deps: update V8 to 5.6.326.55

PR-URL: https://github.com/nodejs/node/pull/10992
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>

44 files changed, 533 insertions, 1344 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-iterator-turbo.js b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
new file mode 100644
index 0000000000..c1b8d32072
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/array-iterator-turbo.js
@@ -0,0 +1,243 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo --turbo-escape --allow-natives-syntax
+
+"use strict";
+
+const kDeoptimized = 2;
+const kTurbofanned = 7;
+const kInterpreted = 8;
+
+function GetOptimizationStatus(fn) {
+  let status = %GetOptimizationStatus(fn);
+  switch (status) {
+  case kInterpreted: // Treat interpreted frames as unoptimized
+    status = kDeoptimized;
+    break;
+  }
+
+  return status;
+}
+
+let global = this;
+let tests = {
+  FastElementsKind() {
+    let runners = {
+      FAST_SMI_ELEMENTS(array) {
+        let sum = 0;
+        for (let x of array) sum += x;
+        return sum;
+      },
+
+      FAST_HOLEY_SMI_ELEMENTS(array) {
+        let sum = 0;
+        for (let x of array) {
+          if (x) sum += x;
+        }
+        return sum;
+      },
+
+      FAST_ELEMENTS(array) {
+        let ret = "";
+        for (let str of array) ret += `> ${str}`;
+        return ret;
+      },
+
+      FAST_HOLEY_ELEMENTS(array) {
+        let ret = "";
+        for (let str of array) ret += `> ${str}`;
+        return ret;
+      },
+
+      FAST_DOUBLE_ELEMENTS(array) {
+        let sum = 0.0;
+        for (let x of array) sum += x;
+          return sum;
+      },
+
+      FAST_HOLEY_DOUBLE_ELEMENTS(array) {
+        let sum = 0.0;
+        for (let x of array) {
+          if (x) sum += x;
+        }
+        return sum;
+      }
+    };
+
+    let tests = {
+      FAST_SMI_ELEMENTS: {
+        array: [1, 2, 3, 4, 5, 6, 7, 8, 9, 10],
+        expected: 55,
+        array2: [1, 2, 3],
+        expected2: 6
+      },
+      FAST_HOLEY_SMI_ELEMENTS: {
+        array: [1, , 3, , 5, , 7, , 9, ,],
+        expected: 25,
+        array2: [1, , 3],
+        expected2: 4
+      },
+      FAST_ELEMENTS: {
+        array: ["a", "b", "c", "d", "e", "f", "g", "h", "i", "j"],
+        expected: "> a> b> c> d> e> f> g> h> i> j",
+        array2: ["a", "b", "c"],
+        expected2: "> a> b> c"
+      },
+      FAST_HOLEY_ELEMENTS: {
+        array: ["a", , "c", , "e", , "g", , "i", ,],
+        expected: "> a> undefined> c> undefined> e> undefined> g" +
+                  "> undefined> i> undefined",
+        array2: ["a", , "c"],
+        expected2: "> a> undefined> c"
+      },
+      FAST_DOUBLE_ELEMENTS: {
+        array: [0.1, 0.2, 0.3, 0.4, 0.5, 0.6, 0.7, 0.8, 0.9, 1.0],
+        expected: 5.5,
+        array2: [0.6, 0.4, 0.2],
+        expected2: 1.2
+      },
+      FAST_HOLEY_DOUBLE_ELEMENTS: {
+        array: [0.1, , 0.3, , 0.5, , 0.7, , 0.9, ,],
+        expected: 2.5,
+        array2: [0.1, , 0.3],
+        expected2: 0.4
+      }
+    };
+
+    for (let key of Object.keys(runners)) {
+      let fn = runners[key];
+      let { array, expected, array2, expected2 } = tests[key];
+
+      // Warmup:
+      fn(array);
+      fn(array);
+      %OptimizeFunctionOnNextCall(fn);
+      fn(array);
+
+      // TODO(bmeurer): FAST_HOLEY_DOUBLE_ELEMENTS maps generally deopt when
+      // a hole is encountered. Test should be fixed once that is corrected.
+      let status = /HOLEY_DOUBLE/.test(key) ? kDeoptimized : kTurbofanned;
+
+      assertEquals(status, GetOptimizationStatus(fn), key);
+      assertEquals(expected, fn(array), key);
+      assertEquals(status, GetOptimizationStatus(fn), key);
+
+      // Check no deopt when another arra with the same map is used
+      assertTrue(%HaveSameMap(array, array2), key);
+      assertEquals(status, GetOptimizationStatus(fn), key);
+      assertEquals(expected2, fn(array2), key);
+
+      // CheckMaps bailout
+      let newArray = Object.defineProperty(
+          [1, 2, 3], 2, { enumerable: false, configurable: false,
+                          get() { return 7; } });
+      fn(newArray);
+      assertEquals(kDeoptimized, GetOptimizationStatus(fn), key);
+    }
+  },
+
+  TypedArrays() {
+    let tests = {
+      Uint8Array: {
+        array: new Uint8Array([1, 2, 3, 4, 5, 6, 7, 8, -1, 256]),
+        expected: 291,
+        array2: new Uint8Array([1, 2, 3]),
+        expected2: 6
+      },
+
+      Int8Array: {
+        array: new Int8Array([1, 2, 3, 4, 5, 6, 7, 8, -129, 128]),
+        expected: 35,
+        array2: new Int8Array([1, 2, 3]),
+        expected2: 6
+      },
+
+      Uint16Array: {
+        array: new Uint16Array([1, 2, 3, 4, 5, 6, 7, 8, -1, 0x10000]),
+        expected: 65571,
+        array2: new Uint16Array([1, 2, 3]),
+        expected2: 6
+      },
+
+      Int16Array: {
+        array: new Int16Array([1, 2, 3, 4, 5, 6, 7, 8, -32769, 0x7FFF]),
+        expected: 65570,
+        array2: new Int16Array([1, 2, 3]),
+        expected2: 6
+      },
+
+      Uint32Array: {
+        array: new Uint32Array([1, 2, 3, 4, 5, 6, 7, 8, -1, 0x100000000]),
+        expected: 4294967331,
+        array2: new Uint32Array([1, 2, 3]),
+        expected2: 6
+      },
+
+      Int32Array: {
+        array: new Int32Array([1, 2, 3, 4, 5, 6, 7, 8,
+                               -2147483649, 0x7FFFFFFF]),
+        expected: 4294967330,
+        array2: new Int32Array([1, 2, 3]),
+        expected2: 6
+      },
+
+      Float32Array: {
+        array: new Float32Array([9.5, 8.0, 7.0, 7.0, 5.0, 4.0, 3.0, 2.0]),
+        expected: 45.5,
+        array2: new Float32Array([10.5, 5.5, 1.5]),
+        expected2: 17.5
+      },
+
+      Float64Array: {
+        array: new Float64Array([9.5, 8.0, 7.0, 7.0, 5.0, 4.0, 3.0, 2.0]),
+        expected: 45.5,
+        array2: new Float64Array([10.5, 5.5, 1.5]),
+        expected2: 17.5
+      },
+
+      Uint8ClampedArray: {
+        array: new Uint8ClampedArray([4.3, 7.45632, 3.14, 4.61, 5.0004, 6.493,
+                                      7.12, 8, 1.7, 3.6]),
+        expected: 51,
+        array2: new Uint8ClampedArray([1, 2, 3]),
+        expected2: 6
+      }
+    };
+
+    for (let key of Object.keys(tests)) {
+      let test = tests[key];
+      let { array, expected, array2, expected2 } = test;
+
+      let sum = function(array) {
+        let ret = 0;
+        for (let x of array) ret += x;
+        return ret;
+      };
+
+      // Warmup
+      sum(array);
+      sum(array);
+      %OptimizeFunctionOnNextCall(sum);
+      assertEquals(expected, sum(array), key);
+
+      assertEquals(kTurbofanned, GetOptimizationStatus(sum), key);
+
+      // Not deoptimized when called on typed array of same type / map
+      assertTrue(%HaveSameMap(array, array2));
+      assertEquals(expected2, sum(array2), key);
+      assertEquals(kTurbofanned, GetOptimizationStatus(sum), key);
+
+      // Throw when detached
+      let clone = new array.constructor(array);
+      %ArrayBufferNeuter(clone.buffer);
+      assertThrows(() => sum(clone), TypeError);
+    }
+  }
+};
+
+for (let name of Object.keys(tests)) {
+  let test = tests[name];
+  test();
+}
diff --git a/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js b/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js
index dca514c294..23cb6c06df 100644
--- a/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js
+++ b/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js
@@ -920,7 +920,6 @@ function TestMapSetSubclassing(container, is_map) {
   assertEquals(["match", "tostring"], log);
   // TODO(littledan): Is the RegExp constructor correct to create
   // the internal slots and do these type checks this way?
-  assertEquals("biep", %_RegExpSource(o));
   assertThrows(() => Object.getOwnPropertyDescriptor(RegExp.prototype,
                                                      'source').get(o),
                TypeError);
diff --git a/deps/v8/test/mjsunit/es6/classes.js b/deps/v8/test/mjsunit/es6/classes.js
index fb77dbb8e4..816d113263 100644
--- a/deps/v8/test/mjsunit/es6/classes.js
+++ b/deps/v8/test/mjsunit/es6/classes.js
@@ -164,14 +164,15 @@
                SyntaxError);
 
   var D = class extends function() {
-    arguments.caller;
+    this.args = arguments;
   } {};
   assertThrows(function() {
     Object.getPrototypeOf(D).arguments;
   }, TypeError);
-  assertThrows(function() {
-    new D;
-  }, TypeError);
+  var e = new D();
+  assertThrows(() => e.args.callee, TypeError);
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(e.args, 'caller'));
+  assertFalse('caller' in e.args);
 })();
 
 
diff --git a/deps/v8/test/mjsunit/es6/completion.js b/deps/v8/test/mjsunit/es6/completion.js
index 988e9709bb..6bc7d47a02 100644
--- a/deps/v8/test/mjsunit/es6/completion.js
+++ b/deps/v8/test/mjsunit/es6/completion.js
@@ -146,3 +146,10 @@ assertUndef(eval(
 assertUndef(eval("1; try{2; throwOnReturn();} catch(e){}"));
 assertUndef(eval("1; twoFunc();"));
 assertEquals(2, eval("1; with ( { a: 0 } ) { 2; }"));
+
+assertUndef(eval('a: while(true) { do { 0 } while(false); switch(1) { case 0: 1; case 1: break a; }; 0 }'));
+assertUndef(eval('a: while(true) { do { 0 } while(false); try {} finally { break a }; 0 }'));
+assertUndef(eval('a: while(true) { b: while(true) { 0; break b; }; switch(1) { case 1: break a; }; 2 }'));
+assertUndef(eval('a: while(true) { b: while(true) { 0; break b; }; while (true) { break a; }; 2 }'));
+assertUndef(eval('while (true) { 20; a:{ break a; }  with ({}) break; 30; }'));
+assertEquals(42, eval('a: while(true) { switch(0) { case 0: 42; case 1: break a; }; 33 }'));
diff --git a/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js b/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js
deleted file mode 100644
index fc8bebd13d..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-"use strict";
-
-var Debug = debug.Debug;
-var exception = null;
-var super_called = false;
-var step_count = 0;
-
-function listener(event, execState, eventData, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    execState.prepareStep(Debug.StepAction.StepIn);
-    var s = execState.frame().sourceLineText();
-    step_count++;
-    assertTrue(s.indexOf('// ' + step_count + '.') >= 0);
-  } catch (e) {
-    exception = e;
-  }
-}
-
-class Base {
-  constructor() {
-    var x = 1;     // 2.
-  }                // 3.
-}
-
-class Derived extends Base {}  // 1. // 4.
-
-Debug.setListener(listener);
-var bp = Debug.setBreakPoint(Derived, 0);
-
-new Derived();
-
-Debug.setListener(null);  // 5.
-
-assertNull(exception);
-assertEquals(5, step_count);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/async-task-event.js b/deps/v8/test/mjsunit/es6/debug-promises/async-task-event.js
deleted file mode 100644
index 0b0fa1e64f..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/async-task-event.js
+++ /dev/null
@@ -1,63 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-Debug = debug.Debug;
-
-var base_id = -1;
-var exception = null;
-var expected = [
-  "enqueue #1",
-  "willHandle #1",
-  "then #1",
-  "enqueue #2",
-  "didHandle #1",
-  "willHandle #2",
-  "then #2",
-  "didHandle #2",
-  "enqueue #3",
-  "willHandle #3",
-  "didHandle #3"
-];
-
-function assertLog(msg) {
-  print(msg);
-  assertTrue(expected.length > 0);
-  assertEquals(expected.shift(), msg);
-  if (!expected.length) {
-    Debug.setListener(null);
-  }
-}
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.AsyncTaskEvent) return;
-  try {
-    if (base_id < 0)
-      base_id = event_data.id();
-    var id = event_data.id() - base_id + 1;
-    assertEquals("Promise.resolve", event_data.name());
-    assertLog(event_data.type() + " #" + id);
-  } catch (e) {
-    print(e + e.stack)
-    exception = e;
-  }
-}
-
-Debug.setListener(listener);
-
-var resolver;
-var p = new Promise(function(resolve, reject) {
-  resolver = resolve;
-});
-p.then(function() {
-  assertLog("then #1");
-}).then(function() {
-  assertLog("then #2");
-});
-resolver();
-
-%RunMicrotasks();
-
-assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/evaluate-across-microtasks.js b/deps/v8/test/mjsunit/es6/debug-promises/evaluate-across-microtasks.js
deleted file mode 100644
index 73718eec7b..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/evaluate-across-microtasks.js
+++ /dev/null
@@ -1,66 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-var Debug = debug.Debug;
-var listenerComplete = false;
-var exception = null;
-var count = 0;
-var log = [];
-var done = false;
-
-function LogX(x) {
-  var stored_count = count;
-  return function() {
-    log.push(`[${stored_count}] ${x}`);
-  };
-}
-
-function DebuggerStatement() {
-  log.push(`[${count}] debugger`);
-  if (count++ < 3) {
-    debugger;
-  }
-}
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    var p = Promise.resolve();
-    var q = p.then(LogX("then 1"));
-    p.then(LogX("then 2"));
-    q.then(LogX("then 3"));
-    q.then(DebuggerStatement);
-    var r = q.then(() => { throw 1; });
-    r.catch(LogX("catch"));
-    listenerComplete = true;
-  } catch (e) {
-    exception = e;
-    print(e, e.stack);
-    quit(1);
-  };
-};
-
-// Add the debug event listener.
-Debug.setListener(listener);
-
-DebuggerStatement();
-LogX("start")();
-
-// Make sure that the debug event listener was invoked.
-assertTrue(listenerComplete);
-
-%RunMicrotasks();
-
-var expectation =
-  [ "[0] debugger", "[1] start", "[1] then 1",
-    "[1] then 2", "[1] then 3", "[1] debugger",
-    "[2] then 1", "[2] then 2", "[1] catch",
-    "[2] then 3", "[2] debugger", "[3] then 1",
-    "[3] then 2", "[2] catch", "[3] then 3",
-    "[3] debugger", "[3] catch",
-  ];
-
-assertEquals(expectation, log);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/promise-all-caught.js b/deps/v8/test/mjsunit/es6/debug-promises/promise-all-caught.js
deleted file mode 100644
index 2c940ce217..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/promise-all-caught.js
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions and a
-// Promise p3 created by Promise.all has a catch handler, and is rejected
-// because one of the Promises p2 passed to Promise.all is rejected. We
-// expect no Exception debug event to be triggered, since p3 and by
-// extension p2 have a catch handler.
-
-var Debug = debug.Debug;
-
-var expected_events = 2;
-
-var p1 = Promise.resolve();
-p1.name = "p1";
-
-var p2 = p1.then(function() {
-  throw new Error("caught");
-});
-
-p2.name = "p2";
-
-var p3 = Promise.all([p2]);
-p3.name = "p3";
-
-p3.catch(function(e) {});
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception)
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/promise-race-caught.js b/deps/v8/test/mjsunit/es6/debug-promises/promise-race-caught.js
deleted file mode 100644
index dd3ca83ee8..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/promise-race-caught.js
+++ /dev/null
@@ -1,40 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions and a
-// Promise p3 created by Promise.race has a catch handler, and is rejected
-// because one of the Promises p2 passed to Promise.all is rejected. We
-// expect no Exception debug event to be triggered, since p3 and by
-// extension p2 have a catch handler.
-
-var Debug = debug.Debug;
-
-var expected_events = 2;
-
-var p1 = Promise.resolve();
-p1.name = "p1";
-
-var p2 = p1.then(function() {
-  throw new Error("caught");
-});
-
-p2.name = "p2";
-
-var p3 = Promise.all([p2]);
-p3.name = "p3";
-
-p3.catch(function(e) {});
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception)
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reentry.js b/deps/v8/test/mjsunit/es6/debug-promises/reentry.js
deleted file mode 100644
index cc98ed9efd..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/reentry.js
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-// Test reentry of special try catch for Promises.
-
-Debug = debug.Debug;
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(function(event, exec_state, event_data, data) { });
-
-var p = new Promise(function(resolve, reject) { resolve(); });
-var q = p.then(function() {
-  new Promise(function(resolve, reject) { resolve(); });
-});
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js
deleted file mode 100644
index 5ec2da50e9..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we listen to uncaught exceptions and
-// the Promise is rejected in a chained closure after it has been resolved.
-// We expect no Exception debug event to be triggered.
-
-Debug = debug.Debug;
-
-var log = [];
-
-var p = new Promise(function(resolve, reject) {
-  log.push("resolve");
-  resolve(reject);
-});
-
-var q = p.then(
-  function(value) {
-    assertEquals(["resolve", "end main"], log);
-    value(new Error("reject"));
-  });
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception);
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnException();
-Debug.setListener(listener);
-
-log.push("end main");
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js
deleted file mode 100644
index 44eb76728f..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions, the Promise
-// is rejected, and a catch handler is installed right before the rejection.
-// We expect no debug event to be triggered.
-
-Debug = debug.Debug;
-
-var p = new Promise(function(resolve, reject) {
-  resolve();
-});
-
-var q = p.then(
-  function() {
-    q.catch(function(e) {
-      assertEquals("caught", e.message);
-    });
-    return Promise.reject(Error("caught"));
-  });
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception);
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js
deleted file mode 100644
index b2fe8b0a45..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions and
-// there is a catch handler for the to-be-rejected Promise.
-// We expect no debug event to be triggered.
-
-Debug = debug.Debug;
-
-var p = new Promise(function(resolve, reject) {
-  resolve();
-});
-
-var q = p.then(
-  function() {
-    return Promise.reject(Error("caught reject"));
-  });
-
-q.catch(
-  function(e) {
-    assertEquals("caught reject", e.message);
-  });
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception);
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js b/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js
deleted file mode 100644
index 6914ae0036..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js
+++ /dev/null
@@ -1,47 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-var Debug = debug.Debug;
-var exception = null;
-var breaks = [];
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    breaks.push(exec_state.frame(0).sourceLineText().trimLeft());
-    exec_state.prepareStep(Debug.StepAction.StepIn);
-  } catch (e) {
-    exception = e;
-  }
-}
-
-Debug.setListener(listener);
-
-function resolver(resolve, reject) {
-  print(1);
-  print(2);
-  print(3);
-  resolve();
-}
-
-debugger;
-var p = new Promise(resolver);
-
-Debug.setListener(null);
-
-var expected_breaks = [
-  "debugger;",
-  "var p = new Promise(resolver);",
-  "print(1);",
-  "print(2);",
-  "print(3);",
-  "resolve();",
-  "}",
-  "Debug.setListener(null);"
-];
-
-assertEquals(expected_breaks, breaks);
-assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js b/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js
deleted file mode 100644
index 8083c17103..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js
+++ /dev/null
@@ -1,65 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax --noalways-opt
-// Tests stepping into through Promises.
-
-Debug = debug.Debug
-var exception = null;
-var break_count = 0;
-var expected_breaks = -1;
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    if (event == Debug.DebugEvent.Break) {
-      assertTrue(exec_state.frameCount() != 0, "FAIL: Empty stack trace");
-      if (!break_count) {
-        // Count number of expected breakpoints in this source file.
-        var source_text = exec_state.frame(0).func().script().source();
-        expected_breaks = source_text.match(/\/\/\s*Break\s+\d+\./g).length;
-        print("Expected breaks: " + expected_breaks);
-      }
-      var source = exec_state.frame(0).sourceLineText();
-      print("paused at: " + source);
-      assertTrue(source.indexOf("// Break " + break_count + ".") > 0,
-                 "Unexpected pause at: " + source + "\n" +
-                 "Expected: // Break " + break_count + ".");
-      ++break_count;
-      if (break_count !== expected_breaks) {
-        exec_state.prepareStep(Debug.StepAction.StepIn);
-      }
-    }
-  } catch(e) {
-    exception = e;
-    print(e, e.stack);
-  }
-};
-
-Debug.setListener(listener);
-
-Promise.resolve(42)
-  .then(
-    function f0() {
-      debugger;  // Break 0.
-    } // Break 1.
-  )
-  .then(callback)
-  .then(callback.bind(null))
-  .then(Object)
-  .then(callback.bind(null).bind(null))
-  .then(finalize)
-  .catch(function(err) {
-    %AbortJS("FAIL: " + err);
-  });
-
-function callback(x) {
-  return x; // Break 2. // Break 4. // Break 6.
-} // Break 3. // Break 5. // Break 7.
-
-function finalize() {
-  assertNull(exception); // Break 8.
-  assertEquals(expected_breaks, break_count);
-
-  Debug.setListener(null);
-}
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js
deleted file mode 100644
index 0399e5cc34..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js
+++ /dev/null
@@ -1,34 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions, the Promise
-// throws, and a catch handler is installed right before throwing.
-// We expect no debug event to be triggered.
-
-Debug = debug.Debug;
-
-var p = new Promise(function(resolve, reject) {
-  resolve();
-});
-
-var q = p.then(
-  function() {
-    q.catch(function(e) {
-      assertEquals("caught", e.message);
-    });
-    throw new Error("caught");
-  });
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception);
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js
deleted file mode 100644
index 8e1524d519..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions and
-// there is a catch handler for the exception thrown in a Promise.
-// We expect no debug event to be triggered.
-
-Debug = debug.Debug;
-
-var p = new Promise(function(resolve, reject) {
-  resolve();
-});
-
-var q = p.then(
-  function() {
-    throw new Error("caught throw");
-  });
-
-q.catch(
-  function(e) {
-    assertEquals("caught throw", e.message);
-  });
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception);
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-eventually-caught.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-eventually-caught.js
deleted file mode 100644
index 19610f77e8..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-eventually-caught.js
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --allow-natives-syntax
-
-// Test debug events when we only listen to uncaught exceptions and
-// there is a catch handler for the to-be-rejected Promise.
-// We expect no Exception debug events, since the default reject handler passes
-// the rejection on to a user-defined reject handler.
-
-Debug = debug.Debug;
-
-var resolve, reject;
-var p0 = new Promise(function(res, rej) { resolve = res; reject = rej; });
-
-var p1 = p0.then(function() {
-  throw new Error();
-});
-
-var p2 = p1.then(function() { });
-var p3 = p2.catch(function() { });
-
-var q = new Promise(function(res, rej) {
-  res();
-});
-
-q.then(function() {
-  resolve();
-})
-
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    assertTrue(event != Debug.DebugEvent.Exception);
-  } catch (e) {
-    %AbortJS(e + "\n" + e.stack);
-  }
-}
-
-Debug.setBreakOnUncaughtException();
-Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/es6/debug-step-destructuring-assignment.js b/deps/v8/test/mjsunit/es6/debug-step-destructuring-assignment.js
deleted file mode 100644
index 4fde928b38..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-step-destructuring-assignment.js
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-var exception = null;
-var Debug = debug.Debug;
-var break_count = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    var source = exec_state.frame(0).sourceLineText();
-    print(source);
-    assertTrue(source.indexOf(`// B${break_count++}`) > 0);
-    if (source.indexOf("assertEquals") > 0) {
-      exec_state.prepareStep(Debug.StepAction.StepNext);
-    } else {
-      exec_state.prepareStep(Debug.StepAction.StepIn);
-    }
-  } catch (e) {
-    exception = e;
-    print(e);
-  }
-};
-
-Debug.setListener(listener);
-
-function f() {
-  var a, b, c, d;
-  debugger;                                       // B0
-  [                                               // B1
-    a,                                            // B2
-    b,                                            // B3
-    c = 3                                         // B4
-  ] = [1, 2];
-  assertEquals({a:1,b:2,c:3}, {a, b, c});         // B5
-
-  [                                               // B6
-    a,                                            // B7
-    [
-      b,                                          // B8
-      c                                           // B9
-    ],
-    d                                             // B10
-  ] = [5, [6, 7], 8];
-  assertEquals({a:5,b:6,c:7,d:8}, {a, b, c, d});  // B11
-
-  [                                               // B12
-    a,                                            // B13
-    b,                                            // B14
-    ...c                                          // B15
-  ] = [1, 2, 3, 4];
-  assertEquals({a:1,b:2,c:[3,4]}, {a, b, c});     // B16
-
-  ({                                              // B17
-    a,                                            // B18
-    b,                                            // B19
-    c = 7                                         // B20
-  } = {a: 5, b: 6});
-  assertEquals({a:5,b:6,c:7}, {a, b, c});         // B21
-
-  ({                                              // B22
-    a,                                            // B23
-    b = return1(),                                // B24
-    c = return1()                                 // B25
-  } = {a: 5, b: 6});
-  assertEquals({a:5,b:6,c:1}, {a, b, c});         // B28
-
-  ({                                              // B29
-    x : a,                                        // B30
-    y : b,                                        // B31
-    z : c = 3                                     // B32
-  } = {x: 1, y: 2});
-  assertEquals({a:1,b:2,c:3}, {a, b, c});         // B33
-}                                                 // B34
-
-function return1() {
-  return 1;                                       // B26
-}                                                 // B27
-
-f();
-Debug.setListener(null);                          // B35
-assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-step-destructuring-bind.js b/deps/v8/test/mjsunit/es6/debug-step-destructuring-bind.js
deleted file mode 100644
index f670f525af..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-step-destructuring-bind.js
+++ /dev/null
@@ -1,110 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-var exception = null;
-var Debug = debug.Debug;
-var break_count = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    var source = exec_state.frame(0).sourceLineText();
-    print(source, break_count);
-    assertTrue(source.indexOf(`B${break_count++}`) > 0);
-    if (source.indexOf("assertEquals") > 0) {
-      exec_state.prepareStep(Debug.StepAction.StepNext);
-    } else {
-      exec_state.prepareStep(Debug.StepAction.StepIn);
-    }
-  } catch (e) {
-    exception = e;
-    print(e);
-  }
-};
-
-Debug.setListener(listener);
-
-var id = x => x;                                  // B9 B10 B36 B37
-
-function test() {
-  debugger;                                       // B0
-  function fx1([
-                a,                                // B2
-                b                                 // B3
-              ]) {
-    assertEquals([1, 2], [a, b]);                 // B4
-  }                                               // B5
-  fx1([1, 2, 3]);                                 // B1
-
-  function f2([
-                a,                                // B7
-                b = id(3)                         // B8
-              ]) {
-    assertEquals([4, 3], [a, b]);                 // B11
-  }                                               // B12
-  f2([4]);                                        // B6
-
-  function f3({
-                x: a,                             // B14
-                y: b                              // B15
-              }) {
-    assertEquals([5, 6], [a, b]);                 // B16
-  }                                               // B17
-  f3({y: 6, x: 5});                               // B13
-
-  function f4([
-                a,                                // B19
-                {
-                  b,                              // B20
-                  c,                              // B21
-                }
-              ]) {
-    assertEquals([2, 4, 6], [a, b, c]);           // B22
-  }                                               // B23
-  f4([2, {c: 6, b: 4}]);                          // B18
-
-  function f5([
-                {
-                  a,                              // B25
-                  b = 7                           // B26
-                },
-                c = 3                             // B27
-              ] = [{a:1}]) {
-    assertEquals([1, 7, 3], [a, b, c]);           // B28
-  }                                               // B29
-  f5();                                           // B24
-
-  var name = "x";                                 // B30
-  function f6({
-                [id(name)]: a,                    // B34 B35
-                b = a                             // B38
-              }) {
-    assertEquals([9, 9], [a, b]);                 // B39
-  }                                               // B40
-  var o6 = {};                                    // B31
-  o6[name] = 9;                                   // B32
-  f6(o6);                                         // B33
-
-  try {
-    throw [3, 4];                                 // B41
-  } catch ([
-             a,                                   // B42
-             b,                                   // B43
-             c = 6                                // B44
-           ]) {
-    assertEquals([3, 4, 6], [a, b, c]);           // B45
-  }
-
-  var {
-    x: a,                                         // B46
-    y: b = 9                                      // B47
-  } = { x: 4 };
-  assertEquals([4, 9], [a, b]);                   // B48
-}                                                 // B49
-
-test();
-Debug.setListener(null);                          // B50
-assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js b/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js
deleted file mode 100644
index 6c887ab08d..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js
+++ /dev/null
@@ -1,42 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-'use strict';
-
-var Debug = debug.Debug
-
-var done = false;
-var stepCount = 0;
-
-function listener(event, execState, eventData, data) {
-  if (event == Debug.DebugEvent.Break) {
-    if (!done) {
-      execState.prepareStep(Debug.StepAction.StepIn);
-      var s = execState.frame().sourceLineText();
-      assertTrue(s.indexOf('// ' + stepCount + '.') !== -1);
-      stepCount++;
-    }
-  }
-};
-
-Debug.setListener(listener);
-
-function GetBase() {
-  var x = 1;   // 1.
-  var y = 2;   // 2.
-  done = true; // 3.
-  return null;
-}
-
-function f() {
-  class Derived extends GetBase() {} // 0.
-}
-
-var bp = Debug.setBreakPoint(f, 0);
-f();
-assertEquals(4, stepCount);
-
-Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js b/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js
deleted file mode 100644
index 96cdc93159..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js
+++ /dev/null
@@ -1,113 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-'use strict';
-
-var Debug = debug.Debug
-var done, stepCount;
-
-function listener(event, execState, eventData, data) {
-  if (event == Debug.DebugEvent.Break) {
-    if (!done) {
-      execState.prepareStep(Debug.StepAction.StepIn);
-      var s = execState.frame().sourceLineText();
-      assertTrue(s.indexOf('// ' + stepCount + '.') !== -1);
-      stepCount++;
-    }
-  }
-};
-
-Debug.setListener(listener);
-
-
-class Base {
-  constructor() { // 1.
-    var x = 1;    // 2.
-    var y = 2;    // 3.
-    done = true;  // 4.
-  }
-}
-
-class Derived extends Base {}
-
-
-(function TestBreakPointInConstructor() {
-  done = false;
-  stepCount = 1;
-  var bp = Debug.setBreakPoint(Base, 0);
-
-  new Base();
-  assertEquals(1, stepCount);
-
-  Debug.clearBreakPoint(bp);
-})();
-
-
-(function TestDefaultConstructor() {
-  done = false;
-  stepCount = 1;
-
-  var bp = Debug.setBreakPoint(Base, 0);
-  new Derived();
-  assertEquals(1, stepCount);
-
-  Debug.clearBreakPoint(bp);
-})();
-
-
-(function TestStepInto() {
-  done = false;
-  stepCount = 0;
-
-  function f() {
-    new Derived();  // 0.
-  }
-
-  var bp = Debug.setBreakPoint(f, 0);
-  f();
-  assertEquals(1, stepCount);
-
-  Debug.clearBreakPoint(bp);
-})();
-
-
-(function TestExtraIndirection() {
-  done = false;
-  stepCount = 0;
-
-  class Derived2 extends Derived {}
-
-  function f() {
-    new Derived2();  // 0.
-  }
-
-  var bp = Debug.setBreakPoint(f, 0);
-  f();
-  assertEquals(1, stepCount);
-
-  Debug.clearBreakPoint(bp);
-})();
-
-
-(function TestBoundClass() {
-  done = false;
-  stepCount = 0;
-
-  var bound = Derived.bind(null);
-
-  function f() {
-    new bound();  // 0.
-  }
-
-  var bp = Debug.setBreakPoint(f, 0);
-  f();
-  assertEquals(1, stepCount);
-
-  Debug.clearBreakPoint(bp);
-})();
-
-
-Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/es6/debug-step-into-regexp-subclass.js b/deps/v8/test/mjsunit/es6/debug-step-into-regexp-subclass.js
deleted file mode 100644
index 5e5eb47d7f..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-step-into-regexp-subclass.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-Debug = debug.Debug
-
-var exception = null;
-var break_count = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    print(event_data.sourceLineText());
-    assertTrue(
-        event_data.sourceLineText().indexOf(`Break ${break_count++}.`) > 0);
-    exec_state.prepareStep(Debug.StepAction.StepIn);
-  } catch (e) {
-    exception = e;
-  }
-};
-
-function customSplit() {
-  return "x";              // Break 2.
-}                          // Break 3.
-var o = {};
-o[Symbol.split] = customSplit;
-
-Debug.setListener(listener);
-debugger;                  // Break 0.
-var result = "".split(o);  // Break 1.
-Debug.setListener(null);   // Break 4.
-
-assertEquals("x", result);
-assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js b/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js
deleted file mode 100644
index 5551843cb2..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js
+++ /dev/null
@@ -1,100 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --expose-debug-as debug
-
-Debug = debug.Debug
-
-var exception = null;
-
-function listener(event, exec_state, event_data, data) {
-  try {
-    if (event == Debug.DebugEvent.Break) {
-      exec_state.prepareStep(Debug.StepAction.StepIn);
-      print(event_data.sourceLineText());
-      assertTrue(
-          event_data.sourceLineText().indexOf(`B${breaks++}`) > 0);
-    }
-  } catch (e) {
-    print(e);
-    quit();
-    exception = e;
-  }
-}
-
-function cb_set(num) {
-  print("element " + num);  // B2 B5 B8
-  return true;              // B3 B6 B9
-}                           // B4 B7 B10
-
-function cb_map(key, val) {
-  print("key " + key + ", value " + val);  // B2 B5 B8
-  return true;                             // B3 B6 B9
-}                                          // B4 B7 B10
-
-var s = new Set();
-s.add(1);
-s.add(2);
-s.add(3);
-
-var m = new Map();
-m.set('foo', 1);
-m.set('bar', 2);
-m.set('baz', 3);
-
-var breaks = 0;
-Debug.setListener(listener);
-debugger;                 // B0
-s.forEach(cb_set);        // B1
-Debug.setListener(null);  // B11
-assertNull(exception);
-assertEquals(12, breaks);
-
-breaks = 0;
-Debug.setListener(listener);
-debugger;                 // B0
-m.forEach(cb_map);        // B1
-Debug.setListener(null);  // B11
-assertNull(exception);
-assertEquals(12, breaks);
-
-// Test two levels of builtin callbacks:
-// Array.forEach calls a callback function, which by itself uses
-// Array.forEach with another callback function.
-
-function cb_set_2(num) {
-  print("element " + num);  // B3 B6 B9  B15 B18 B21 B27 B30 B33
-  return true;              // B4 B7 B10 B16 B19 B22 B28 B31 B34
-}                           // B5 B8 B11 B17 B20 B23 B29 B32 B35
-
-function cb_map_2(k, v) {
-  print(`key ${k}, value ${v}`);  // B3 B6 B9  B15 B18 B21 B27 B30 B33
-  return true;                    // B4 B7 B10 B16 B19 B22 B28 B31 B34
-}                                 // B5 B8 B11 B17 B20 B23 B29 B32 B35
-
-function cb_set_foreach(num) {
-  s.forEach(cb_set_2);      // B2  B14 B26
-  print("back.");           // B12 B24 B36
-}                           // B13 B25 B37
-
-function cb_map_foreach(key, val) {
-  m.forEach(cb_map_2);      // B2  B14 B26
-  print("back.");           // B12 B24 B36
-}                           // B13 B25 B37
-
-breaks = 0;
-Debug.setListener(listener);
-debugger;                   // B0
-s.forEach(cb_set_foreach);  // B1
-Debug.setListener(null);    // B38
-assertNull(exception);
-assertEquals(39, breaks);
-
-breaks = 0;
-Debug.setListener(listener);
-debugger;                   // B0
-m.forEach(cb_map_foreach);  // B1
-Debug.setListener(null);    // B38
-assertNull(exception);
-assertEquals(39, breaks);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-generators.js b/deps/v8/test/mjsunit/es6/debug-stepin-generators.js
deleted file mode 100644
index 081dfb7063..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-stepin-generators.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-Debug = debug.Debug
-var exception = null;
-var yields = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    var source = exec_state.frame(0).sourceLineText();
-    print(source);
-    if (/stop stepping/.test(source)) return;
-    if (/yield/.test(source)) yields++;
-    exec_state.prepareStep(Debug.StepAction.StepIn);
-  } catch (e) {
-    print(e, e.stack);
-    exception = e;
-  }
-};
-
-Debug.setListener(listener);
-
-function* g() {
-  for (var i = 0; i < 3; ++i) {
-    yield i;
-  }
-}
-
-var i = g();
-debugger;
-for (var num of g()) {}
-i.next();
-
-print(); // stop stepping
-
-// Not stepped into.
-i.next();
-i.next();
-
-assertNull(exception);
-assertEquals(4, yields);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js b/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js
index e541f0f4b4..9e3bd172c8 100644
--- a/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js
+++ b/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js
@@ -7,18 +7,12 @@
 Debug = debug.Debug
 var exception = null;
 var break_count = 0;
-var expected_breaks = -1;
+const expected_breaks = 9;
 
 function listener(event, exec_state, event_data, data) {
   try {
     if (event == Debug.DebugEvent.Break) {
       assertTrue(exec_state.frameCount() != 0, "FAIL: Empty stack trace");
-      if (!break_count) {
-        // Count number of expected breakpoints in this source file.
-        var source_text = exec_state.frame(0).func().script().source();
-        expected_breaks = source_text.match(/\/\/\s*Break\s+\d+\./g).length;
-        print("Expected breaks: " + expected_breaks);
-      }
       var source = exec_state.frame(0).sourceLineText();
       print("paused at: " + source);
       assertTrue(source.indexOf("// Break " + break_count + ".") > 0,
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-tailcalls.js b/deps/v8/test/mjsunit/es6/debug-stepin-tailcalls.js
deleted file mode 100644
index 6020ba9d50..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-stepin-tailcalls.js
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --harmony-tailcalls
-
-"use strict";
-
-var Debug = debug.Debug
-var exception = null;
-var breaks = 0;
-
-function f(x) {
-  if (x > 0) {            // B3 B5 B7 B9
-    return f(x - 1);      // B4 B6 B8
-  }
-}                         // B10
-
-function g(x) {
-  return f(x);            // B2
-}
-
-function h(x) {
-  debugger;               // B0
-  g(x);                   // B1
-}                         // B11
-
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    print(event_data.sourceLineText());
-    assertTrue(event_data.sourceLineText().indexOf(`B${breaks++}`) > 0);
-    exec_state.prepareStep(Debug.StepAction.StepIn);
-  } catch (e) {
-    exception = e;
-  };
-};
-
-Debug.setListener(listener);
-
-h(3);
-
-Debug.setListener(null);  // B12
-assertNull(exception);
-assertEquals(13, breaks);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepout-tailcalls.js b/deps/v8/test/mjsunit/es6/debug-stepout-tailcalls.js
deleted file mode 100644
index db0878d7a9..0000000000
--- a/deps/v8/test/mjsunit/es6/debug-stepout-tailcalls.js
+++ /dev/null
@@ -1,45 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug --harmony-tailcalls
-
-"use strict";
-
-var Debug = debug.Debug
-var exception = null;
-var breaks = 0;
-
-function f(x) {
-  if (x > 0) {
-    return f(x - 1);      // Tail call
-  }
-  debugger;               // Break 0
-}
-
-function g(x) {
-  return f(x);            // Tail call
-}
-
-function h(x) {
-  g(x);                   // Not tail call
-}                         // Break 1
-
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    assertTrue(event_data.sourceLineText().indexOf(`Break ${breaks++}`) > 0);
-    exec_state.prepareStep(Debug.StepAction.StepOut);
-  } catch (e) {
-    exception = e;
-  };
-};
-
-Debug.setListener(listener);
-
-h(3);
-
-Debug.setListener(null);  // Break 2
-assertNull(exception);
-assertEquals(3, breaks);
diff --git a/deps/v8/test/mjsunit/es6/default-parameters-debug.js b/deps/v8/test/mjsunit/es6/default-parameters-debug.js
index 30e19c42af..49adfa4610 100644
--- a/deps/v8/test/mjsunit/es6/default-parameters-debug.js
+++ b/deps/v8/test/mjsunit/es6/default-parameters-debug.js
@@ -9,36 +9,31 @@ Debug = debug.Debug
 
 listenerComplete = false;
 breakPointCount = 0;
+exception = null;
 
 function listener(event, exec_state, event_data, data) {
-  if (event == Debug.DebugEvent.Break) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
     breakPointCount++;
     if (breakPointCount == 1) {
       // Break point in initializer for parameter `a`, invoked by
       // initializer for parameter `b`
-      assertEquals('default', exec_state.frame(1).evaluate('mode').value());
-
-      // initializer for `b` can't refer to `b`
-      assertThrows(function() {
-        exec_state.frame(1).evaluate('b').value();
-      }, ReferenceError);
-
-      assertThrows(function() {
-        exec_state.frame(1).evaluate('c');
-      }, ReferenceError);
+      assertEquals('default', exec_state.frame(0).evaluate('mode').value());
+      assertTrue(exec_state.frame(1).evaluate('b').isUndefined());
+      assertTrue(exec_state.frame(1).evaluate('c').isUndefined());
     } else if (breakPointCount == 2) {
       // Break point in IIFE initializer for parameter `c`
       assertEquals('modeFn', exec_state.frame(1).evaluate('a.name').value());
       assertEquals('default', exec_state.frame(1).evaluate('b').value());
-      assertThrows(function() {
-        exec_state.frame(1).evaluate('c');
-      }, ReferenceError);
+      assertTrue(exec_state.frame(1).evaluate('c').isUndefined());
     } else if (breakPointCount == 3) {
       // Break point in function body --- `c` parameter is shadowed
       assertEquals('modeFn', exec_state.frame(0).evaluate('a.name').value());
       assertEquals('default', exec_state.frame(0).evaluate('b').value());
       assertEquals('local', exec_state.frame(0).evaluate('d').value());
     }
+  } catch (e) {
+    exception = e;
   }
 };
 
@@ -56,3 +51,4 @@ f();
 
 // Make sure that the debug event listener vas invoked.
 assertEquals(3, breakPointCount);
+assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/generators-relocation.js b/deps/v8/test/mjsunit/es6/generators-relocation.js
deleted file mode 100644
index 2636f52d7b..0000000000
--- a/deps/v8/test/mjsunit/es6/generators-relocation.js
+++ /dev/null
@@ -1,61 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-var Debug = debug.Debug;
-
-function assertIteratorResult(value, done, result) {
-  assertEquals({value: value, done: done}, result);
-}
-
-function RunTest(formals_and_body, args, value1, value2) {
-  // A null listener. It isn't important what the listener does.
-  function listener(event, exec_state, event_data, data) {
-  }
-
-  // Create the generator function outside a debugging context. It will probably
-  // be lazily compiled.
-  var gen = (function*(){}).constructor.apply(null, formals_and_body);
-
-  // Instantiate the generator object.
-  var obj = gen.apply(null, args);
-
-  // Advance to the first yield.
-  assertIteratorResult(value1, false, obj.next());
-
-  // Enable the debugger, which should force recompilation of the generator
-  // function and relocation of the suspended generator activation.
-  Debug.setListener(listener);
-
-  // Add a breakpoint on line 3 (the second yield).
-  var bp = Debug.setBreakPoint(gen, 3);
-
-  // Check that the generator resumes and suspends properly.
-  assertIteratorResult(value2, false, obj.next());
-
-  // Disable debugger -- should not force recompilation.
-  Debug.clearBreakPoint(bp);
-  Debug.setListener(null);
-
-  // Run to completion.
-  assertIteratorResult(undefined, true, obj.next());
-}
-
-function prog(a, b, c) {
-  return a + ';\n' + 'yield ' + b + ';\n' + 'yield ' + c;
-}
-
-// Simple empty local scope.
-RunTest([prog('', '1', '2')], [], 1, 2);
-
-RunTest([prog('for (;;) break', '1', '2')], [], 1, 2);
-
-RunTest([prog('while (0) foo()', '1', '2')], [], 1, 2);
-
-RunTest(['a', prog('var x = 3', 'a', 'x')], [1], 1, 3);
-
-RunTest(['a', prog('', '1', '2')], [42], 1, 2);
-
-RunTest(['a', prog('for (;;) break', '1', '2')], [42], 1, 2);
diff --git a/deps/v8/test/mjsunit/es6/reflect.js b/deps/v8/test/mjsunit/es6/reflect.js
index d597a78901..9e21717a99 100644
--- a/deps/v8/test/mjsunit/es6/reflect.js
+++ b/deps/v8/test/mjsunit/es6/reflect.js
@@ -273,6 +273,14 @@ function prepare(target) {
 })();
 
 
+(function testReflectSetArrayLength() {
+  var y = [];
+  Object.defineProperty(y, 0, {value: 42, configurable: false});
+  assertFalse(Reflect.set(y, 'length', 0));
+  assertTrue(Reflect.set(y, 'length', 2));
+})();
+
+
 
 ////////////////////////////////////////////////////////////////////////////////
 // Reflect.has
@@ -352,6 +360,14 @@ function prepare(target) {
 })();
 
 
+(function testReflectDefinePropertyArrayLength() {
+  var y = [];
+  Object.defineProperty(y, 0, {value: 42, configurable: false});
+  assertFalse(Reflect.defineProperty(y, 'length', {value: 0}));
+  assertTrue(Reflect.defineProperty(y, 'length', {value: 2}));
+})();
+
+
 // See reflect-define-property.js for further tests.
 
 
diff --git a/deps/v8/test/mjsunit/es6/regexp-flags.js b/deps/v8/test/mjsunit/es6/regexp-flags.js
index 2bcccfa760..9760cf8d5d 100644
--- a/deps/v8/test/mjsunit/es6/regexp-flags.js
+++ b/deps/v8/test/mjsunit/es6/regexp-flags.js
@@ -45,8 +45,12 @@ assertEquals(4, get_count);
 // Overridden flag getters affect string.replace
 // TODO(adamk): Add more tests here once we've switched
 // to use [[OriginalFlags]] in more cases.
-assertEquals(expected, string.replace(r3, "X"));
-assertEquals(5, get_count);
+// TODO(jgruber): This exact case actually causes an infinite loop in the spec
+// (@@replace sees global = true while BuiltinExec sees global = false).
+// Comment the test for now and remove / fix once this has been resolved on
+// the spec side.
+//assertEquals(expected, string.replace(r3, "X"));
+//assertEquals(5, get_count);
 
 
 function testName(name) {
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-3280.js b/deps/v8/test/mjsunit/es6/regress/regress-3280.js
deleted file mode 100644
index 2dadd02840..0000000000
--- a/deps/v8/test/mjsunit/es6/regress/regress-3280.js
+++ /dev/null
@@ -1,25 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --expose-debug-as debug
-
-var Debug = debug.Debug;
-
-var listener_called;
-
-function listener(event, exec_state, event_data, data) {
-  if (event == Debug.DebugEvent.Break) {
-    listener_called = true;
-    exec_state.frame().allScopes();
-  }
-}
-
-Debug.setListener(listener);
-
-function *generator_local_2(a) {
-  debugger;
-}
-generator_local_2(1).next();
-
-assertTrue(listener_called, "listener not called");
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-468661.js b/deps/v8/test/mjsunit/es6/regress/regress-468661.js
index 4a58a71d30..db71352f74 100644
--- a/deps/v8/test/mjsunit/es6/regress/regress-468661.js
+++ b/deps/v8/test/mjsunit/es6/regress/regress-468661.js
@@ -7,6 +7,7 @@
 Debug = debug.Debug
 var exception = null;
 var break_count = 0;
+const expected_breaks = 9;
 
 var expected_values =
   [ReferenceError, undefined, 0, 0, 0, 0, 1,
@@ -16,12 +17,6 @@ function listener(event, exec_state, event_data, data) {
   try {
     if (event == Debug.DebugEvent.Break) {
       assertTrue(exec_state.frameCount() != 0, "FAIL: Empty stack trace");
-      // Count number of expected breakpoints in this source file.
-      if (!break_count) {
-        var source_text = exec_state.frame(0).func().script().source();
-        expected_breaks = source_text.match(/\/\/\s*Break\s+\d+\./g).length;
-        print("Expected breaks: " + expected_breaks);
-      }
       var frameMirror = exec_state.frame(0);
 
       var v = null;;
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-5598.js b/deps/v8/test/mjsunit/es6/regress/regress-5598.js
new file mode 100644
index 0000000000..600a866470
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-5598.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo --turbo-escape --allow-natives-syntax
+
+function fn(a) {
+  var [b] = a;
+  return b;
+}
+
+fn('a');
+fn('a');
+%OptimizeFunctionOnNextCall(fn);
+
+fn('a');
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-660925.js b/deps/v8/test/mjsunit/es6/regress/regress-660925.js
new file mode 100644
index 0000000000..12c370cb6c
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-660925.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+let array = new Array(0xFFFFFFFF);
+let it = array.keys();
+assertEquals({ value: 0, done: false }, it.next());
+
+it = array.entries();
+assertEquals({ value: [0, undefined], done: false }, it.next());
+
+it = array[Symbol.iterator]();
+assertEquals({ value: undefined, done: false }, it.next());
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-666622.js b/deps/v8/test/mjsunit/es6/regress/regress-666622.js
new file mode 100644
index 0000000000..56731ab28e
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-666622.js
@@ -0,0 +1,39 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function iterateArray() {
+  var array = new Array();
+  var it = array.entries();
+  it.next();
+}
+
+function iterateTypedArray() {
+  var array = new Uint8Array();
+  var it = array.entries();
+  it.next();
+}
+
+function testArray() {
+  iterateArray();
+  try {
+  } catch (e) {
+  }
+}
+testArray();
+testArray();
+%OptimizeFunctionOnNextCall(testArray);
+testArray();
+
+function testTypedArray() {
+  iterateTypedArray();
+  try {
+  } catch (e) {
+  }
+}
+testTypedArray();
+testTypedArray();
+%OptimizeFunctionOnNextCall(testTypedArray);
+testTypedArray();
diff --git a/deps/v8/test/mjsunit/es6/rest-params.js b/deps/v8/test/mjsunit/es6/rest-params.js
index 9afe9b409e..2f122daffd 100644
--- a/deps/v8/test/mjsunit/es6/rest-params.js
+++ b/deps/v8/test/mjsunit/es6/rest-params.js
@@ -136,11 +136,9 @@ var O = {
 (function testUnmappedArguments() {
   // Strict/Unmapped arguments should always be used for functions with rest
   // parameters
-  assertThrows(function(...rest) { return arguments.caller; }, TypeError);
   assertThrows(function(...rest) { return arguments.callee; }, TypeError);
   // TODO(caitp): figure out why this doesn't throw sometimes, even though the
   //              getter always does =)
-  // assertThrows(function(...rest) { arguments.caller = 1; }, TypeError);
   // assertThrows(function(...rest) { arguments.callee = 1; }, TypeError);
 })();
 
diff --git a/deps/v8/test/mjsunit/es6/sloppy-restrictive-block-function.js b/deps/v8/test/mjsunit/es6/sloppy-restrictive-block-function.js
new file mode 100644
index 0000000000..65734acd03
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/sloppy-restrictive-block-function.js
@@ -0,0 +1,50 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// ES#sec-functiondeclarations-in-ifstatement-statement-clauses
+// Annex B 3.4 FunctionDeclarations in IfStatement Statement Clauses
+// In sloppy mode, function declarations in if statements act like
+// they have a block around them. Prohibited in strict mode.
+(function() {
+  if (false) function f() { };
+  assertEquals(undefined, f);
+})();
+
+(function() {
+  assertEquals(undefined, f);
+  if (true) function f() { };
+  assertEquals('function', typeof f);
+})();
+
+(function() {
+  assertEquals(undefined, f);
+  if (true) {} else function f() { };
+  assertEquals(undefined, f);
+})();
+
+(function() {
+  assertEquals(undefined, f);
+  if (false) {} else function f() { };
+  assertEquals('function', typeof f);
+})();
+
+// Labeled function declarations undergo the same hoisting/FiB semantics as if
+// they were unalbeled.
+(function() {
+  function bar() {
+    return f;
+    x: function f() {}
+  }
+  assertEquals('function', typeof bar());
+})();
+
+(function() {
+  function bar() {
+    return f;
+    {
+      x: function f() {}
+    }
+  }
+  assertEquals(undefined, bar());
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-call.js b/deps/v8/test/mjsunit/es6/spread-call.js
index 05e17741d6..de38f129cd 100644
--- a/deps/v8/test/mjsunit/es6/spread-call.js
+++ b/deps/v8/test/mjsunit/es6/spread-call.js
@@ -24,6 +24,13 @@
   assertEquals(5, countArgs(...[1, 2, 3, 4, 5]));
   assertEquals(6, countArgs(...[1, 2, 3, 4, 5, 6]));
 
+  assertEquals(1, countArgs(...[1.1]));
+  assertEquals(2, countArgs(...[1.1, 2.2]));
+  assertEquals(3, countArgs(...[1.1, 2.2, 3.3]));
+  assertEquals(4, countArgs(...[1.1, 2.2, 3.3, 4.4]));
+  assertEquals(5, countArgs(...[1.1, 2.2, 3.3, 4.4, 5.5]));
+  assertEquals(6, countArgs(...[1.1, 2.2, 3.3, 4.4, 5.5, 6.6]));
+
   assertEquals(1, countArgs(...new Set([1])));
   assertEquals(2, countArgs(...new Set([1, 2])));
   assertEquals(3, countArgs(...new Set([1, 2, 3])));
@@ -346,6 +353,91 @@
   assertEquals("ABXYC1C2DEBXYC1C2", log);
 })();
 
+(function testArrayPrototypeHoleGetterModifiesIteratorPrototypeNext() {
+  function sum() {
+    var sum = arguments[0];
+    for (var i = 1; i < arguments.length; ++i) {
+      sum += arguments[i];
+    }
+    return sum;
+  }
+  var a = [1, 2];
+  a[3] = 4;
+  var called = 0;
+
+  Object.defineProperty(Array.prototype, 2, {
+    get: function() {
+      var ai = a[Symbol.iterator]();
+      var original_next = ai.__proto__["next"];
+      Object.defineProperty(ai.__proto__, "next", {
+        get: function() {
+          called++;
+          return original_next;
+        }
+      });
+      return 3;
+    },
+    configurable: true
+  });
+
+  assertEquals(10, sum(...a));
+  assertEquals(2, called);
+
+  Object.defineProperty(Array.prototype, 2, {});
+})();
+
+(function testArrayHasOtherPrototype() {
+  function countArgs() { return arguments.length; }
+  var a = [1, 2, 3];
+  var b = {};
+  Object.defineProperty(b, Symbol.iterator, {
+    value: function*() {
+      yield 4;
+    },
+    configurable: true
+  });
+
+  Object.setPrototypeOf(a, b);
+
+  assertEquals(1, countArgs(...a));
+})();
+
+(function testArrayIteratorPrototypeGetter() {
+  function countArgs() { return arguments.length; }
+  var a = [1, 2, 3];
+  var ai = a[Symbol.iterator]();
+  var called = 0;
+
+  var original_next = ai.__proto__["next"];
+
+  Object.defineProperty(ai.__proto__, "next", {
+    get: function() {
+      called++;
+      return original_next;
+    }
+  });
+
+  countArgs(...a);
+
+  // should be called 4 times; 3 for the values, 1 for the final
+  // {value: undefined, done: true} pair
+  assertEquals(4, called);
+})();
+
+(function testArrayIteratorPrototypeModified() {
+  function countArgs() { return arguments.length; }
+  var a = [1,2,3];
+  var ai = a[Symbol.iterator]();
+  Object.defineProperty(ai.__proto__, "next", {
+    value: function() {
+      return {value: undefined, done: true};
+     },
+     configurable: true
+  });
+
+  assertEquals(0, countArgs(...a));
+
+})();
 
 (function testCustomArrayPrototypeIterator() {
   var origIterator =
@@ -370,3 +462,29 @@
 
   Object.defineProperty(Array.prototype, Symbol.iterator, origIterator);
 })();
+
+(function testGetPropertyIteratorCalledExactlyOnce() {
+  function countArgs() { return arguments.length; }
+  var a = [1, 2, 3];
+  var called = 0;
+
+  Object.defineProperty(Array.prototype, Symbol.iterator, {
+    value: function*() {
+      yield 1;
+      yield 2;
+    },
+    configurable: true
+  });
+
+  var it = a[Symbol.iterator];
+  Object.defineProperty(a, Symbol.iterator, {
+    get: function() {
+      called++;
+      return it;
+    }
+  });
+
+  countArgs(...a);
+
+  assertEquals(1, called);
+})();
diff --git a/deps/v8/test/mjsunit/es6/string-endswith.js b/deps/v8/test/mjsunit/es6/string-endswith.js
index 4246f166a4..b776ccc4ba 100644
--- a/deps/v8/test/mjsunit/es6/string-endswith.js
+++ b/deps/v8/test/mjsunit/es6/string-endswith.js
@@ -34,6 +34,7 @@ assertFalse(testString.endsWith("world"));
 assertFalse(testString.endsWith("Hello World!"));
 assertFalse(testString.endsWith(null));
 assertFalse(testString.endsWith(undefined));
+assertFalse(testString.endsWith());
 
 assertTrue("null".endsWith(null));
 assertTrue("undefined".endsWith(undefined));
diff --git a/deps/v8/test/mjsunit/es6/string-includes.js b/deps/v8/test/mjsunit/es6/string-includes.js
index c825ffdc68..60a7ddd685 100644
--- a/deps/v8/test/mjsunit/es6/string-includes.js
+++ b/deps/v8/test/mjsunit/es6/string-includes.js
@@ -27,6 +27,11 @@
 
 assertEquals(1, String.prototype.includes.length);
 
+var s = 'a';
+assertFalse(s.includes(null));
+assertFalse(s.includes(undefined));
+assertFalse(s.includes());
+
 var reString = "asdf[a-z]+(asdf)?";
 assertTrue(reString.includes("[a-z]+"));
 assertTrue(reString.includes("(asdf)?"));
diff --git a/deps/v8/test/mjsunit/es6/string-startswith.js b/deps/v8/test/mjsunit/es6/string-startswith.js
index f38f7b9cb8..449d07a56d 100644
--- a/deps/v8/test/mjsunit/es6/string-startswith.js
+++ b/deps/v8/test/mjsunit/es6/string-startswith.js
@@ -34,6 +34,7 @@ assertFalse(testString.startsWith("hello"));
 assertFalse(testString.startsWith("Hello World!"));
 assertFalse(testString.startsWith(null));
 assertFalse(testString.startsWith(undefined));
+assertFalse(testString.startsWith());
 
 assertTrue("null".startsWith(null));
 assertTrue("undefined".startsWith(undefined));
diff --git a/deps/v8/test/mjsunit/es6/symbols.js b/deps/v8/test/mjsunit/es6/symbols.js
index a21afb3770..d83e2174ec 100644
--- a/deps/v8/test/mjsunit/es6/symbols.js
+++ b/deps/v8/test/mjsunit/es6/symbols.js
@@ -353,7 +353,7 @@ function TestKeyDelete(obj) {
 }
 
 
-var objs = [{}, [], Object.create(null), Object(1), new Map, function(){}]
+var objs = [{}, [], Object.create({}), Object(1), new Map, function(){}]
 
 for (var i in objs) {
   var obj = objs[i]