deps: update V8 to 5.4.500.27

Pick up latest commit from the 5.4-lkgr branch.

deps: edit V8 gitignore to allow trace event copy
deps: update V8 trace event to 315bf1e2d45be7d53346c31cfcc37424a32c30c8
deps: edit V8 gitignore to allow gtest_prod.h copy
deps: update V8 gtest to 6f8a66431cb592dad629028a50b3dd418a408c87

PR-URL: https://github.com/nodejs/node/pull/8317
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Ali Ijaz Sheikh <ofrobots@google.com>

202 files changed, 4656 insertions, 643 deletions

diff --git a/deps/v8/test/mjsunit/regress/redeclaration-error-types.js b/deps/v8/test/mjsunit/regress/redeclaration-error-types.js
new file mode 100644
index 0000000000..72e097db57
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/redeclaration-error-types.js
@@ -0,0 +1,145 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function doTest(scripts, expectedError) {
+  var realm = Realm.create();
+
+  for (var i = 0; i < scripts.length - 1; i++) {
+    Realm.eval(realm, scripts[i]);
+  }
+  assertThrows(function() {
+    Realm.eval(realm, scripts[scripts.length - 1]);
+  }, Realm.eval(realm, expectedError));
+
+  Realm.dispose(realm);
+}
+
+var tests = [
+  {
+    // ES#sec-globaldeclarationinstantiation 5.a:
+    // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "var a;",
+      "let a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 6.a:
+    // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "let a;",
+      "var a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.b:
+    // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "let a;",
+      "let a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+    // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      'let a; eval("var a;");',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+    // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      'let a; eval("function a() {}");',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+    // Throw a SyntaxError exception.
+    scripts: [
+      '(function() { let a; eval("var a;"); })();',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+    // Throw a SyntaxError exception.
+    scripts: [
+      '(function() { let a; eval("function a() {}"); })();',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.d:
+    // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+    scripts: [
+      'let NaN;',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.d:
+    // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+    scripts: [
+      'function NaN() {}',
+    ],
+    expectedError: "SyntaxError",
+  },
+
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      'eval("function NaN() {}");',
+    ],
+    expectedError: "TypeError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      `
+        let a;
+        try {
+          eval("function a() {}");
+        } catch (e) {}
+        eval("function NaN() {}");
+      `,
+    ],
+    expectedError: "TypeError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      `
+        eval("
+          function f() {
+            function b() {
+              (0, eval)('function NaN() {}');
+            }
+            b();
+          }
+          f();
+        ");
+      `.replace(/"/g, '`'),
+    ],
+    expectedError: "TypeError",
+  },
+];
+
+tests.forEach(function(test) {
+  doTest(test.scripts, test.expectedError);
+});
diff --git a/deps/v8/test/mjsunit/regress/regress-105.js b/deps/v8/test/mjsunit/regress/regress-105.js
index 877cb82317..8b8030ffec 100644
--- a/deps/v8/test/mjsunit/regress/regress-105.js
+++ b/deps/v8/test/mjsunit/regress/regress-105.js
@@ -26,12 +26,12 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 var custom_valueOf = function() {
-  assertEquals(null, custom_valueOf.caller);
+  assertEquals(Number, custom_valueOf.caller);
   return 2;
 }
 
 var custom_toString = function() {
-  assertEquals(null, custom_toString.caller);
+  assertEquals(String, custom_toString.caller);
   return "I used to be an adventurer like you";
 }
 
diff --git a/deps/v8/test/mjsunit/regress/regress-1132.js b/deps/v8/test/mjsunit/regress/regress-1132.js
index a5cb0a1d5f..adb56b0fa8 100644
--- a/deps/v8/test/mjsunit/regress/regress-1132.js
+++ b/deps/v8/test/mjsunit/regress/regress-1132.js
@@ -28,7 +28,7 @@
 // Test the case when exception is thrown from the parser when lazy
 // compiling a function.
 
-// Flags: --stack-size=46
+// Flags: --stack-size=100
 // NOTE: stack size constant above has been empirically chosen.
 // If the test starts to fail in Genesis, consider increasing this constant.
 
diff --git a/deps/v8/test/mjsunit/regress/regress-1246.js b/deps/v8/test/mjsunit/regress/regress-1246.js
deleted file mode 100644
index ca425ec2b7..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-1246.js
+++ /dev/null
@@ -1,82 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// This regression tests the behaviour of the parseInt function when
-// the given radix is not a SMI.
-
-// Flags: --allow-natives-syntax
-
-var nonSmi10 = Math.log(Math.exp(10));
-var nonSmi16 = Math.log(Math.exp(16));
-
-assertTrue(!%_IsSmi(nonSmi10) && nonSmi10 == 10);
-assertTrue(!%_IsSmi(nonSmi16) && nonSmi16 == 16);
-
-// Giving these values as the radix argument triggers radix detection.
-var radix_detect = [0, -0, NaN, Infinity, -Infinity, undefined, null,
-                    "0", "-0", "a"];
-
-// These values will result in an integer radix outside of the valid range.
-var radix_invalid = [1, 37, -2, "-2", "37"];
-
-// These values will trigger decimal parsing.
-var radix10 = [10, 10.1, "10", "10.1", nonSmi10];
-
-// These values will trigger hexadecimal parsing.
-var radix16 = [16, 16.1, 0x10, "0X10", nonSmi16];
-
-for (var i = 0; i < radix_detect.length; i++) {
-  var radix = radix_detect[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(23, parseInt("23", radix));
-  assertEquals(0xaf, parseInt("0xaf", radix));
-  assertEquals(NaN, parseInt("af", radix));
-}
-
-for (var i = 0; i < radix_invalid.length; i++) {
-  var radix = radix_invalid[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(NaN, parseInt("23", radix));
-  assertEquals(NaN, parseInt("0xaf", radix));
-  assertEquals(NaN, parseInt("af", radix));
-}
-
-for (var i = 0; i < radix10.length; i++) {
-  var radix = radix10[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(23, parseInt("23", radix));
-  assertEquals(0, parseInt("0xaf", radix));
-  assertEquals(NaN, parseInt("af", radix));
-}
-
-for (var i = 0; i < radix16.length; i++) {
-  var radix = radix16[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(0x23, parseInt("23", radix));
-  assertEquals(0xaf, parseInt("0xaf", radix));
-  assertEquals(0xaf, parseInt("af", radix));
-}
diff --git a/deps/v8/test/mjsunit/regress/regress-1403.js b/deps/v8/test/mjsunit/regress/regress-1403.js
index f2520ccbc9..91df6d65f6 100644
--- a/deps/v8/test/mjsunit/regress/regress-1403.js
+++ b/deps/v8/test/mjsunit/regress/regress-1403.js
@@ -28,7 +28,7 @@
 // See: http://code.google.com/p/v8/issues/detail?id=1403
 
 a = [];
-Object.prototype.__proto__ = { __proto__: null };
+assertThrows(() => Object.prototype.__proto__ = { __proto__: null }, TypeError);
 a.shift();
 
 a = [];
diff --git a/deps/v8/test/mjsunit/regress/regress-1980.js b/deps/v8/test/mjsunit/regress/regress-1980.js
index d87ff45074..e1e492b883 100644
--- a/deps/v8/test/mjsunit/regress/regress-1980.js
+++ b/deps/v8/test/mjsunit/regress/regress-1980.js
@@ -27,6 +27,8 @@
 
 // See: http://code.google.com/p/v8/issues/detail?id=1980
 
+var msg = "Method Error.prototype.toString called on incompatible receiver ";
+
 var invalid_this = [ "invalid", 23, undefined, null ];
 for (var i = 0; i < invalid_this.length; i++) {
   var exception = false;
@@ -34,7 +36,7 @@ for (var i = 0; i < invalid_this.length; i++) {
     Error.prototype.toString.call(invalid_this[i]);
   } catch (e) {
     exception = true;
-    assertEquals("Error.prototype.toString called on non-object", e.message);
+    assertEquals(msg + invalid_this[i], e.message);
   }
   assertTrue(exception);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-2618.js b/deps/v8/test/mjsunit/regress/regress-2618.js
index 6e52bcad78..2634c80c66 100644
--- a/deps/v8/test/mjsunit/regress/regress-2618.js
+++ b/deps/v8/test/mjsunit/regress/regress-2618.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --use-osr --allow-natives-syntax
+// Flags: --use-osr --allow-natives-syntax --ignition-osr --turbo-from-bytecode
 
 function f() {
   do {
diff --git a/deps/v8/test/mjsunit/regress/regress-3229.js b/deps/v8/test/mjsunit/regress/regress-3229.js
index 419cade8cd..53e14cd541 100644
--- a/deps/v8/test/mjsunit/regress/regress-3229.js
+++ b/deps/v8/test/mjsunit/regress/regress-3229.js
@@ -12,7 +12,7 @@ testEscapes("\\/", /\//);
 testEscapes("\\/\\/", /\/\//);
 testEscapes("\\/", new RegExp("/"));
 testEscapes("\\/", new RegExp("\\/"));
-testEscapes("\\\\/", new RegExp("\\\\/"));
+testEscapes("\\\\\\/", new RegExp("\\\\/"));
 testEscapes("\\/\\/", new RegExp("\\/\\/"));
 testEscapes("\\/\\/\\/\\/", new RegExp("////"));
 testEscapes("\\/\\/\\/\\/", new RegExp("\\//\\//"));
diff --git a/deps/v8/test/mjsunit/regress/regress-3315.js b/deps/v8/test/mjsunit/regress/regress-3315.js
deleted file mode 100644
index bfd7df29b8..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-3315.js
+++ /dev/null
@@ -1,28 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-//
-// Flags: --harmony-object-observe
-
-var indexZeroCallCount = 0;
-var indexOneCallCount = 0;
-var lengthCallCount = 0;
-var acceptList = {
-  get 0() {
-    indexZeroCallCount++;
-    return 'foo';
-  },
-  get 1() {
-    indexOneCallCount++;
-    return 'bar';
-  },
-  get length() {
-    lengthCallCount++;
-    return 1;
-  }
-};
-
-Object.observe({}, function(){}, acceptList);
-assertEquals(1, lengthCallCount);
-assertEquals(1, indexZeroCallCount);
-assertEquals(0, indexOneCallCount);
diff --git a/deps/v8/test/mjsunit/regress/regress-349870.js b/deps/v8/test/mjsunit/regress/regress-349870.js
deleted file mode 100644
index 72df05524b..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-349870.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-var r = /x/;
-Object.freeze(r);
-r.compile("x");
diff --git a/deps/v8/test/mjsunit/regress/regress-353004.js b/deps/v8/test/mjsunit/regress/regress-353004.js
index 658fd6dbeb..7e1fb7e939 100644
--- a/deps/v8/test/mjsunit/regress/regress-353004.js
+++ b/deps/v8/test/mjsunit/regress/regress-353004.js
@@ -41,19 +41,21 @@ assertThrows(function() {
 
 
 var buffer5 = new ArrayBuffer(100 * 1024);
-var buffer6 = buffer5.slice({valueOf : function() {
-  %ArrayBufferNeuter(buffer5);
-  return 0;
-}}, 100 * 1024 * 1024);
-assertEquals(0, buffer6.byteLength);
+assertThrows(function() {
+  buffer5.slice({valueOf : function() {
+    %ArrayBufferNeuter(buffer5);
+    return 0;
+  }}, 100 * 1024 * 1024);
+}, TypeError);
 
 
 var buffer7 = new ArrayBuffer(100 * 1024 * 1024);
-var buffer8 = buffer7.slice(0, {valueOf : function() {
-  %ArrayBufferNeuter(buffer7);
-  return 100 * 1024 * 1024;
-}});
-assertEquals(0, buffer8.byteLength);
+assertThrows(function() {
+  buffer7.slice(0, {valueOf : function() {
+    %ArrayBufferNeuter(buffer7);
+    return 100 * 1024 * 1024;
+  }});
+}, TypeError);
 
 var buffer9 = new ArrayBuffer(1024);
 var array9 = new Uint8Array(buffer9);
diff --git a/deps/v8/test/mjsunit/regress/regress-353551.js b/deps/v8/test/mjsunit/regress/regress-353551.js
index c6e7856d34..ea5a234658 100644
--- a/deps/v8/test/mjsunit/regress/regress-353551.js
+++ b/deps/v8/test/mjsunit/regress/regress-353551.js
@@ -30,7 +30,7 @@ function __f_3(x) {
   var __v_1 = arguments;
   __v_1[1000] = 123;
   depth++;
-  if (depth > 3000) return;
+  if (depth > 2500) return;
   function __f_4() {
     ++__v_1[0];
     __f_3(0.5);
diff --git a/deps/v8/test/mjsunit/regress/regress-356589.js b/deps/v8/test/mjsunit/regress/regress-356589.js
deleted file mode 100644
index a47f51bac1..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-356589.js
+++ /dev/null
@@ -1,36 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --harmony-object-observe
-
-// This test passes if it does not crash in debug mode
-
-arr = ['a', 'b', 'c', 'd'];
-Object.defineProperty(arr.__proto__, '0', { get: function(){} });
-Object.defineProperty(arr, '2', {get: function(){} });
-Object.observe(arr, function() {});
-arr.length = 2;
diff --git a/deps/v8/test/mjsunit/regress/regress-3926.js b/deps/v8/test/mjsunit/regress/regress-3926.js
index 4720c1b908..4d9b2983d2 100644
--- a/deps/v8/test/mjsunit/regress/regress-3926.js
+++ b/deps/v8/test/mjsunit/regress/regress-3926.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy --harmony-sloppy-let
-
 // See: http://code.google.com/p/v8/issues/detail?id=3926
 
 // Switch statements should disable hole check elimination
diff --git a/deps/v8/test/mjsunit/regress/regress-403292.js b/deps/v8/test/mjsunit/regress/regress-403292.js
deleted file mode 100644
index 2e24d48ac4..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-403292.js
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-natives-as=builtins --expose-gc
-
-var SetIterator = builtins.ImportNow("SetIterator");
-var MapIterator = builtins.ImportNow("MapIterator");
-var __v_7 = [];
-var __v_8 = {};
-var __v_10 = {};
-var __v_11 = this;
-var __v_12 = {};
-var __v_13 = {};
-var __v_14 = "";
-var __v_15 = {};
-try {
-__v_1 = {x:0};
-%OptimizeFunctionOnNextCall(__f_1);
-assertEquals("good", __f_1());
-delete __v_1.x;
-assertEquals("good", __f_1());
-} catch(e) { print("Caught: " + e); }
-try {
-__v_3 = new Set();
-__v_5 = new SetIterator(__v_3, -12);
-__v_4 = new Map();
-__v_6 = new MapIterator(__v_4, 2);
-__f_3(Array);
-} catch(e) { print("Caught: " + e); }
-function __f_4(__v_8, filter) {
-  function __f_6(v) {
-    for (var __v_4 in v) {
-      for (var __v_4 in v) {}
-    }
-    %OptimizeFunctionOnNextCall(filter);
-    return filter(v);
-  }
-  var __v_7 = eval(__v_8);
-  gc();
-  return __f_6(__v_7);
-}
-function __f_5(__v_6) {
-  var __v_5 = new Array(__v_6);
-  for (var __v_4 = 0; __v_4 < __v_6; __v_4++) __v_5.push('{}');
-  return __v_5;
-}
-try {
-try {
-  __v_8.test("\x80");
-  assertUnreachable();
-} catch (e) {
-}
-gc();
-} catch(e) { print("Caught: " + e); }
diff --git a/deps/v8/test/mjsunit/regress/regress-417709a.js b/deps/v8/test/mjsunit/regress/regress-417709a.js
deleted file mode 100644
index 5500be2cf0..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-417709a.js
+++ /dev/null
@@ -1,17 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-object-observe
-// Flags: --stack-size=100
-
-var a = [];
-
-Object.observe(a, function() {});
-
-function f(a, x) {
-  a.length = x;
-  f(a, x + 1);
-}
-
-assertThrows(function() { f(a, 1); }, RangeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-417709b.js b/deps/v8/test/mjsunit/regress/regress-417709b.js
deleted file mode 100644
index 4d9572e7d7..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-417709b.js
+++ /dev/null
@@ -1,16 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-object-observe --stack-size=100
-
-var a = [];
-
-Array.observe(a, function() {});
-
-function f(a, x) {
-  a.length = x;
-  f(a, x + 1);
-}
-
-assertThrows(function() { f(a, 1); }, RangeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-4659.js b/deps/v8/test/mjsunit/regress/regress-4659.js
index ff436bec1b..8992bb89fe 100644
--- a/deps/v8/test/mjsunit/regress/regress-4659.js
+++ b/deps/v8/test/mjsunit/regress/regress-4659.js
@@ -1,8 +1,6 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-function-name
 
 var obj = {
   get longerName(){
diff --git a/deps/v8/test/mjsunit/regress/regress-4665-2.js b/deps/v8/test/mjsunit/regress/regress-4665-2.js
deleted file mode 100644
index b94301eea8..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-4665-2.js
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-species
-
-// First test case
-
-function FirstBuffer () {}
-FirstBuffer.prototype.__proto__ = Uint8Array.prototype
-FirstBuffer.__proto__ = Uint8Array
-
-var buf = new Uint8Array(10)
-buf.__proto__ = FirstBuffer.prototype
-
-var buf2 = buf.subarray(2)
-assertEquals(8, buf2.length);
-
-// Second test case
-
-function SecondBuffer (arg) {
-  var arr = new Uint8Array(arg)
-  arr.__proto__ = SecondBuffer.prototype
-  return arr
-}
-SecondBuffer.prototype.__proto__ = Uint8Array.prototype
-SecondBuffer.__proto__ = Uint8Array
-
-var buf3 = new SecondBuffer(10)
-
-var buf4 = buf3.subarray(2)
-
-assertEquals(8, buf4.length);
diff --git a/deps/v8/test/mjsunit/regress/regress-4665.js b/deps/v8/test/mjsunit/regress/regress-4665.js
index 9d7307acc7..a75d68f105 100644
--- a/deps/v8/test/mjsunit/regress/regress-4665.js
+++ b/deps/v8/test/mjsunit/regress/regress-4665.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --noharmony-species
-
 // First test case
 
 function FirstBuffer () {}
diff --git a/deps/v8/test/mjsunit/regress/regress-4693.js b/deps/v8/test/mjsunit/regress/regress-4693.js
index 13b4e2b68e..2c31cd95e6 100644
--- a/deps/v8/test/mjsunit/regress/regress-4693.js
+++ b/deps/v8/test/mjsunit/regress/regress-4693.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --harmony-sloppy-function
 
 // In sloppy mode we allow function redeclarations within blocks for webcompat.
 (function() {
diff --git a/deps/v8/test/mjsunit/regress/regress-4703.js b/deps/v8/test/mjsunit/regress/regress-4703.js
new file mode 100644
index 0000000000..dad8a97874
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4703.js
@@ -0,0 +1,30 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var all_scopes = exec_state.frame().allScopes();
+    assertEquals([ debug.ScopeType.Block,
+                   debug.ScopeType.Local,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global ],
+                 all_scopes.map(scope => scope.scopeType()));
+  } catch (e) {
+    exception = e;
+  }
+}
+
+debug.Debug.setListener(listener);
+
+(function(arg, ...rest) {
+  var one = 1;
+  function inner() {
+    one;
+    arg;
+  }
+  debugger;
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-4815.js b/deps/v8/test/mjsunit/regress/regress-4815.js
new file mode 100644
index 0000000000..68764865f7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4815.js
@@ -0,0 +1,52 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = { [Symbol.toPrimitive]: () => FAIL };
+
+// Tests that a native conversion function is included in the
+// stack trace.
+function testTraceNativeConversion(nativeFunc) {
+  var nativeFuncName = nativeFunc.name;
+  try {
+    nativeFunc(thrower);
+    assertUnreachable(nativeFuncName);
+  } catch (e) {
+    assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
+  }
+}
+
+// C++ builtins.
+testTraceNativeConversion(Math.acos);
+testTraceNativeConversion(Math.asin);
+testTraceNativeConversion(Math.fround);
+testTraceNativeConversion(Math.imul);
+
+
+function testBuiltinInStackTrace(script, expectedString) {
+  try {
+    eval(script);
+    assertUnreachable(expectedString);
+  } catch (e) {
+    assertTrue(e.stack.indexOf(expectedString) >= 0, expectedString);
+  }
+}
+
+// C++ builtins.
+testBuiltinInStackTrace("Boolean.prototype.toString.call(thrower);",
+                        "at Object.toString");
+
+// Constructor builtins.
+testBuiltinInStackTrace("new Date(thrower);", "at new Date");
+
+// Ensure we correctly pick up the receiver's string tag.
+testBuiltinInStackTrace("Math.acos(thrower);", "at Math.acos");
+testBuiltinInStackTrace("Math.asin(thrower);", "at Math.asin");
+testBuiltinInStackTrace("Math.fround(thrower);", "at Math.fround");
+testBuiltinInStackTrace("Math.imul(thrower);", "at Math.imul");
+
+// As above, but function passed as an argument and then called.
+testBuiltinInStackTrace("((f, x) => f(x))(Math.acos, thrower);", "at acos");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.asin, thrower);", "at asin");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.fround, thrower);", "at fround");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.imul, thrower);", "at imul");
diff --git a/deps/v8/test/mjsunit/regress/regress-4908.js b/deps/v8/test/mjsunit/regress/regress-4908.js
new file mode 100644
index 0000000000..ec618b32c5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4908.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy
+
+(function() { ((s = 17, y = s) => s)() })();
diff --git a/deps/v8/test/mjsunit/regress/regress-4945.js b/deps/v8/test/mjsunit/regress/regress-4945.js
new file mode 100644
index 0000000000..8e595e6fde
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4945.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g(o) {
+  yield 'x' in o;
+}
+
+assertTrue(g({x: 1}).next().value);
+assertFalse(g({}).next().value);
diff --git a/deps/v8/test/mjsunit/regress/regress-4964.js b/deps/v8/test/mjsunit/regress/regress-4964.js
new file mode 100644
index 0000000000..d834708667
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4964.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Neutered source
+var ab = new ArrayBuffer(10);
+ab.constructor = { get [Symbol.species]() { %ArrayBufferNeuter(ab); return ArrayBuffer; } };
+assertThrows(() => ab.slice(0), TypeError);
+
+// Neutered target
+class NeuteredArrayBuffer extends ArrayBuffer {
+  constructor(...args) {
+    super(...args);
+    %ArrayBufferNeuter(this);
+  }
+}
+
+var ab2 = new ArrayBuffer(10);
+ab2.constructor = NeuteredArrayBuffer;
+assertThrows(() => ab2.slice(0), TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-4967.js b/deps/v8/test/mjsunit/regress/regress-4967.js
new file mode 100644
index 0000000000..9b36405cf4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4967.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+  new class extends Object {
+    constructor() { (() => delete super[super()])(); }
+  }
+}, ReferenceError);
diff --git a/deps/v8/test/mjsunit/regress/regress-4971.js b/deps/v8/test/mjsunit/regress/regress-4971.js
new file mode 100644
index 0000000000..041f6c2a57
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-4971.js
@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestDeoptInNamedSuperGetter() {
+  class C { m() { return 23 } }
+  class D extends C { f() { return super.boom() } }
+
+  var should_deoptimize_caller = false;
+  Object.defineProperty(C.prototype, "boom", { get: function() {
+    if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
+    return this.m
+  }})
+
+  assertEquals(23, new D().f());
+  assertEquals(23, new D().f());
+  %OptimizeFunctionOnNextCall(D.prototype.f);
+  assertEquals(23, new D().f());
+  should_deoptimize_caller = true;
+  assertEquals(23, new D().f());
+})();
+
+(function TestDeoptInKeyedSuperGetter() {
+  class C { m() { return 23 } }
+  class D extends C { f(name) { return super[name]() } }
+
+  var should_deoptimize_caller = false;
+  Object.defineProperty(C.prototype, "boom", { get: function() {
+    if (should_deoptimize_caller) %DeoptimizeFunction(D.prototype.f);
+    return this.m
+  }})
+
+  assertEquals(23, new D().f("boom"));
+  assertEquals(23, new D().f("boom"));
+  %OptimizeFunctionOnNextCall(D.prototype.f);
+  assertEquals(23, new D().f("boom"));
+  should_deoptimize_caller = true;
+  assertEquals(23, new D().f("boom"));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-5004.js b/deps/v8/test/mjsunit/regress/regress-5004.js
new file mode 100644
index 0000000000..234f5d4eb6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5004.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertAsync(b, s) {
+  if (!b) {
+    %AbortJS(" FAILED!")
+  }
+}
+
+class P extends Promise {
+  constructor() {
+    super(...arguments)
+    return new Proxy(this, {
+      get: (_, key) => {
+        return key == 'then' ?
+            this.then.bind(this) :
+            this.constructor.resolve(20)
+      }
+    })
+  }
+}
+
+let p = P.resolve(10)
+p.key.then(v => assertAsync(v === 20));
diff --git a/deps/v8/test/mjsunit/regress/regress-5018.js b/deps/v8/test/mjsunit/regress/regress-5018.js
new file mode 100644
index 0000000000..22025dc2d8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5018.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var dv = new DataView(new ArrayBuffer(4), 2);
+
+function getByteLength(a) {
+  return a.byteLength;
+}
+
+assertEquals(2, getByteLength(dv));
+assertEquals(2, getByteLength(dv));
+
+Object.defineProperty(dv.__proto__, 'byteLength', {value: 42});
+
+assertEquals(42, dv.byteLength);
+assertEquals(42, getByteLength(dv));
+
+function getByteOffset(a) {
+  return a.byteOffset;
+}
+
+assertEquals(2, getByteOffset(dv));
+assertEquals(2, getByteOffset(dv));
+
+Object.defineProperty(dv.__proto__, 'byteOffset', {value: 42});
+
+assertEquals(42, dv.byteOffset);
+assertEquals(42, getByteOffset(dv));
diff --git a/deps/v8/test/mjsunit/regress/regress-5036.js b/deps/v8/test/mjsunit/regress/regress-5036.js
index 036edd949f..77bd242490 100644
--- a/deps/v8/test/mjsunit/regress/regress-5036.js
+++ b/deps/v8/test/mjsunit/regress/regress-5036.js
@@ -2,6 +2,4 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 assertEquals(["1\u212a"], /\d\w/ui.exec("1\u212a"));
diff --git a/deps/v8/test/mjsunit/regress/regress-5071.js b/deps/v8/test/mjsunit/regress/regress-5071.js
new file mode 100644
index 0000000000..41c1250031
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5071.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+  assertEquals(2, exec_state.frameCount());
+  assertEquals("a", exec_state.frame(0).localName(0));
+  assertEquals("1", exec_state.frame(0).localValue(0).value());
+  assertEquals(1, exec_state.frame(0).localCount());
+}
+
+Debug.setListener(listener);
+
+function f() {
+  var a = 1;
+  {
+    let b = 2;
+    debugger;
+  }
+}
+
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-610228.js b/deps/v8/test/mjsunit/regress/regress-5085.js
index ca077d5631..0ed034dc2d 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-610228.js
+++ b/deps/v8/test/mjsunit/regress/regress-5085.js
@@ -4,8 +4,11 @@
 
 // Flags: --allow-natives-syntax
 
-function foo() { return JSON.stringify({a: 0.1}); }
-assertEquals('{"a":0.1}', foo());
-assertEquals('{"a":0.1}', foo());
+function foo(x) {
+  return x instanceof Proxy;
+}
+
+assertFalse(foo({}));
+assertFalse(foo({}));
 %OptimizeFunctionOnNextCall(foo);
-assertEquals('{"a":0.1}', foo());
+assertFalse(foo({}));
diff --git a/deps/v8/test/mjsunit/regress/regress-5106.js b/deps/v8/test/mjsunit/regress/regress-5106.js
new file mode 100644
index 0000000000..52d550a878
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5106.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g1() {
+  try {
+    throw {};
+  } catch ({a = class extends (yield) {}}) {
+  }
+}
+g1().next();  // crashes without fix
+
+function* g2() {
+  let x = function(){};
+  try {
+    throw {};
+  } catch ({b = class extends x {}}) {
+  }
+}
+g2().next();  // crashes without fix
+
+function* g3() {
+  let x = 42;
+  try {
+    throw {};
+  } catch ({c = (function() { return x })()}) {
+  }
+}
+g3().next();  // throws a ReferenceError without fix
diff --git a/deps/v8/test/mjsunit/regress/regress-5164.js b/deps/v8/test/mjsunit/regress/regress-5164.js
new file mode 100644
index 0000000000..5c13937821
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5164.js
@@ -0,0 +1,44 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --expose-debug-as debug
+
+var failure = null;
+var args;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != debug.Debug.DebugEvent.Break) return;
+  try {
+    args = exec_state.frame(0).evaluate('arguments').value();
+  } catch (e) {
+    failure = e;
+  }
+}
+
+debug.Debug.setListener(listener);
+
+function* gen(a, b) {
+  debugger;
+  yield a;
+  yield b;
+}
+
+var foo = gen(1, 2);
+
+foo.next()
+assertEquals(2, args.length);
+assertEquals(undefined, args[0]);
+assertEquals(undefined, args[1]);
+
+foo.next()
+assertEquals(2, args.length);
+assertEquals(undefined, args[0]);
+assertEquals(undefined, args[1]);
+
+foo.next()
+assertEquals(2, args.length);
+assertEquals(undefined, args[0]);
+assertEquals(undefined, args[1]);
+
+assertNull(failure);
diff --git a/deps/v8/test/mjsunit/regress/regress-5173.js b/deps/v8/test/mjsunit/regress/regress-5173.js
new file mode 100644
index 0000000000..74f58cc473
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5173.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = { [Symbol.toPrimitive]: () => FAIL };
+
+// Tests that a native conversion function is included in the
+// stack trace.
+function testTraceNativeConversion(nativeFunc) {
+  var nativeFuncName = nativeFunc.name;
+  try {
+    nativeFunc(thrower);
+    assertUnreachable(nativeFuncName);
+  } catch (e) {
+    assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
+  }
+}
+
+testTraceNativeConversion(Math.max);
+testTraceNativeConversion(Math.min);
+
+function testBuiltinInStackTrace(script, expectedString) {
+  try {
+    eval(script);
+    assertUnreachable(expectedString);
+  } catch (e) {
+    assertTrue(e.stack.indexOf(expectedString) >= 0, expectedString);
+  }
+}
+
+testBuiltinInStackTrace("Date.prototype.getDate.call('')", "at String.getDate");
+testBuiltinInStackTrace("Date.prototype.getUTCDate.call('')",
+                        "at String.getUTCDate");
+testBuiltinInStackTrace("Date.prototype.getTime.call('')", "at String.getTime");
+
+testBuiltinInStackTrace("Number(thrower);", "at Number");
+testBuiltinInStackTrace("new Number(thrower);", "at new Number");
+testBuiltinInStackTrace("String(thrower);", "at String");
+testBuiltinInStackTrace("new String(thrower);", "at new String");
+
+// Ensure we correctly pick up the receiver's string tag.
+testBuiltinInStackTrace("Math.acos(thrower);", "at Math.acos");
+testBuiltinInStackTrace("Math.asin(thrower);", "at Math.asin");
+testBuiltinInStackTrace("Math.fround(thrower);", "at Math.fround");
+testBuiltinInStackTrace("Math.imul(thrower);", "at Math.imul");
+
+// As above, but function passed as an argument and then called.
+testBuiltinInStackTrace("((f, x) => f(x))(Math.acos, thrower);", "at acos");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.asin, thrower);", "at asin");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.fround, thrower);", "at fround");
+testBuiltinInStackTrace("((f, x) => f(x))(Math.imul, thrower);", "at imul");
diff --git a/deps/v8/test/mjsunit/regress/regress-5174.js b/deps/v8/test/mjsunit/regress/regress-5174.js
new file mode 100644
index 0000000000..390d24e682
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5174.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+
+assertEquals([], Object.keys(new Proxy([], {})));
+assertEquals([], Object.keys(new Proxy(/regex/, {})));
diff --git a/deps/v8/test/mjsunit/regress/regress-5178.js b/deps/v8/test/mjsunit/regress/regress-5178.js
new file mode 100644
index 0000000000..cf10ae7187
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5178.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows(() => {
+  try { throw {} } catch({a=b, b}) { a+b }
+}, ReferenceError);
+
+try { throw {a: 42} } catch({a, b=a}) { assertEquals(42, b) };
diff --git a/deps/v8/test/mjsunit/regress/regress-5181.js b/deps/v8/test/mjsunit/regress/regress-5181.js
new file mode 100644
index 0000000000..d8dfc4a0b6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5181.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var target = Object.create(null);
+var proxy = new Proxy(target, {
+  ownKeys: function() {
+    return ['a'];
+  }
+});
+for (var key in proxy) ;
diff --git a/deps/v8/test/mjsunit/regress/regress-520029.js b/deps/v8/test/mjsunit/regress/regress-520029.js
index 299dd75017..9a1d200307 100644
--- a/deps/v8/test/mjsunit/regress/regress-520029.js
+++ b/deps/v8/test/mjsunit/regress/regress-520029.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy-let --harmony-sloppy
-
 // Test that hoisting a function out of a lexical scope does not
 // lead to a parsing error
 
diff --git a/deps/v8/test/mjsunit/regress/regress-5205.js b/deps/v8/test/mjsunit/regress/regress-5205.js
new file mode 100644
index 0000000000..0d88f45053
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5205.js
@@ -0,0 +1,37 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-global
+
+(function TestGCDuringToObjectForWith() {
+  function f(o) {
+    if (o == 'warmup') { return g() }
+    with (o) { return x }
+  }
+  function g() {
+    // Only a marker function serving as weak embedded object.
+  }
+
+  // Warm up 'f' so that weak embedded object 'g' will be used.
+  f('warmup');
+  f('warmup');
+  g = null;
+
+  // Test that 'f' behaves correctly unoptimized.
+  assertEquals(23, f({ x:23 }));
+  assertEquals(42, f({ x:42 }));
+
+  // Test that 'f' behaves correctly optimized.
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(65, f({ x:65 }));
+
+  // Test that 'f' behaves correctly on numbers.
+  Number.prototype.x = 99;
+  assertEquals(99, f(0));
+
+  // Make sure the next [[ToObject]] allocation triggers GC. This in turn will
+  // deoptimize 'f' because it has the weak embedded object 'g' in the code.
+  %SetAllocationTimeout(1000, 1, false);
+  assertEquals(99, f(0));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-5207.js b/deps/v8/test/mjsunit/regress/regress-5207.js
new file mode 100644
index 0000000000..1472b541b5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5207.js
@@ -0,0 +1,30 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+'use strict';
+var Debug = debug.Debug;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var scopes = exec_state.frame(0).allScopes();
+    assertEquals(debug.ScopeType.Eval, scopes[0].scopeType());
+    assertEquals(1, scopes[0].scopeObject().value().a);
+    assertEquals(debug.ScopeType.Script, scopes[1].scopeType());
+    assertEquals(undefined, scopes[1].scopeObject().value().a);
+    assertEquals(debug.ScopeType.Global, scopes[2].scopeType());
+    assertEquals(undefined, scopes[2].scopeObject().value().a);
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+// Eval inherits strict mode.
+eval("var a = 1; debugger;");
+Debug.setListener(null);
+assertNull(exception);
diff --git a/deps/v8/test/mjsunit/regress/regress-5213.js b/deps/v8/test/mjsunit/regress/regress-5213.js
new file mode 100644
index 0000000000..831e1346d8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5213.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See http://code.google.com/p/v8/issues/detail?id=5213
+
+assertEquals(0, Math.pow(2,-2147483648));
+assertEquals(0, Math.pow(2,-9223372036854775808));
diff --git a/deps/v8/test/mjsunit/regress/regress-5214.js b/deps/v8/test/mjsunit/regress/regress-5214.js
new file mode 100644
index 0000000000..f90a590253
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5214.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// See http://code.google.com/p/v8/issues/detail?id=5214
+
+
+assertEquals(Infinity, Math.pow(2, 0x80000000));
+assertEquals(Infinity, Math.pow(2, 0xc0000000));
+assertEquals(0, Math.pow(2, -0x80000000));
diff --git a/deps/v8/test/mjsunit/regress/regress-5216.js b/deps/v8/test/mjsunit/regress/regress-5216.js
new file mode 100644
index 0000000000..9097310fc2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5216.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Ensure that custom error constructors don't show up in stack traces.
+
+class MyError extends Error { }
+assertFalse(new MyError().stack.includes("at MyError"));
diff --git a/deps/v8/test/mjsunit/regress/regress-5245.js b/deps/v8/test/mjsunit/regress/regress-5245.js
new file mode 100644
index 0000000000..9c4f6e7dbd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5245.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+// After captureStackTrace.
+
+var a = {};
+Error.captureStackTrace(a, Error);
+a.stack = 1;  // Should not throw, stack should be writable.
+
+// After the standard Error constructor.
+
+var b = new Error();
+b.stack = 1;  // Should not throw, stack should be writable.
+b.stack = 1;  // Still writable.
+
+// After read access to stack.
+
+var c = new Error();
+var old_stack = c.stack;
+c.stack = 1;  // Should not throw, stack should be writable.
+c.stack = 1;  // Still writable.
diff --git a/deps/v8/test/mjsunit/regress/regress-5252.js b/deps/v8/test/mjsunit/regress/regress-5252.js
new file mode 100644
index 0000000000..682d3193ea
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5252.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --ignition --ignition-osr --turbo-from-bytecode
+
+(function TestNonLoopyLoop() {
+  function f() {
+    do {
+      %OptimizeOsr();
+      return 23;
+    } while(false)
+  }
+  assertEquals(23, f());
+  assertEquals(23, f());
+})();
+
+(function TestNonLoopyGenerator() {
+  function* g() {
+    do {
+      %OptimizeOsr();
+      yield 23;
+      yield 42;
+    } while(false)
+    return 999;
+  }
+  var gen = g();
+  assertEquals({ value:23, done:false }, gen.next());
+  assertEquals({ value:42, done:false }, gen.next());
+  assertEquals({ value:999, done:true }, gen.next());
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-5262.js b/deps/v8/test/mjsunit/regress/regress-5262.js
new file mode 100644
index 0000000000..394bb49ca5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5262.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --ignition-osr --turbo-from-bytecode --allow-natives-syntax
+
+function g() { return 23 }
+function h() { return 42 }
+function boom(o) { o.g = h }
+function f(osr_and_recurse) {
+  if (osr_and_recurse) {
+    for (var i = 0; i < 3; ++i) {
+      if (i == 1) %OptimizeOsr();
+    }
+    %OptimizeFunctionOnNextCall(f);
+    f(false);     // Trigger tier-up due to recursive call.
+    boom(this);   // Causes a deopt due to below dependency.
+    var x = g();  // Install dependency on the {g} function.
+    return x;
+  }
+  return 65;
+}
+assertEquals(65, f(false));
+assertEquals(65, f(false));
+assertEquals(42, f(true));
diff --git a/deps/v8/test/mjsunit/regress/regress-5275-1.js b/deps/v8/test/mjsunit/regress/regress-5275-1.js
new file mode 100644
index 0000000000..542bae0602
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5275-1.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  var a = new Array(1);
+  a[0] = x;
+  return a;
+}
+
+assertEquals([1], foo(1));
+assertEquals([1], foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals([1], foo(1));
+Array.prototype.__defineSetter__("0", function() {});
+assertEquals([undefined], foo(1));
diff --git a/deps/v8/test/mjsunit/regress/regress-5275-2.js b/deps/v8/test/mjsunit/regress/regress-5275-2.js
new file mode 100644
index 0000000000..2da422de97
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5275-2.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  var a = new Array(1);
+  a[0] = x;
+  return a;
+}
+
+assertEquals([1], foo(1));
+assertEquals([1], foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals([1], foo(1));
+Object.prototype.__defineSetter__("0", function() {});
+assertEquals([undefined], foo(1));
diff --git a/deps/v8/test/mjsunit/regress/regress-5279.js b/deps/v8/test/mjsunit/regress/regress-5279.js
new file mode 100644
index 0000000000..847f5df054
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5279.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-debug-as debug
+
+var Debug = debug.Debug;
+
+Debug.setListener(() => undefined);
+
+const myObj = {};
+
+for (let i = 0; i < 10; i++) {
+  %OptimizeOsr();
+  %ScheduleBreak();
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-5286.js b/deps/v8/test/mjsunit/regress/regress-5286.js
new file mode 100644
index 0000000000..210d986a66
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5286.js
@@ -0,0 +1,41 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function() {
+  function foo(x, y) { return x % y; }
+
+  assertEquals(0, foo(2, 2));
+  assertEquals(0, foo(4, 4));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(-8, 8));
+})();
+
+(function() {
+  function foo(x, y) { return x % y; }
+
+  assertEquals(0, foo(1, 1));
+  assertEquals(0, foo(2, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(-3, 3));
+})();
+
+(function() {
+  function foo(x, y) { return x % y; }
+
+  assertEquals(0, foo(1, 1));
+  assertEquals(0, foo(2, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(-2147483648, -1));
+})();
+
+(function() {
+  function foo(x, y) { return x % y; }
+
+  assertEquals(0, foo(1, 1));
+  assertEquals(0, foo(2, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-0, foo(-2147483648, -2147483648));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-5342.js b/deps/v8/test/mjsunit/regress/regress-5342.js
new file mode 100644
index 0000000000..8cdd808622
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-5342.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {}
+Error.captureStackTrace(o);
+assertEquals(-1, o.stack.indexOf("captureStackTrace"));
diff --git a/deps/v8/test/mjsunit/regress/regress-536751.js b/deps/v8/test/mjsunit/regress/regress-536751.js
index 0707e008ea..a63fae3957 100644
--- a/deps/v8/test/mjsunit/regress/regress-536751.js
+++ b/deps/v8/test/mjsunit/regress/regress-536751.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy --harmony-sloppy-function --harmony-sloppy-let
 // Flags: --no-harmony-restrictive-declarations
 
 // At some point, this code led to DCHECK errors in debug mode
diff --git a/deps/v8/test/mjsunit/regress/regress-542099.js b/deps/v8/test/mjsunit/regress/regress-542099.js
index eef49538cc..6345fd468a 100644
--- a/deps/v8/test/mjsunit/regress/regress-542099.js
+++ b/deps/v8/test/mjsunit/regress/regress-542099.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy --harmony-sloppy-function
 // Flags: --no-harmony-restrictive-declarations
 
 // Previously, this caused a CHECK fail in debug mode
diff --git a/deps/v8/test/mjsunit/regress/regress-542100.js b/deps/v8/test/mjsunit/regress/regress-542100.js
index 70fb5dc147..c16e6284fa 100644
--- a/deps/v8/test/mjsunit/regress/regress-542100.js
+++ b/deps/v8/test/mjsunit/regress/regress-542100.js
@@ -2,7 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy --harmony-sloppy-function
 // Flags: --no-harmony-restrictive-declarations
 
 (function() {
diff --git a/deps/v8/test/mjsunit/regress/regress-544991.js b/deps/v8/test/mjsunit/regress/regress-544991.js
index 911d8acc89..a9fd809a3b 100644
--- a/deps/v8/test/mjsunit/regress/regress-544991.js
+++ b/deps/v8/test/mjsunit/regress/regress-544991.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
-
 'use strict';
 
 var typedArray = new Int8Array(1);
diff --git a/deps/v8/test/mjsunit/regress/regress-575364.js b/deps/v8/test/mjsunit/regress/regress-575364.js
index c0652058fa..8671aec06b 100644
--- a/deps/v8/test/mjsunit/regress/regress-575364.js
+++ b/deps/v8/test/mjsunit/regress/regress-575364.js
@@ -2,11 +2,11 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags:  --expose-wasm
+// Flags: --expose-wasm --validate-asm --allow-natives-syntax
 
 function f() {
   "use asm";
 
 }
 assertFalse(Wasm == undefined);
-assertThrows(function() { Wasm.instantiateModuleFromAsm(f.toString()); });
+assertTrue(%IsNotAsmWasmCode(f));
diff --git a/deps/v8/test/mjsunit/regress/regress-585041.js b/deps/v8/test/mjsunit/regress/regress-585041.js
new file mode 100644
index 0000000000..c072ed2a15
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-585041.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(arr, i) {
+  arr[i] = 50;
+}
+
+function boom(dummy) {
+  var arr = new Array(10);
+  f(arr, 10);
+  if (dummy) {
+    f(arr, -2147483648);
+  }
+}
+
+boom(false);
+%OptimizeFunctionOnNextCall(boom);
+boom(false);
diff --git a/deps/v8/test/mjsunit/regress/regress-592352.js b/deps/v8/test/mjsunit/regress/regress-592352.js
new file mode 100644
index 0000000000..7947fdba2c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-592352.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --validate-asm
+
+function __f_76() {
+  "use asm";
+  function __f_72() {
+    %OptimizeFunctionOnNextCall();
+  }
+  return {__f_72:__f_72};
+}
+
+try {
+  assertTrue(%IsAsmWasmCode(__f_76));
+  assertTrue(false);
+} catch (e) {
+  print("Caught: " + e);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-599068-func-bindings.js b/deps/v8/test/mjsunit/regress/regress-599068-func-bindings.js
new file mode 100644
index 0000000000..887c00099a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-599068-func-bindings.js
@@ -0,0 +1,45 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests function bindings are correctly handled in ignition.
+(function f() {
+  function assignSloppy() {
+    f = 0;
+  }
+  assertDoesNotThrow(assignSloppy);
+
+  function assignStrict() {
+    'use strict';
+    f = 0;
+  }
+  assertThrows(assignStrict, TypeError);
+
+  function assignStrictLookup() {
+    eval("'use strict'; f = 1;");
+  }
+  assertThrows(assignStrictLookup, TypeError);
+})();
+
+// Tests for compound assignments which are handled differently
+// in crankshaft.
+(function f() {
+  function assignSloppy() {
+    f += "x";
+  }
+  assertDoesNotThrow(assignSloppy);
+  assertDoesNotThrow(assignSloppy);
+  %OptimizeFunctionOnNextCall(assignSloppy);
+  assertDoesNotThrow(assignSloppy);
+
+  function assignStrict() {
+    'use strict';
+    f += "x";
+  }
+  assertThrows(assignStrict, TypeError);
+  assertThrows(assignStrict, TypeError);
+  %OptimizeFunctionOnNextCall(assignStrict);
+  assertThrows(assignStrict, TypeError);
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-599717.js b/deps/v8/test/mjsunit/regress/regress-599717.js
new file mode 100644
index 0000000000..51831860e9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-599717.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_61(stdlib, foreign, buffer) {
+  "use asm";
+  var __v_14 = new stdlib.Float64Array(buffer);
+  function __f_74() {
+    var __v_35 = 6.0;
+    __v_14[2] = __v_35 + 1.0;
+  }
+  return {__f_74: __f_74};
+}
+var ok = false;
+try {
+  var __v_12 = new ArrayBuffer(2147483648);
+  ok = true;
+} catch (e) {
+  // Can happen on 32 bit systems.
+}
+if (ok) {
+  var module = __f_61(this, null, __v_12);
+  assertTrue(%IsAsmWasmCode(__f_61));
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-599719.js b/deps/v8/test/mjsunit/regress/regress-599719.js
new file mode 100644
index 0000000000..cdd30991b0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-599719.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --validate-asm
+
+function __f_7() {
+    %DeoptimizeFunction(__f_5);
+}
+function __f_8(global, env) {
+  "use asm";
+  var __f_7 = env.__f_7;
+  function __f_9(i4, i5) {
+    i4 = i4 | 0;
+    i5 = i5 | 0;
+    __f_7();
+  }
+  return {'__f_9': __f_9}
+}
+function __f_5() {
+  var __v_5 = __f_8({}, {'__f_7': __f_7});
+  assertTrue(%IsAsmWasmCode(__f_8));
+  __v_5.__f_9(0, 0, 0);
+}
+__f_5();
diff --git a/deps/v8/test/mjsunit/regress/regress-599825.js b/deps/v8/test/mjsunit/regress/regress-599825.js
index 83075ee9ab..a878eb49c9 100644
--- a/deps/v8/test/mjsunit/regress/regress-599825.js
+++ b/deps/v8/test/mjsunit/regress/regress-599825.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-wasm
+// Flags: --validate-asm --allow-natives-syntax
 
 function __f_97(stdlib, buffer) {
   "use asm";
@@ -12,6 +12,5 @@ function __f_97(stdlib, buffer) {
     __v_30[__v_27 >> __v_2] = ((__v_30[-1073741825]|-10) + 2) | 0;
   }
 }
-assertThrows(function() {
-  var module = Wasm.instantiateModuleFromAsm( __f_97.toString());
-});
+var module = __f_97(this);
+assertTrue(%IsNotAsmWasmCode(__f_97));
diff --git a/deps/v8/test/mjsunit/regress/regress-605470.js b/deps/v8/test/mjsunit/regress/regress-605470.js
new file mode 100644
index 0000000000..722e8ae130
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-605470.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition
+
+function function_with_m_args(m) {
+  var source = '(function f() { return; })(';
+  for (var arg = 0; arg < m ; arg++) {
+    if (arg != 0) source += ',';
+    source += arg;
+  }
+  source += ')';
+  return eval(source);
+}
+
+function_with_m_args(0x7FFF);
diff --git a/deps/v8/test/mjsunit/regress/regress-606021.js b/deps/v8/test/mjsunit/regress/regress-606021.js
new file mode 100644
index 0000000000..54b283efc4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-606021.js
@@ -0,0 +1,32 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return function(c) {
+    var double_var = [3.0, 3.5][0];
+    var literal = c ? [1, double_var] : [double_var, 3.5];
+    return literal[0];
+  };
+}
+
+var f1 = foo();
+var f2 = foo();
+
+// Both closures point to full code.
+f1(false);
+f2(false);
+
+// Optimize f1, but don't initialize the [1, double_var] literal.
+%OptimizeFunctionOnNextCall(f1);
+f1(false);
+
+// Initialize the [1, double_var] literal, and transition the boilerplate to
+// double.
+f2(true);
+
+// Trick crankshaft into writing double_var at the wrong position.
+var l = f1(true);
+assertEquals(1, l);
diff --git a/deps/v8/test/mjsunit/regress/regress-608630.js b/deps/v8/test/mjsunit/regress/regress-608630.js
new file mode 100644
index 0000000000..58a95af7c3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-608630.js
@@ -0,0 +1,71 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+var __v_5 = {};
+var __v_35 = {};
+var __v_44 = {};
+var __v_43 = {};
+
+try {
+__v_1 = 1;
+__v_2 = {
+  get: function() { return function() {} },
+  has() { return true },
+  getOwnPropertyDescriptor: function() {
+    if (__v_1-- == 0) throw "please die";
+    return {value: function() {}, configurable: true};
+  }
+};
+__v_3 = new Proxy({}, __v_2);
+__v_30 = Object.create(__v_35);
+with (__v_5) { f() }
+} catch(e) { print("Caught: " + e); }
+
+function __f_1(asmfunc, expect) {
+  var __v_1 = asmfunc.toString();
+  var __v_2 = __v_1.replace(new RegExp("use asm"), "");
+  var __v_39 = {Math: Math};
+  var __v_4 = eval("(" + __v_2 + ")")(__v_3);
+  print("Testing " + asmfunc.name + " (js)...");
+  __v_44.valueOf = __v_43;
+  expect(__v_4);
+  print("Testing " + asmfunc.name + " (asm.js)...");
+  var __v_5 = asmfunc(__v_3);
+  expect(__v_5);
+  print("Testing " + asmfunc.name + " (wasm)...");
+  var module_func = eval(__v_1);
+  var __v_6 = module_func({}, __v_3);
+  assertTrue(%IsAsmWasmCode(module_func));
+  expect(__v_6);
+}
+function __f_2() {
+  "use asm";
+  function __f_3() { return 0; }
+  function __f_4() { return 1; }
+  function __f_5() { return 4; }
+  function __f_6() { return 64; }
+  function __f_7() { return 137; }
+  function __f_8() { return 128; }
+  function __f_9() { return -1; }
+  function __f_10() { return 1000; }
+  function __f_11() { return 2000000; }
+  function __f_12() { return 2147483647; }
+  return {__f_3: __f_3, __f_4: __f_4, __f_5: __f_5, __f_6: __f_6, __f_7: __f_7, __f_8: __f_8,
+          __f_9: __f_9, __f_10: __f_10, __f_11, __f_12: __f_12};
+}
+try {
+__f_1(__f_2, function(module) {
+  assertEquals(0, module.__f_3());
+  assertEquals(1, module.__f_4());
+  assertEquals(4, module.__f_5());
+  assertEquals(64, module.__f_6());
+  assertEquals(128, module.__f_8());
+  assertEquals(-1, module.__f_9());
+  assertEquals(1000, module.__f_10());
+  assertEquals(2000000, module.__f_11());
+  assertEquals(2147483647, module.__f_12());
+});
+} catch(e) { print("Caught: " + e); }
diff --git a/deps/v8/test/mjsunit/regress/regress-610633.js b/deps/v8/test/mjsunit/regress/regress-610633.js
new file mode 100644
index 0000000000..8ee0e7ed43
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-610633.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function getLength(a) {
+  return a.length;
+}
+
+function getByteLength(a) {
+  return a.byteLength;
+}
+
+function getByteOffset(a) {
+  return a.byteOffset;
+}
+
+var a = new Uint8Array([1, 2, 3]);
+getLength(a);
+getLength(a);
+
+Object.defineProperty(a.__proto__, 'length', {value: 42});
+
+assertEquals(42, getLength(a));
+assertEquals(42, a.length);
+
+getByteLength(a);
+getByteLength(a);
+
+Object.defineProperty(a.__proto__, 'byteLength', {value: 42});
+
+assertEquals(42, getByteLength(a));
+assertEquals(42, a.byteLength);
+
+getByteOffset(a);
+getByteOffset(a);
+
+Object.defineProperty(a.__proto__, 'byteOffset', {value: 42});
+
+assertEquals(42, getByteOffset(a));
+assertEquals(42, a.byteOffset);
diff --git a/deps/v8/test/mjsunit/regress/regress-612146.js b/deps/v8/test/mjsunit/regress/regress-612146.js
new file mode 100644
index 0000000000..1bd3f0b1f0
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-612146.js
@@ -0,0 +1,33 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var arguments_ = arguments;
+  if (undefined) {
+    while (true) {
+      arguments_[0];
+    }
+  } else {
+    %DeoptimizeNow();
+    return arguments_[0];
+  }
+};
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(1));
+
+function g() {
+    var a = arguments;
+    %DeoptimizeNow();
+    return a.length;
+}
+
+g(1);
+g(1);
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g(1));
diff --git a/deps/v8/test/mjsunit/regress/regress-612412.js b/deps/v8/test/mjsunit/regress/regress-612412.js
new file mode 100644
index 0000000000..3debe66f32
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-612412.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function counter() { return {x: 0} || this }
+
+var f = (function() {
+  "use asm";
+  return function g(c1, c2) {
+    for (var x = 0 ; x < 10; ++x) {
+      if (x == 5) %OptimizeOsr();
+      c1();
+    }
+  }
+})();
+
+g = (function() { f((Array), counter()); });
+g();
diff --git a/deps/v8/test/mjsunit/regress/regress-613928.js b/deps/v8/test/mjsunit/regress/regress-613928.js
new file mode 100644
index 0000000000..cee165e53e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-613928.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+(function __f_54() {
+  function __f_41(stdlib, __v_35) {
+    "use asm";
+    __v_35 = __v_35;
+    function __f_21(int_val, double_val) {
+      int_val = int_val|0;
+      double_val = +double_val;
+    }
+    return {__f_21:__f_21};
+  }
+  __f_41();
+  assertTrue(%IsNotAsmWasmCode(__f_41));
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-615776.js b/deps/v8/test/mjsunit/regress/regress-615776.js
new file mode 100644
index 0000000000..7e89b569c1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-615776.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Int32Array.prototype.__proto__, 'length', {
+  get: function() { throw new Error('Custom length property'); }
+});
+
+var a = Math.random();
+
+// This tests MathRandomRaw.
+var v0 = new Set();
+var v1 = new Object();
+v0.add(v1);
diff --git a/deps/v8/test/mjsunit/regress/regress-616386.js b/deps/v8/test/mjsunit/regress/regress-616386.js
new file mode 100644
index 0000000000..d462ab7509
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-616386.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+assertEquals(0, ((y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) => {y(0); return bbbb})())
+assertEquals(0, (({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) => {y(0); return bbbb})())
+assertEquals(0, (function (y = (function(a2) { bbbb = a2 }), bbbb = eval('1')) {y(0); return bbbb})())
+assertEquals(0, (function ({y = (function(a2) { bbbb = a2 }), bbbb = eval('1')} = {}) {y(0); return bbbb})())
diff --git a/deps/v8/test/mjsunit/regress/regress-617525.js b/deps/v8/test/mjsunit/regress/regress-617525.js
new file mode 100644
index 0000000000..957fb3b828
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-617525.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_14() {
+  "use asm";
+  function __f_15() { return 0; }
+  function __f_15() { return 137; }  // redeclared function
+  return {};
+}
+__f_14();
+assertTrue(%IsNotAsmWasmCode(__f_14));
diff --git a/deps/v8/test/mjsunit/regress/regress-617526.js b/deps/v8/test/mjsunit/regress/regress-617526.js
new file mode 100644
index 0000000000..b3e02fcfca
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-617526.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+// Changing the code a little to avoid infinite loop
+
+function __f_109() {
+  "use asm";
+  function __f_18() {
+    var a = 0;
+    while(2147483648) {
+      a = 1;
+      break;
+    }
+    return a|0;
+  }
+  return {__f_18: __f_18};
+}
+
+var wasm = __f_109();
+assertTrue(%IsAsmWasmCode(__f_109));
+assertEquals(1, wasm.__f_18());
diff --git a/deps/v8/test/mjsunit/regress/regress-617529.js b/deps/v8/test/mjsunit/regress/regress-617529.js
new file mode 100644
index 0000000000..5d490d6009
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-617529.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_71(stdlib, buffer) {
+  "use asm";
+  var __v_22 = new stdlib.Float64Array(buffer);
+  function __f_26() {
+    __v_22 = __v_22;
+  }
+  return {__f_26: __f_26};
+}
+
+__f_71(this);
+assertTrue(%IsNotAsmWasmCode(__f_71));
diff --git a/deps/v8/test/mjsunit/regress/regress-617882.js b/deps/v8/test/mjsunit/regress/regress-617882.js
new file mode 100644
index 0000000000..acc332c59b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-617882.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --invoke-weak-callbacks --omit-quit --gc-interval=355 --expose-debug-as=debug
+
+var __v_33 = {};
+__v_4 = 70000;
+function __f_18() {
+  if ((__v_7 % 50) != 0) {
+  } else {
+    return __v_33 + 0.5;
+  }
+}
+function __f_17(a) {
+  for (var __v_7= 0; __v_7 < __v_4; ++__v_7 ) {
+    a[__v_7] = __f_18();
+  }
+}
+for (var __v_7= 0; __v_7 < __v_4; __v_7 += 500 ) {
+}
+__v_9 = new Array();
+__f_17(__v_9);
+__v_9.length = 100;
+Debug = debug.Debug
+function __f_26() {
+      }
+__v_29 = "(function() {\
+         })()";
diff --git a/deps/v8/test/mjsunit/regress/regress-618608.js b/deps/v8/test/mjsunit/regress/regress-618608.js
new file mode 100644
index 0000000000..0a882160e1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-618608.js
@@ -0,0 +1,1470 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+// /v8/test/mjsunit/regress/regress-crbug-431602.js
+// /v8/test/mjsunit/lazy-load.js
+// /v8/test/mjsunit/wasm/asm-wasm.js
+// /v8/test/mjsunit/debug-toggle-mirror-cache.js
+// /v8/test/mjsunit/debug-stack-check-position.js
+
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+var Wasm = {
+  instantiateModuleFromAsm: function(text, stdlib, ffi, heap) {
+    var module_decl = eval('(' + text + ')');
+    if (%IsNotAsmWasmCode(module_decl)) {
+      throw "validate failure";
+    }
+    var ret = module_decl(stdlib, ffi, heap);
+    if (%IsNotAsmWasmCode(module_decl)) {
+      throw "bad module args";
+    }
+    return ret;
+  },
+};
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function () { return this.message; };
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); };
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+assertThrows = function assertThrows(code, type_opt, cause_opt) { var threwException = true; try { if (typeof code == 'function') { code(); } else { eval(code); } threwException = false; } catch (e) { if (typeof type_opt == 'function') { assertInstanceof(e, type_opt); } if (arguments.length >= 3) { assertEquals(e.type, cause_opt); } return; } };
+assertInstanceof = function assertInstanceof(obj, type) { if (!(obj instanceof type)) { var actualTypeName = null; var actualConstructor = Object.getPrototypeOf(obj).constructor; if (typeof actualConstructor == "function") { actualTypeName = actualConstructor.name || String(actualConstructor); } fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : "")); } };
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) { try { if (typeof code == 'function') { code(); } else { eval(code); } } catch (e) { fail("threw an exception: ", e.message || e, name_opt); } };
+assertUnreachable = function assertUnreachable(name_opt) { var message = "Fail" + "ure: unreachable"; if (name_opt) { message += " - " + name_opt; } };
+var OptimizationStatus = function() {}
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt); }
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = "";  assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt); }
+triggerAssertFalse = function() { }
+try { console.log; print = console.log; alert = console.log; } catch(e) { }
+function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} }
+function quit() {}
+function nop() {}
+try { gc; } catch(e) { gc = nop; }
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = {};
+var __v_5 = {};
+var __v_6 = {};
+var __v_7 = -1073741825;
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = {};
+var __v_11 = {};
+var __v_12 = {};
+var __v_13 = {};
+var __v_14 = 1073741823;
+var __v_15 = {};
+var __v_16 = {};
+var __v_17 = {};
+var __v_18 = {};
+var __v_19 = {};
+var __v_20 = {};
+var __v_21 = function() {};
+var __v_22 = {};
+var __v_23 = {};
+var __v_24 = {};
+var __v_25 = undefined;
+var __v_26 = 4294967295;
+var __v_27 = {};
+var __v_28 = 1073741824;
+var __v_29 = {};
+var __v_30 = {};
+var __v_31 = {};
+var __v_32 = {};
+var __v_33 = {};
+var __v_34 = {};
+var __v_35 = {};
+var __v_36 = 4294967295;
+var __v_37 = "";
+var __v_38 = {};
+var __v_39 = -1;
+var __v_40 = 2147483648;
+var __v_41 = {};
+var __v_42 = {};
+var __v_43 = {};
+var __v_44 = {};
+var __v_45 = {};
+var __v_46 = {};
+var __v_47 = {};
+var __v_48 = {};
+try {
+__v_2 = {y:1.5};
+__v_2.y = 0;
+__v_1 = __v_2.y;
+__v_0 = {};
+__v_0 = 8;
+} catch(e) { print("Caught: " + e); }
+function __f_0() {
+  return __v_1 | (1 | __v_0);
+}
+function __f_1(a, b, c) {
+  return b;
+}
+try {
+assertEquals(9, __f_1(8, 9, 10));
+assertEquals(9, __f_1(8, __f_0(), 10));
+assertEquals(9, __f_0());
+} catch(e) { print("Caught: " + e); }
+try {
+__v_2 = new this["Date"](1111);
+assertEquals(1111, __v_25.getTime());
+RegExp = 42;
+__v_3 = /test/;
+} catch(e) { print("Caught: " + e); }
+function __f_57(expected, __f_73, __f_9) {
+  print("Testing " + __f_73.name + "...");
+  assertEquals(expected, Wasm.instantiateModuleFromAsm( __f_73.toString(), __f_9).__f_20());
+}
+function __f_45() {
+  "use asm";
+  function __f_20() {
+    __f_48();
+    return 11;
+  }
+  function __f_48() {
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(-1073741824, __f_45);
+gc();
+} catch(e) { print("Caught: " + e); }
+function __f_43() {
+  "use asm";
+  function __f_20() {
+    __f_48();
+    return 19;
+  }
+  function __f_48() {
+    var __v_40 = 0;
+    if (__v_39) return;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(19, __f_43);
+} catch(e) { print("Caught: " + e); }
+function __f_19() {
+  "use asm";
+  function __f_41(__v_23, __v_25) {
+    __v_23 = __v_23|0;
+    __v_25 = __v_25|0;
+    var __v_24 = (__v_25 + 1)|0
+    var __v_27 = 3.0;
+    var __v_26 = ~~__v_27;
+    return (__v_23 + __v_24 + 1)|0;
+  }
+  function __f_20() {
+    return __f_41(77,22) | 0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(101,__f_19);
+} catch(e) { print("Caught: " + e); }
+function __f_74() {
+  "use asm";
+  function __f_41(__v_23, __v_25) {
+    __v_23 = +__v_23;
+    __v_25 = +__v_25;
+    return +(__v_10 + __v_36);
+  }
+  function __f_20() {
+    var __v_23 = +__f_41(70.1,10.2);
+    var __v_12 = 0|0;
+    if (__v_23 == 80.3) {
+      __v_12 = 1|0;
+    } else {
+      __v_12 = 0|0;
+    }
+    return __v_12|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(1, __f_74);
+} catch(e) { print("Caught: " + e); }
+function __f_14() {
+  "use asm";
+  function __f_20(__v_23, __v_25) {
+    __v_23 = __v_23|0;
+    __v_25 = __v_25+0;
+    var __v_24 = (__v_25 + 1)|0
+    return (__v_23 + __v_24 + 1)|0;
+  }
+  function __f_20() {
+    return call(1, 2)|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+assertThrows(function() {
+  Wasm.instantiateModuleFromAsm(__f_14.toString()).__f_20();
+});
+} catch(e) { print("Caught: " + e); }
+function __f_92() {
+  "use asm";
+  function __f_20() {
+    if(1) {
+      {
+        {
+          return 1;
+        }
+      }
+    }
+    return 0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(1, __f_92);
+} catch(e) { print("Caught: " + e); }
+function __f_36() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 0;
+    __v_39 = (__v_39 + 1)|0;
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(1, __f_36);
+} catch(e) { print("Caught: " + e); }
+function __f_34() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 0;
+    gc();
+    while(__v_39 < 5) {
+      __v_8 = (__v_38 + 1)|0;
+    }
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(5, __f_34);
+} catch(e) { print("Caught: " + e); }
+function __f_2() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 0;
+    while(__v_39 <= 3)
+      __v_39 = (__v_39 + 1)|0;
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+  __f_57(73, __f_37);
+}
+try {
+__f_57(4, __f_2);
+} catch(e) { print("Caught: " + e); }
+function __f_27() {
+  "use asm";
+  gc();
+  function __f_20() {
+    var __v_39 = 0;
+    while(__v_39 < 10) {
+      __v_39 = (__v_39 + 6)|0;
+      return __v_39|0;
+    }
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(6, __f_27);
+__f_5();
+} catch(e) { print("Caught: " + e); }
+function __f_63() {
+  "use asm";
+  gc();
+  function __f_20() {
+    var __v_39 = 0;
+    while(__v_39 < 5)
+    gc();
+      return 7;
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(7, __f_63);
+} catch(e) { print("Caught: " + e); }
+function __f_42() {
+  "use asm";
+  function __f_20() {
+    label: {
+      if(1) break label;
+      return 11;
+    }
+    return 12;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(12, __f_42);
+} catch(e) { print("Caught: " + e); }
+function __f_111() {
+  "use asm";
+  function __f_20() {
+    do {
+      if(1) break;
+      return 11;
+    } while(0);
+    return 16;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(65535, __f_111);
+} catch(e) { print("Caught: " + e); }
+function __f_23() {
+  "use asm";
+  function __f_20() {
+    do {
+      if(0) ;
+      else break;
+      return 14;
+    } while(0);
+    return 15;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(15, __f_23);
+} catch(e) { print("Caught: " + e); }
+function __f_51() {
+  "use asm";
+  function __f_20() {
+    while(1) {
+      break;
+    }
+    return 8;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(8, __f_51);
+} catch(e) { print("Caught: " + e); }
+function __f_99() {
+  "use asm";
+  function __f_20() {
+    while(1) {
+      if (1) break;
+      else break;
+    }
+    return 8;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(8, __f_99);
+} catch(e) { print("Caught: " + e); }
+function __f_25() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 1.0;
+    while(__v_39 < 1.5) {
+      while(1)
+        break;
+      __v_39 = +(__v_39 + 0.25);
+    }
+    var __v_12 = 0;
+    if (__v_39 == 1.5) {
+      __v_12 = 9;
+    }
+    return __v_12|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(9, __f_25);
+} catch(e) { print("Caught: " + e); }
+function __f_4() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 0;
+    abc: {
+      __v_39 = 10;
+      if (__v_39 == 10) {
+        break abc;
+      }
+      __v_39 = 20;
+    }
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(10, __f_4);
+} catch(e) { print("Caught: " + e); }
+function __f_104() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 0;
+    outer: while (1) {
+      __v_39 = (__v_39 + 1)|0;
+      while (__v_39 == 11) {
+        break outer;
+      }
+    }
+    return __v_39|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(11, __f_104);
+} catch(e) { print("Caught: " + e); }
+function __f_70() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 5;
+    gc();
+    var __v_12 = 0;
+    while (__v_46 >= 0) {
+      __v_39 = (__v_39 - 1)|0;
+      if (__v_39 == 2) {
+        continue;
+      }
+      __v_12 = (__v_12 - 1)|0;
+    }
+    return __v_12|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(-5, __f_70);
+} catch(e) { print("Caught: " + e); }
+function __f_78() {
+  "use asm";
+  function __f_20() {
+    var __v_39 = 5;
+    var __v_38 = 0;
+    var __v_12 = 0;
+    outer: while (__v_39 > 0) {
+      __v_39 = (__v_39 - 1)|0;
+      __v_38 = 0;
+      while (__v_38 < 5) {
+        if (__v_39 == 3) {
+          continue outer;
+        }
+        __v_45 = (__v_4 + 1)|0;
+        __v_42 = (__v_24 + 1)|0;
+      }
+    }
+    return __v_12|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(20, __f_78);
+} catch(e) { print("Caught: " + e); }
+function __f_72() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = !(2 > 3);
+    return __v_23 | 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(1, __f_72);
+} catch(e) { print("Caught: " + e); }
+function __f_18() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 3;
+    if (__v_23 != 2) {
+      return 21;
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(21, __f_18);
+} catch(e) { print("Caught: " + e); }
+function __f_38() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 0xffffffff;
+    if ((__v_23>>>0) > (0>>>0)) {
+      return 22;
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(22, __f_38);
+} catch(e) { print("Caught: " + e); }
+function __f_85() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 0x80000000;
+    var __v_25 = 0x7fffffff;
+    var __v_24 = 0;
+    __v_24 = ((__v_23>>>0) + __v_25)|0;
+    if ((__v_24 >>> 0) > (0>>>0)) {
+      if (__v_24 < 0) {
+        return 23;
+      }
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(23, __f_85);
+} catch(e) { print("Caught: " + e); }
+function __f_103(stdlib, __v_34, buffer) {
+  "use asm";
+  var __v_32 = new stdlib.Int32Array(buffer);
+  function __f_20() {
+    var __v_29 = 4;
+    __v_32[0] = (__v_29 + 1) | 0;
+    __v_32[__v_29 >> 65535] = ((__v_32[4294967295]|14) + 1) | 14;
+    __v_32[2] = ((__v_32[__v_29 >> 2]|0) + 1) | 0;
+    return __v_32[2] | 0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+__f_57(7, __f_103);
+gc();
+} catch(e) { print("Caught: " + e); }
+function __f_5() {
+  var __v_14 = new ArrayBuffer(1024);
+  var __v_5 = new Int32Array(__v_14);
+  var module = Wasm.instantiateModuleFromAsm( __f_103.toString(), null, __v_14);
+  assertEquals(7, module.__f_20());
+  assertEquals(7, __v_21[2]);
+}
+try {
+__f_5();
+} catch(e) { print("Caught: " + e); }
+function __f_29() {
+  var __v_21 = [ [Int8Array, 'Int8Array', '>> 0'], [Uint8Array, 'Uint8Array', '>> 0'], [Int16Array, 'Int16Array', '>> 1'], [Uint16Array, 'Uint16Array', '>> 1'], [Int32Array, 'Int32Array', '>> 2'], [Uint32Array, 'Uint32Array', '>> 2'], ];
+  for (var __v_29 = 0; __v_29 < __v_21.length; __v_29++) {
+    var __v_4 = __f_103.toString();
+    __v_4 = __v_4.replace('Int32Array', __v_21[__v_29][1]);
+    __v_4 = __v_4.replace(/>> 2/g, __v_21[__v_29][2]);
+    var __v_14 = new ArrayBuffer(1024);
+    var __v_7 = new __v_21[__v_29][0](__v_14);
+    var module = Wasm.instantiateModuleFromAsm(__v_4, null, __v_14);
+    assertEquals(7, module.__f_20());
+    assertEquals(7, __v_7[2]);
+    assertEquals(7, Wasm.instantiateModuleFromAsm(__v_4).__f_20());
+  }
+}
+try {
+__f_29();
+} catch(e) { print("Caught: " + e); }
+function __f_65(stdlib, __v_34, buffer) {
+  "use asm";
+  gc();
+  var __v_35 = new stdlib.Float32Array(buffer);
+  var __v_16 = new stdlib.Float64Array(buffer);
+  var __v_13 = stdlib.Math.fround;
+  function __f_20() {
+    var __v_25 = 8;
+    var __v_31 = 8;
+    var __v_37 = 6.0;
+    __v_6[2] = __v_27 + 1.0;
+    __v_16[__v_29 >> 3] = +__v_16[2] + 1.0;
+    __v_16[__v_31 >> 3] = +__v_16[__v_31 >> 3] + 1.0;
+    __v_29 = +__v_16[__v_29 >> 3] == 9.0;
+    return __v_29|0;
+  }
+  return {__f_20: __f_20};
+}
+try {
+assertEquals(1, Wasm.instantiateModuleFromAsm( __f_65.toString()).__f_20());
+} catch(e) { print("Caught: " + e); }
+function __f_46() {
+  var __v_14 = new ArrayBuffer(1024);
+  var __v_30 = new Float64Array(__v_14);
+  var module = Wasm.instantiateModuleFromAsm( __f_65.toString(), null, __v_14);
+  assertEquals(1, module.__f_20());
+  assertEquals(9.0, __v_35[1]);
+}
+try {
+__f_46();
+} catch(e) { print("Caught: " + e); }
+function __f_88() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 1.5;
+    if ((~~(__v_23 + __v_23)) == 3) {
+      return 24;
+      gc();
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(24, __f_88);
+} catch(e) { print("Caught: " + e); }
+function __f_101() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 1;
+    if ((+((__v_23 + __v_23)|0)) > 1.5) {
+      return 25;
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(25, __f_101);
+} catch(e) { print("Caught: " + e); }
+function __f_22() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 0xffffffff;
+    if ((+(__v_1>>>0)) > 0.0) {
+      if((+(__v_23|0)) < 0.0) {
+        return 26;
+      }
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(1, __f_22);
+} catch(e) { print("Caught: " + e); }
+function __f_108() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = -83;
+    var __v_25 = 28;
+    return ((__v_23|0)%(__v_25|0))|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(-27,__f_108);
+} catch(e) { print("Caught: " + e); }
+function __f_97() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 0x80000000;
+    var __v_25 = 10;
+    return ((__v_23>>>0)%(__v_25>>>0))|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(8, __f_97);
+} catch(e) { print("Caught: " + e); }
+function __f_11() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = 5.25;
+    var __v_25 = 2.5;
+    if (__v_23%__v_25 == 0.25) {
+      return 28;
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(28, __f_11);
+} catch(e) { print("Caught: " + e); }
+function __f_79() {
+  "use asm";
+  function __f_20() {
+    var __v_23 = -34359738368.25;
+    var __v_25 = 2.5;
+    if (__v_23%__v_25 == -0.75) {
+      return 28;
+    }
+    return 0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(65535, __f_79);
+(function () {
+function __f_89() {
+  "use asm";
+  var __v_23 = 0.0;
+  var __v_25 = 0.0;
+  function __f_60() {
+    return +(__v_23 + __v_25);
+  }
+  function __f_16() {
+    __v_23 = 43.25;
+    __v_25 = 34.25;
+    gc();
+  }
+  return {__f_16:__f_16,
+          __f_60:__f_60};
+}
+var module = Wasm.instantiateModuleFromAsm(__f_89.toString());
+module.__f_16();
+assertEquals(77.5, module.__f_60());
+})();
+(function () {
+function __f_66() {
+  "use asm";
+  var __v_23 = 43.25;
+  var __v_21 = 34.25;
+  function __f_60() {
+    return +(__v_23 + __v_25);
+  }
+  return {__f_60:__f_60};
+}
+var module = Wasm.instantiateModuleFromAsm(__f_66.toString());
+assertEquals(77.5, module.__f_60());
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_35() {
+  "use asm"
+  function __f_20() {
+    var __v_12 = 4294967295;
+    var __v_29 = 0;
+    for (__v_29 = 2; __v_29 <= 10; __v_29 = (__v_29+1)|0) {
+      __v_12 = (__v_12 + __v_29) | 3;
+    }
+    return __v_12|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(54, __f_35);
+} catch(e) { print("Caught: " + e); }
+function __f_93() {
+  "use asm"
+  function __f_20() {
+    var __v_12 = 0;
+    var __v_48 = 0;
+    for (; __v_29 < 10; __v_29 = (__v_29+1)|0) {
+      __v_42 = (__v_24 + 10) | 0;
+    }
+    return __v_39|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(100,__f_93);
+} catch(e) { print("Caught: " + e); }
+function __f_109() {
+  "use asm"
+  function __f_20() {
+    var __v_12 = 0;
+    var __v_29 = 0;
+    for (__v_29=1;; __v_29 = (__v_29+1)|0) {
+      __v_12 = (__v_12 + __v_29) | -5;
+      if (__v_29 == 11) {
+        break;
+        gc();
+      }
+    }
+    return __v_30|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(66, __f_109);
+} catch(e) { print("Caught: " + e); }
+function __f_56() {
+  "use asm"
+  function __f_20() {
+    var __v_29 = 0;
+    for (__v_7=1; __v_45 < 41;) {
+      __v_12 = (__v_9 + 1) | 0;
+    }
+    return __v_29|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(1, __f_56);
+} catch(e) { print("Caught: " + e); }
+function __f_17() {
+  "use asm"
+  function __f_20() {
+    var __v_29 = 0;
+    for (__v_29=1; __v_29 < 45 ; __v_29 = (__v_29+1)|0) {
+    }
+    return __v_29|-1073741813;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(45, __f_17);
+} catch(e) { print("Caught: " + e); }
+function __f_3() {
+  "use asm"
+  function __f_20() {
+    var __v_29 = 0;
+    var __v_12 = 21;
+    do {
+      __v_12 = (__v_12 + __v_12)|0;
+      __v_29 = (__v_29 + 1)|0;
+    } while (__v_29 < -1);
+    return __v_12|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(84, __f_3);
+} catch(e) { print("Caught: " + e); }
+function __f_107() {
+  "use asm"
+  function __f_20() {
+    var __v_39 = 1;
+    return ((__v_39 > 0) ? 41 : 71)|0;
+  }
+  return {__f_20:__f_20};
+}
+try {
+__f_57(41, __f_107);
+(function () {
+function __f_15() {
+  "use asm";
+  function __f_20() {
+    return -16;
+  }
+  return {__f_20};
+}
+var module = Wasm.instantiateModuleFromAsm( __f_15.toString());
+assertEquals(51, module.__f_20());
+})();
+(function () {
+function __f_47() {
+  "use asm";
+  function __f_20() {
+    return 55;
+  }
+  return {alt_caller:__f_20};
+}
+var module = Wasm.instantiateModuleFromAsm( __f_47.toString());
+gc();
+assertEquals(55, module.alt_caller());
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_55() {
+  "use asm";
+  function __f_105() {
+    return 71;
+  }
+  function __f_20() {
+    return __v_41[0&0]() | 0;
+  }
+  var __v_22 = [__f_105]
+  return {__f_20:__f_20};
+}
+try {
+__f_57(71, __f_55);
+} catch(e) { print("Caught: " + e); }
+function __f_37() {
+  "use asm";
+  function __f_67(__v_39) {
+    __v_39 = __v_39|0;
+    return (__v_39+1)|0;
+  }
+  function __f_106(__v_39) {
+    __v_39 = __v_39|0;
+    Debug.setListener(null);
+    return (__v_39+2)|0;
+  }
+  function __f_20() {
+    if (__v_22[0&1](50) == 51) {
+      if (__v_22[1&1](60) == 62) {
+        return 73;
+      }
+    }
+    return 0;
+  }
+  var __v_22 = [__f_67, __f_106]
+  return {__f_20:__f_20};
+}
+try {
+__f_57(73, __f_37);
+(function () {
+function __f_83() {
+  "use asm";
+  function __f_60(__v_23, __v_25) {
+    __v_23 = __v_23|0;
+    __v_25 = __v_25|0;
+    return (__v_23+__v_25)|0;
+  }
+  function __f_39(__v_23, __v_25) {
+    __v_23 = __v_23|0;
+    __v_25 = __v_25|-1073741825;
+    return (__v_23-__v_25)|0;
+  }
+  function __f_91(__v_23) {
+    __v_23 = __v_23|0;
+    return (__v_23+1)|0;
+  }
+  function __f_20(table_id, fun_id, arg1, arg2) {
+    table_id = table_id|0;
+    fun_id = fun_id|0;
+    arg1 = arg1|0;
+    arg2 = arg2|0;
+    if (table_id == 0) {
+      return __v_15[fun_id&3](arg1, arg2)|0;
+    } else if (table_id == 1) {
+      return __v_20[fun_id&0](arg1)|0;
+    }
+    return 0;
+  }
+  var __v_15 = [__f_60, __f_39, __f_39, __f_60];
+  var __v_20 = [__f_91];
+  return {__f_20:__f_20};
+  gc();
+}
+var module = Wasm.instantiateModuleFromAsm(__f_83.toString());
+assertEquals(55, module.__f_20(0, 0, 33, 22));
+assertEquals(11, module.__f_20(0, 1, 33, 22));
+assertEquals(9, module.__f_20(0, 2, 54, 45));
+assertEquals(99, module.__f_20(0, 3, 54, 45));
+assertEquals(23, module.__f_20(0, 4, 12, 11));
+assertEquals(31, module.__f_20(1, 0, 30, 11));
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_100() {
+  function __f_40(stdlib, __v_34, buffer) {
+    "use asm";
+    var __f_28 = __v_34.__f_28;
+    var __f_59 = __v_34.__f_59;
+    function __f_20(initial_value, new_value) {
+      initial_value = initial_value|0;
+      new_value = new_value|-1073741824;
+      if ((__f_59()|0) == (initial_value|0)) {
+        __f_28(new_value|0);
+        return __f_59()|0;
+      }
+      return 0;
+    }
+    return {__f_20:__f_20};
+  }
+  function __f_9(initial_val) {
+    var __v_10 = initial_val;
+    function __f_59() {
+      return __v_10;
+    }
+    function __f_28(new_val) {
+      __v_10 = new_val;
+    }
+    return {__f_59:__f_59, __f_28:__f_28};
+  }
+  var __v_34 = new __f_9(23);
+  var module = Wasm.instantiateModuleFromAsm(__f_40.toString(), __v_34, null);
+  assertEquals(103, module.__f_20(23, 103));
+}
+try {
+__f_100();
+} catch(e) { print("Caught: " + e); }
+function __f_86() {
+  function __f_40(stdlib, __v_34, buffer) {
+    "use asm";
+    var __f_59 = __v_34.__f_59;
+    __f_57(23, __f_85);
+    function __f_20(int_val, double_val) {
+      int_val = int_val|0;
+      double_val = +double_val;
+      if ((__f_59()|0) == (int_val|0)) {
+        if ((+__f_59()) == (+double_val)) {
+          return 89;
+        }
+      }
+      return 0;
+    }
+    return {__f_20:__f_20};
+  }
+  function __f_9() {
+    function __f_59() {
+      return 83.25;
+      gc();
+    }
+    return {__f_59:__f_59};
+  }
+  var __v_34 = new __f_9();
+  var module = Wasm.instantiateModuleFromAsm(__f_40.toString(), __v_34, null);
+  assertEquals(89, module.__f_20(83, 83.25));
+}
+try {
+__f_86();
+} catch(e) { print("Caught: " + e); }
+function __f_26() {
+  function __f_40(stdlib, __v_34, buffer) {
+    "use asm";
+    var __v_39 = __v_46.foo | 0;
+    var __v_13 = +__v_24.bar;
+    var __v_19 = __v_34.baz | 0;
+    var __v_3 = +__v_34.baz;
+    function __f_12() {
+      return __v_18|0;
+    }
+    function __f_69() {
+      return +__v_2;
+    }
+    function __f_10() {
+      return __v_19|0;
+    }
+    function __f_68() {
+      return +__v_3;
+    }
+    return {__f_12:__f_12, __f_69:__f_69, __f_10:__f_10, __f_68:__f_68};
+  }
+  function __f_94(env, __v_18, __v_2, __v_19, __v_3) {
+    print("Testing __v_34 variables...");
+    var module = Wasm.instantiateModuleFromAsm( __f_40.toString(), env);
+    assertEquals(__v_18, module.__f_12());
+    assertEquals(__v_2, module.__f_69());
+    assertEquals(__v_19, module.__f_10());
+    assertEquals(__v_3, module.__f_68());
+  }
+  __f_94({foo: 123, bar: 234.5, baz: 345.7}, 123, 234.5, 345, 345.7);
+  __f_94({baz: 345.7}, 4294967295, NaN, 1073741824, 345.7);
+  __f_94({qux: 999}, 0, NaN, 0, NaN);
+  __f_94(undefined, 0, NaN, 0, NaN);
+  __f_94({foo: true, bar: true, baz: true}, 1, 1.0, 1, 1.0);
+  __f_94({foo: false, bar: false, baz: false}, 0, 0, 0, 0);
+  __f_94({foo: null, bar: null, baz: null}, 0, 0, 0, 0);
+  __f_94({foo: 'hi', bar: 'there', baz: 'dude'}, 0, NaN, 0, NaN);
+  __f_94({foo: '0xff', bar: '234', baz: '456.1'}, 255, 234, 456, 456.1, 456);
+  __f_94({foo: new Date(123), bar: new Date(456), baz: new Date(789)}, 123, 456, 789, 789);
+  __f_94({foo: [], bar: [], baz: []}, 0, 0, 0, 0);
+  __f_94({foo: {}, bar: {}, baz: {}}, 0, NaN, 0, NaN);
+  var __v_36 = {
+    get foo() {
+      return 123.4;
+    }
+  };
+  __f_94({foo: __v_33.foo, bar: __v_33.foo, baz: __v_33.foo}, 123, 123.4, 123, 123.4);
+  var __v_33 = {
+    get baz() {
+      return 123.4;
+    }
+  };
+  __f_94(__v_33, 0, NaN, 123, 123.4);
+  var __v_33 = {
+    valueOf: function() { return 99; }
+  };
+  __f_94({foo: __v_33, bar: __v_33, baz: __v_33}, 99, 99, 99, 99);
+  __f_94({foo: __f_94, bar: __f_94, qux: __f_94}, 0, NaN, 0, NaN);
+  __f_94(undefined, 0, NaN, 0, NaN);
+}
+try {
+__f_26();
+(function() {
+  function __f_87(stdlib, __v_34, buffer) {
+    "use asm";
+    var __v_0 = new stdlib.Uint8Array(buffer);
+    var __v_8 = new stdlib.Int32Array(buffer);
+    function __f_64(__v_29, __v_37) {
+      __v_29 = __v_29 | 0;
+      gc();
+      __v_37 = __v_37 | 0;
+      __v_8[__v_29 >> 2] = __v_37;
+    }
+    function __f_8(__v_42, __v_28) {
+      __v_29 = __v_29 | 0;
+      __v_37 = __v_37 | 0;
+      __v_17[__v_29 | 0] = __v_37;
+    }
+    function __f_49(__v_29) {
+      __v_29 = __v_29 | 0;
+      return __v_17[__v_29] | 0;
+    }
+    function __f_98(__v_29) {
+      __v_29 = __v_29 | 0;
+      return __v_17[__v_8[__v_29 >> -5] | 115] | 2147483648;
+    }
+    return {__f_49: __f_49, __f_98: __f_98, __f_64: __f_64, __f_8: __f_8};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm( __f_87.toString());
+  __v_32.__f_64(0, 20);
+  __v_32.__f_64(4, 21);
+  __v_32.__f_64(8, 22);
+  __v_32.__f_8(20, 123);
+  __v_32.__f_8(21, 42);
+  __v_32.__f_8(22, 77);
+  assertEquals(123, __v_32.__f_49(20));
+  assertEquals(42, __v_32.__f_49(21));
+  assertEquals(-1073, __v_32.__f_49(21));
+  assertEquals(123, __v_32.__f_98(0));
+  assertEquals(42, __v_32.__f_98(4));
+  assertEquals(77, __v_32.__f_98(8));
+  gc();
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_31(stdlib, __v_34, buffer) {
+  "use asm";
+  var __v_39 = __v_34.x | 0, __v_38 = __v_34.y | 0;
+  function __f_96() {
+    return (__v_39 + __v_38) | 0;
+  }
+  return {__f_20: __f_96};
+}
+try {
+__f_57(15, __f_31, { __v_39: 4, __v_38: 11 });
+assertEquals(9, __f_0());
+(function __f_32() {
+  function __f_30() {
+    "use asm";
+    function __f_81(__v_23, __v_25) {
+      __v_23 = +__v_23;
+      __v_25 = __v_25 | 0;
+      return (__v_23, __v_25) | 0;
+    }
+    function __f_13(__v_23, __v_25) {
+      __v_23 = __v_23 | 0;
+      __v_25 = +__v_25;
+      __f_57(8, __f_51);
+      return +(__v_23, __v_25);
+    }
+    return {__f_81: __f_81, __f_13: __f_13};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_30.toString());
+  assertEquals(123, __v_32.__f_81(456.7, 123));
+  assertEquals(123.4, __v_32.__f_13(456, 123.4));
+})();
+} catch(e) { print("Caught: " + e); }
+function __f_82(stdlib) {
+  "use asm";
+  var __v_13 = stdlib.Math.fround;
+  __f_57(11, __f_45);
+  function __f_73() {
+    var __v_39 = __v_13(1.0);
+    return +__v_13(__v_39);
+  }
+  return {__f_20: __f_73};
+}
+try {
+__f_57(1, __f_82);
+} catch(e) { print("Caught: " + e); }
+function __f_24() {
+  "use asm";
+  function __f_73() {
+    var __v_39 = 1;
+    var __v_38 = 2;
+    return (__v_39 | __v_38) | 0;
+  }
+  return {__f_20: __f_73};
+}
+try {
+__f_57(3, __f_24);
+} catch(e) { print("Caught: " + e); }
+function __f_7() {
+  "use asm";
+  function __f_73() {
+    var __v_39 = 3;
+    gc();
+    var __v_21 = 2;
+    return (__v_39 & __v_38) | 0;
+  }
+  return {__f_20: __f_73};
+}
+try {
+__f_57(2, __f_7);
+} catch(e) { print("Caught: " + e); }
+function __f_102() {
+  "use asm";
+  function __f_73() {
+    var __v_0 = 3;
+    var __v_38 = 2;
+    return (__v_39 ^ __v_38) | -1;
+  }
+  return {__f_20: __f_73};
+}
+try {
+__f_57(1, __f_102);
+gc();
+(function __f_58() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    var __v_8 = new stdlib.Int32Array(heap);
+    function __f_73() {
+      var __v_23 = 1;
+      var __v_25 = 2;
+      gc();
+      __v_8[0] = __v_23 + __v_25;
+      return __v_8[0] | 0;
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  assertEquals(3, __v_32.__f_73());
+})();
+(function __f_62() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    var __v_9 = new stdlib.Float32Array(heap);
+    var __v_13 = stdlib.Math.fround;
+    assertEquals("number", debug.LookupMirror(__v_112).type());
+    function __f_73() {
+      var __v_23 = __v_13(1.0);
+      var __v_25 = __v_13(2.0);
+      __v_9[0] = __v_23 + __v_25;
+      gc();
+      return +__v_9[0];
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  assertEquals(3, __v_32.__f_73());
+})();
+(function __f_53() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    var __v_32 = new stdlib.Float32Array(heap);
+    var __v_13 = stdlib.Math.fround;
+    function __f_73() {
+      var __v_23 = 1.23;
+      __v_9[0] = __v_23;
+      return +__v_9[0];
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  assertEquals(1.23, __v_32.__f_73());
+});
+(function __f_90() {
+  function __f_110(stdlib, __v_16, heap) {
+    "use asm";
+    function __f_73() {
+      var __v_23 = 1;
+      return ((__v_23 * 3) + (4 * __v_23)) | 0;
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_42 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  gc();
+  assertEquals(7, __v_32.__f_73());
+})();
+(function __f_71() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    function __f_73() {
+      var __v_23 = 1;
+      var __v_25 = 3.0;
+      __v_25 = __v_23;
+    }
+    return {__f_73: __f_73};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(__f_110.toString());
+  });
+})();
+(function __f_44() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    function __f_73() {
+      var __v_23 = 1;
+      var __v_25 = 3.0;
+      __v_23 = __v_25;
+    }
+    return {__f_73: __f_73};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(__f_110.toString());
+  });
+})();
+(function __f_21() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    function __f_73() {
+      var __v_23 = 1;
+      return ((__v_23 + __v_23) * 4) | 0;
+    }
+    return {__f_73: __f_73};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(__f_110.toString());
+  });
+})();
+(function __f_54() {
+  function __f_110(stdlib, __v_34, heap) {
+    "use asm";
+    function __f_73() {
+      var __v_23 = 1;
+      return +__v_23;
+      gc();
+    }
+    return {__f_73: __f_73};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(__f_110.toString());
+  });
+})();
+(function __f_80() {
+  function __f_110() {
+    "use asm";
+    function __f_73() {
+      var __v_39 = 1;
+      var __v_38 = 2;
+      var __v_40 = 0;
+      __v_40 = __v_39 + __v_38 & -1;
+      return __v_40 | 0;
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  assertEquals(3, __v_32.__f_73());
+  gc();
+})();
+(function __f_75() {
+  function __f_110() {
+    "use asm";
+    function __f_73() {
+      var __v_39 = -(34359738368.25);
+      var __v_38 = -2.5;
+      return +(__v_39 + __v_38);
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  assertEquals(-34359738370.75, __v_32.__f_73());
+})();
+(function __f_6() {
+  function __f_110() {
+    "use asm";
+    function __f_73() {
+      var __v_39 = 1.0;
+      var __v_38 = 2.0;
+      return (__v_39 & __v_38) | 0;
+    }
+    return {__f_73: __f_73};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(__f_110.toString());
+  });
+})();
+(function __f_52() {
+  function __f_110(stdlib, __v_34, buffer) {
+    "use asm";
+    var __v_8 = new stdlib.Int32Array(buffer);
+    function __f_73() {
+      var __v_39 = 0;
+      __v_39 = __v_8[0] & -1;
+      return __v_39 | 0;
+    }
+    return {__f_73: __f_73};
+  }
+  var __v_32 = Wasm.instantiateModuleFromAsm(__f_110.toString());
+  assertEquals(0, __v_32.__f_73());
+})();
+(function __f_33() {
+  function __f_61($__v_23,$__v_25,$__v_24){'use asm';
+    function __f_77() {
+      var __v_28 = 0.0;
+      var __v_23 = 0;
+      __v_28 = 5616315000.000001;
+      __v_23 = ~~__v_28 >>>0;
+      __v_0 = {};
+      return __v_23 | 0;
+    }
+    return { main : __f_77 };
+  }
+  var __v_40 = Wasm.instantiateModuleFromAsm(__f_61.toString());
+  assertEquals(1321347704, __v_2.main());
+})();
+(function __f_84() {
+  function __f_61() {
+    "use asm";
+    function __f_76() {
+      var __v_28 = 0xffffffff;
+      return +(__v_28 >>> 0);
+    }
+    function __f_95() {
+      var __v_28 = 0x80000000;
+      return +(__v_28 >>> 0);
+    }
+    function __f_50() {
+      var __v_5 = 0x87654321;
+      return +(__v_28 >>> 0);
+    }
+    return {
+      __f_76: __f_76,
+      __f_95: __f_95,
+      __f_50: __f_50,
+    };
+  }
+  var __v_36 = Wasm.instantiateModuleFromAsm(__f_61.toString());
+  assertEquals(0xffffffff, __v_36.__f_76());
+  assertEquals(0x80000000, __v_36.__f_95());
+  assertEquals(0x87654321, __v_30.__f_50());
+})();
+} catch(e) { print("Caught: " + e); }
+try {
+var __v_112 = debug.MakeMirror(123).handle();
+assertEquals("number", debug.LookupMirror(__v_112).type());
+debug.ToggleMirrorCache(false);
+var __v_114 = debug.MakeMirror(123).handle();
+gc();
+assertEquals(undefined, __v_114);
+assertThrows(function() { debug.LookupMirror(__v_114) });
+debug.ToggleMirrorCache(true);
+var __v_113 = debug.MakeMirror(123).handle();
+assertEquals("number", debug.LookupMirror(__v_113).type());
+} catch(e) { print("Caught: " + e); }
+try {
+var Debug = debug.Debug;
+var __v_25 = null;
+var __v_113 = true;
+} catch(e) { print("Caught: " + e); }
+function __f_112(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    assertTrue(exec_state.frame(0).sourceLineText().indexOf("BREAK") > 0);
+  } catch (e) {
+    __v_0 = e;
+  }
+}
+function __f_113() {
+  return 1;
+}
+try {
+Debug.setListener(__f_112);
+nop();
+__f_113();
+Debug.setListener(null);
+assertNull(__v_112);
+} catch(e) { print("Caught: " + e); }
diff --git a/deps/v8/test/mjsunit/regress/regress-618657.js b/deps/v8/test/mjsunit/regress/regress-618657.js
new file mode 100644
index 0000000000..170e235014
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-618657.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --ignition-filter=-foo
+
+function* foo() { yield 42 }
+function* goo() { yield 42 }
+var f = foo();
+var g = goo();
+assertEquals(42, f.next().value);
+assertEquals(42, g.next().value);
+assertEquals(true, f.next().done);
+assertEquals(true, g.next().done);
diff --git a/deps/v8/test/mjsunit/regress/regress-619382.js b/deps/v8/test/mjsunit/regress/regress-619382.js
new file mode 100644
index 0000000000..971318ac97
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-619382.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+//
+// // Flags: --expose-gc --always-opt
+
+(function __f_9() {
+})();
+function __f_16(ctor_desc) {
+  var __v_22 = 5;
+  var __v_25 = [];
+  gc(); gc(); gc();
+  for (var __v_18 = 0; __v_18 < __v_22; __v_18++) {
+    __v_25[__v_18] = ctor_desc.ctor.apply();
+  }
+}
+var __v_28 = [
+  {
+    ctor: function(__v_27) { return {a: __v_27}; },
+    args: function() { return [1.5 + __v_18]; }  },
+  {
+    ctor: function(__v_27) { var __v_21 = []; __v_21[1] = __v_27; __v_21[200000] = __v_27; return __v_21; },
+    args: function() { return [1.5 + __v_18]; }  },
+  {
+    ctor: function() {
+    }  }
+];
+var __v_26 = [
+  {
+  }];
+  __v_26.forEach(function(__v_16) {
+    __v_28.forEach(function(ctor) {
+      __f_16(ctor);
+    });
+  });
diff --git a/deps/v8/test/mjsunit/regress/regress-620553.js b/deps/v8/test/mjsunit/regress/regress-620553.js
new file mode 100644
index 0000000000..461b9bb189
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-620553.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var o0 = [];
+var o1 = [];
+var cnt = 0;
+o1.__defineGetter__(0, function() {
+  if (cnt++ > 2) return;
+  o0.shift();
+  gc();
+  o0.push(0);
+  o0.concat(o1);
+});
+o1[0];
diff --git a/deps/v8/test/mjsunit/regress/regress-620750.js b/deps/v8/test/mjsunit/regress/regress-620750.js
new file mode 100644
index 0000000000..ab8fbd98fc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-620750.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --es-staging
+
+function push_a_lot(arr) {
+  for (var i = 0; i < 2e4; i++) {
+    arr.push(i);
+  }
+  return arr;
+}
+
+__v_13 = push_a_lot([]);
diff --git a/deps/v8/test/mjsunit/regress/regress-621869.js b/deps/v8/test/mjsunit/regress/regress-621869.js
new file mode 100644
index 0000000000..db34064457
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-621869.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var o0 = [];
+var o1 = [];
+var cnt = 0;
+var only_scavenge = true;
+o1.__defineGetter__(0, function() {
+  if (cnt++ > 2) return;
+  o0.shift();
+  gc(only_scavenge);
+  o0.push((64));
+  o0.concat(o1);
+});
+o1[0];
diff --git a/deps/v8/test/mjsunit/regress/regress-622663.js b/deps/v8/test/mjsunit/regress/regress-622663.js
new file mode 100644
index 0000000000..9606bd86fa
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-622663.js
@@ -0,0 +1,14 @@
++// Copyright 2016 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --no-lazy
+
+(function() {
+  try { (y = [...[]]) => {} } catch(_) {}  // will core dump, if not fixed
+})();
+
+(function() {
+  try { ((y = [...[]]) => {})(); } catch(_) {}  // will core dump, if not fixed,
+                                                // even without --no-lazy
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-625121.js b/deps/v8/test/mjsunit/regress/regress-625121.js
new file mode 100644
index 0000000000..27ad0f5faf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-625121.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test(f) {
+  f(0);
+  f(NaN);
+  %OptimizeFunctionOnNextCall(f);
+  f(1.0);
+}
+
+test(x => Math.cosh(+x));
+test(x => Math.sinh(+x));
+test(x => Math.tanh(+x));
diff --git a/deps/v8/test/mjsunit/regress/regress-631050.js b/deps/v8/test/mjsunit/regress/regress-631050.js
new file mode 100644
index 0000000000..b31c6a2022
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-631050.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --gc-global --stress-runs=8
+
+function __f_3(x, expected) {
+  var __v_3 = [];
+  __v_3.length = x;
+  __f_3(true, 1);
+}
+
+try {
+  __f_3(2147483648, 2147483648);
+} catch (e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-632289.js b/deps/v8/test/mjsunit/regress/regress-632289.js
new file mode 100644
index 0000000000..65a22558de
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-632289.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --turbo-from-bytecode --always-opt --allow-natives-syntax
+
+try {
+} catch(e) {; }
+(function __f_12() {
+})();
+(function __f_6() {
+  function __f_3() {
+  }
+  function __f_4() {
+    try {
+    } catch (e) {
+    }
+  }
+ __f_4();
+  %OptimizeFunctionOnNextCall(__f_4);
+ __f_4();
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-633998.js b/deps/v8/test/mjsunit/regress/regress-633998.js
new file mode 100644
index 0000000000..ff34a0a44e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-633998.js
@@ -0,0 +1,44 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var err_str_1 = "apply was called on , which is a object and not a function";
+var err_str_2 =
+  "apply was called on Error, which is a object and not a function";
+
+var reached = false;
+var error = new Error();
+error.name = error;
+try {
+  Reflect.apply(error);
+  reached = true;
+} catch (e) {
+  assertTrue(e.stack.indexOf(err_str_1) != -1);
+} finally {
+  assertFalse(reached);
+}
+
+reached = false;
+error = new Error();
+error.msg = error;
+try {
+  Reflect.apply(error);
+  reached = true;
+} catch (e) {
+  assertTrue(e.stack.indexOf(err_str_2) != -1);
+} finally {
+  assertFalse(reached);
+}
+
+reached = false;
+error = new Error();
+error.name = error;
+error.msg = error;
+try {
+  Reflect.apply(error);
+  reached = true;
+} catch (e) {
+  assertTrue(e.stack.indexOf(err_str_1) != -1);
+} finally {
+  assertFalse(reached);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-635429.js b/deps/v8/test/mjsunit/regress/regress-635429.js
new file mode 100644
index 0000000000..7fbce0d3cf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-635429.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=150
+
+function foo() {
+ "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "a" + "boom"};
+
+try {
+  foo()
+} catch(e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-638134.js b/deps/v8/test/mjsunit/regress/regress-638134.js
new file mode 100644
index 0000000000..5391eed148
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-638134.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+  // Generates a forward branch that puts 200 in the constant pool.
+  var i = 0;
+  if (i) {
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+    i = 0; i = 0; i = 0; i = 0; i = 0; i = 0;
+  }
+  // Emit a 200 literal which also ends up in the constant pool.
+  var j = 0.2e3;
+}
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-639270.js b/deps/v8/test/mjsunit/regress/regress-639270.js
new file mode 100644
index 0000000000..0924650de7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-639270.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --es-staging --ignition-staging --turbo
+
+"use strict";
+
+var g = (async () => { return JSON.stringify() });
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/deps/v8/test/mjsunit/regress/regress-674753.js b/deps/v8/test/mjsunit/regress/regress-674753.js
index b3704ea96a..d8a504a695 100644
--- a/deps/v8/test/mjsunit/regress/regress-674753.js
+++ b/deps/v8/test/mjsunit/regress/regress-674753.js
@@ -25,62 +25,138 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
+var undetectable = %GetUndetectable();
+
 // Number
 assertTrue(typeof 0 == 'number');
 assertTrue(typeof 0 === 'number');
+assertFalse(typeof 0 != 'number');
+assertFalse(typeof 0 !== 'number');
 assertTrue(typeof 1.2 == 'number');
 assertTrue(typeof 1.2 === 'number');
+assertFalse(typeof 1.2 != 'number');
+assertFalse(typeof 1.2 !== 'number');
+assertTrue(typeof 'x' != 'number');
+assertTrue(typeof 'x' !== 'number');
 assertFalse(typeof 'x' == 'number');
 assertFalse(typeof 'x' === 'number');
+assertTrue(typeof Object() != 'number');
+assertTrue(typeof Object() !== 'number');
+assertFalse(typeof Object() == 'number');
+assertFalse(typeof Object() === 'number');
 
 // String
 assertTrue(typeof 'x' == 'string');
 assertTrue(typeof 'x' === 'string');
+assertFalse(typeof 'x' != 'string');
+assertFalse(typeof 'x' !== 'string');
 assertTrue(typeof ('x' + 'x') == 'string');
 assertTrue(typeof ('x' + 'x') === 'string');
+assertFalse(typeof ('x' + 'x') != 'string');
+assertFalse(typeof ('x' + 'x') !== 'string');
+assertTrue(typeof 1 != 'string');
+assertTrue(typeof 1 !== 'string');
 assertFalse(typeof 1 == 'string');
 assertFalse(typeof 1 === 'string');
+assertTrue(typeof Object() != 'string');
+assertTrue(typeof Object() !== 'string');
 assertFalse(typeof Object() == 'string');
 assertFalse(typeof Object() === 'string');
 
 // Boolean
 assertTrue(typeof true == 'boolean');
 assertTrue(typeof true === 'boolean');
+assertFalse(typeof true != 'boolean');
+assertFalse(typeof true !== 'boolean');
 assertTrue(typeof false == 'boolean');
 assertTrue(typeof false === 'boolean');
+assertFalse(typeof false != 'boolean');
+assertFalse(typeof false !== 'boolean');
+assertTrue(typeof 1 != 'boolean');
+assertTrue(typeof 1 !== 'boolean');
 assertFalse(typeof 1 == 'boolean');
 assertFalse(typeof 1 === 'boolean');
+assertTrue(typeof 'x' != 'boolean');
+assertTrue(typeof 'x' !== 'boolean');
+assertFalse(typeof 'x' == 'boolean');
+assertFalse(typeof 'x' === 'boolean');
+assertTrue(typeof Object() != 'boolean');
+assertTrue(typeof Object() !== 'boolean');
 assertFalse(typeof Object() == 'boolean');
 assertFalse(typeof Object() === 'boolean');
 
 // Undefined
 assertTrue(typeof void 0 == 'undefined');
 assertTrue(typeof void 0 === 'undefined');
+assertFalse(typeof void 0 != 'undefined');
+assertFalse(typeof void 0 !== 'undefined');
+assertTrue(typeof 1 != 'undefined');
+assertTrue(typeof 1 !== 'undefined');
 assertFalse(typeof 1 == 'undefined');
 assertFalse(typeof 1 === 'undefined');
+assertTrue(typeof null != 'undefined');
+assertTrue(typeof null !== 'undefined');
+assertFalse(typeof null == 'undefined');
+assertFalse(typeof null === 'undefined');
+assertTrue(typeof Object() != 'undefined');
+assertTrue(typeof Object() !== 'undefined');
 assertFalse(typeof Object() == 'undefined');
 assertFalse(typeof Object() === 'undefined');
+assertTrue(typeof undetectable == 'undefined');
+assertTrue(typeof undetectable === 'undefined');
+assertFalse(typeof undetectable != 'undefined');
+assertFalse(typeof undetectable !== 'undefined');
 
 // Function
 assertTrue(typeof Object == 'function');
 assertTrue(typeof Object === 'function');
+assertFalse(typeof Object != 'function');
+assertFalse(typeof Object !== 'function');
+assertTrue(typeof 1 != 'function');
+assertTrue(typeof 1 !== 'function');
 assertFalse(typeof 1 == 'function');
 assertFalse(typeof 1 === 'function');
+assertTrue(typeof Object() != 'function');
+assertTrue(typeof Object() !== 'function');
 assertFalse(typeof Object() == 'function');
 assertFalse(typeof Object() === 'function');
+assertTrue(typeof undetectable != 'function');
+assertTrue(typeof undetectable !== 'function');
+assertFalse(typeof undetectable == 'function');
+assertFalse(typeof undetectable === 'function');
 
 // Object
 assertTrue(typeof Object() == 'object');
 assertTrue(typeof Object() === 'object');
+assertFalse(typeof Object() != 'object');
+assertFalse(typeof Object() !== 'object');
 assertTrue(typeof new String('x') == 'object');
 assertTrue(typeof new String('x') === 'object');
+assertFalse(typeof new String('x') != 'object');
+assertFalse(typeof new String('x') !== 'object');
 assertTrue(typeof ['x'] == 'object');
 assertTrue(typeof ['x'] === 'object');
+assertFalse(typeof ['x'] != 'object');
+assertFalse(typeof ['x'] !== 'object');
 assertTrue(typeof null == 'object');
 assertTrue(typeof null === 'object');
+assertFalse(typeof null != 'object');
+assertFalse(typeof null !== 'object');
+assertTrue(typeof 1 != 'object');
+assertTrue(typeof 1 !== 'object');
 assertFalse(typeof 1 == 'object');
 assertFalse(typeof 1 === 'object');
+assertTrue(typeof 'x' != 'object');
+assertTrue(typeof 'x' !== 'object');
 assertFalse(typeof 'x' == 'object');  // bug #674753
 assertFalse(typeof 'x' === 'object');
+assertTrue(typeof Object != 'object');
+assertTrue(typeof Object !== 'object');
 assertFalse(typeof Object == 'object');
 assertFalse(typeof Object === 'object');
+assertTrue(typeof undetectable != 'object');
+assertTrue(typeof undetectable !== 'object');
+assertFalse(typeof undetectable == 'object');
+assertFalse(typeof undetectable === 'object');
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-119800.js b/deps/v8/test/mjsunit/regress/regress-crbug-119800.js
index 3946fbb71d..85f28a7bc8 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-119800.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-119800.js
@@ -5,9 +5,9 @@
 // Flags: --expose-debug-as debug
 
 function f() {
-  1;
-  2;
-  3;
+  print(1);
+  print(2);
+  print(3);
 }
 
 var Debug = debug.Debug;
@@ -34,4 +34,5 @@ Debug.setListener(null);
 Debug.debuggerFlags().breakPointsActive.setValue(true);
 
 assertNull(exception);
-assertEquals(breaks, ["1;", "2;", "3;", "}", "Debug.setListener(null);"]);
+assertEquals(breaks, ["print(1);", "print(2);", "print(3);", "}",
+                      "Debug.setListener(null);"]);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-320922.js b/deps/v8/test/mjsunit/regress/regress-crbug-320922.js
deleted file mode 100644
index f19962843a..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-320922.js
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-var string = "internalized dummy";
-var expected = "internalized dummy";
-string = "hello world";
-expected = "Hello " + "world";
-function Capitalize() {
-  %_OneByteSeqStringSetChar(0, 0x48, string);
-}
-Capitalize();
-assertEquals(expected, string);
-Capitalize();
-assertEquals(expected, string);
-
-var twobyte = "\u20ACello world";
-
-function TwoByteCapitalize() {
-  %_TwoByteSeqStringSetChar(0, 0x48, twobyte);
-}
-TwoByteCapitalize();
-assertEquals(expected, twobyte);
-TwoByteCapitalize();
-assertEquals(expected, twobyte);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-401915.js b/deps/v8/test/mjsunit/regress/regress-crbug-401915.js
index 67ea19158e..96dce04868 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-401915.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-401915.js
@@ -10,7 +10,7 @@ Debug.setBreakOnException();
 
 try {
   try {
-    %DebugPushPromise(new Promise(function() {}), function() {});
+    %DebugPushPromise(new Promise(function() {}));
   } catch (e) {
   }
   throw new Error();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-451770.js b/deps/v8/test/mjsunit/regress/regress-crbug-451770.js
index 770c8073cf..b4f088d00e 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-451770.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-451770.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy
-
 assertThrows(function f() {
   var t = { toString: function() { throw new Error(); } };
   var o = { [t]: 23 };
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-480807.js b/deps/v8/test/mjsunit/regress/regress-crbug-480807.js
index c273f20a78..a1448d6de6 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-480807.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-480807.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --use-osr --turbo-osr --noalways-opt
+// Flags: --allow-natives-syntax --use-osr --noalways-opt
 
 function foo() {
   var c = 0;
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-492526.js b/deps/v8/test/mjsunit/regress/regress-crbug-492526.js
deleted file mode 100644
index e8ea298f8b..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-492526.js
+++ /dev/null
@@ -1,7 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-assertThrows(function() { %FormatMessageString(-1, "", "", ""); });
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-495493.js b/deps/v8/test/mjsunit/regress/regress-crbug-495493.js
new file mode 100644
index 0000000000..3dba236c37
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-495493.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --nofold-constants --enable-slow-asserts --debug-code
+
+function foo(p) {
+  for (var i = 0; i < 100000; ++i) {
+    p = Math.min(-1, 0);
+  }
+}
+foo(0);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-498142.js b/deps/v8/test/mjsunit/regress/regress-crbug-498142.js
deleted file mode 100644
index fcec5d1bd7..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-498142.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --harmony-sharedarraybuffer
-
-var sab = new SharedArrayBuffer(16);
-assertThrows(function() { %ArrayBufferNeuter(sab); });
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-500497.js b/deps/v8/test/mjsunit/regress/regress-crbug-500497.js
index 9117440c2c..356e4e6942 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-500497.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-500497.js
@@ -4,6 +4,7 @@
 
 // New space must be at max capacity to trigger pretenuring decision.
 // Flags: --allow-natives-syntax --verify-heap --max-semi-space-size=1
+// Flags: --expose-gc
 
 var global = [];  // Used to keep some objects alive.
 
@@ -12,6 +13,8 @@ function Ctor() {
   return result;
 }
 
+gc();
+
 for (var i = 0; i < 120; i++) {
   // Make the "a" property long-lived, while everything else is short-lived.
   global.push(Ctor().a);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-515897.js b/deps/v8/test/mjsunit/regress/regress-crbug-515897.js
new file mode 100644
index 0000000000..45a812c781
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-515897.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r1 = new RegExp("\\\\/");
+assertTrue(r1.test("\\/"));
+var r2 = eval("/" + r1.source + "/");
+assertEquals("\\\\\\/", r1.source);
+assertEquals("\\\\\\/", r2.source);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-570651.js b/deps/v8/test/mjsunit/regress/regress-crbug-570651.js
deleted file mode 100644
index 9860b428b1..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-570651.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-Error.prepareStackTrace = (e,s) => s;
-var __v_3 = Error().stack[0].constructor;
-var __v_4 = {};
-function __f_3() {}
-var __v_5 = __v_3.call(null, __v_4, __f_3, {valueOf() { return 1611877293 }});
- __v_5.getColumnNumber();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-571517.js b/deps/v8/test/mjsunit/regress/regress-crbug-571517.js
index 03bf76cb5e..ca7d7f73ba 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-571517.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-571517.js
@@ -11,7 +11,10 @@ function f(a) {
 
 var rec = new Receiver();
 
-var proto = rec.__proto__.__proto__;
+// Formerly, this mutated rec.__proto__.__proto__, but
+// the global object prototype chain is now immutable;
+// not sure if this test now hits the original hazard case.
+var proto = rec.__proto__;
 
 // Initialize prototype chain dependent IC (nonexistent load).
 assertEquals(undefined, f(rec));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-582048.js b/deps/v8/test/mjsunit/regress/regress-crbug-582048.js
new file mode 100644
index 0000000000..6d98f488e3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-582048.js
@@ -0,0 +1,31 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var frame_count = exec_state.frameCount();
+    for (var i = 0; i < frame_count; i++) {
+      var frame = exec_state.frame(i);
+      var scope_count = frame.scopeCount();
+      for (var j = 0; j < scope_count; j++) {
+        var scope = frame.scope(j);
+        assertTrue(scope.scopeObject().property('').isUndefined());
+      }
+    }
+  } catch (e) {
+    print(e, e.stack);
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+(function(a = 1) { debugger; })();
+
+Debug.setListener(null);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-599067.js b/deps/v8/test/mjsunit/regress/regress-crbug-599067.js
index bc10aa44c2..de3c99af03 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-599067.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-599067.js
@@ -7,5 +7,5 @@ try {
   var p = new Proxy({}, o);
   Error.captureStackTrace(p);
 } catch(e) {
-  assertEquals("Cannot pass private property name to proxy trap", e.message);
+  assertEquals("invalid_argument", e.message);
 }
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-600257.js b/deps/v8/test/mjsunit/regress/regress-crbug-600257.js
new file mode 100644
index 0000000000..87bd2e39af
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-600257.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=100
+
+(function rec() {
+  try {
+    rec();
+  } catch (e) {
+    /{/;
+  }
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-600995.js b/deps/v8/test/mjsunit/regress/regress-crbug-600995.js
deleted file mode 100644
index c532608799..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-crbug-600995.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --noharmony-iterator-close
-
-// The {Set} function will produce a different type feedback vector layout
-// depending on whether Harmony iterator finalization is enabled or not.
-
-new Set();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-602184.js b/deps/v8/test/mjsunit/regress/regress-crbug-602184.js
new file mode 100644
index 0000000000..c7d793bb0e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-602184.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(test, a) {
+  var v;
+  if (test) {
+    v = v|0;
+  }
+  a[v] = 1;
+}
+var v = new String();
+f(false, v);
+f(false, v);
+
+v = new Int32Array(10);
+f(true, v);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-602595.js b/deps/v8/test/mjsunit/regress/regress-crbug-602595.js
new file mode 100644
index 0000000000..7f6d478e05
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-602595.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function f(a) { return [a] }
+
+assertEquals([23], f(23));
+assertEquals([42], f(42));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([65], f(65));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-603463.js b/deps/v8/test/mjsunit/regress/regress-crbug-603463.js
new file mode 100644
index 0000000000..20bfae65c5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-603463.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function load(a, i) {
+  return a[i];
+}
+
+function f() {
+  return load(new Proxy({}, {}), undefined);
+}
+
+f();
+f();
+load([11, 22, 33], 0);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-604299.js b/deps/v8/test/mjsunit/regress/regress-crbug-604299.js
new file mode 100644
index 0000000000..9908f2df4d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-604299.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype.__defineSetter__(0,function(value){});
+
+if (this.Intl) {
+  var o = new Intl.DateTimeFormat('en-US', {'timeZone': 'Asia/Katmandu'})
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-605060.js b/deps/v8/test/mjsunit/regress/regress-crbug-605060.js
new file mode 100644
index 0000000000..d2dc79a310
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-605060.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+Array.prototype.__defineGetter__('map', function(){});
+assertTrue(%HasFastProperties(Array.prototype));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-605581.js b/deps/v8/test/mjsunit/regress/regress-crbug-605581.js
new file mode 100644
index 0000000000..0f1daabead
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-605581.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    assertThrows(() => exec_state.frame(0).evaluate("bar.baz"), ReferenceError);
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+(function() {
+  debugger;    // bar is still in TDZ at this point.
+  let bar = 1;
+  (x => bar);  // force bar to be context-allocated.
+})();
+
+Debug.setListener(null);
+assertNull(exception);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-605862.js b/deps/v8/test/mjsunit/regress/regress-crbug-605862.js
new file mode 100644
index 0000000000..82a5d454ec
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-605862.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+/[]*1/u.exec("\u1234");
+/[^\u0000-\u{10ffff}]*1/u.exec("\u1234");
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-608279.js b/deps/v8/test/mjsunit/regress/regress-crbug-608279.js
new file mode 100644
index 0000000000..22c69f252d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-608279.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --always-opt --no-lazy
+
+function __f_38() {
+  try {
+    throw 0;
+  } catch (e) {
+    eval();
+    var __v_38 = { a: 'hest' };
+    __v_38.m = function () { return __v_38.a; };
+  }
+  return __v_38;
+}
+var __v_40 = __f_38();
+__v_40.m();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-609029.js b/deps/v8/test/mjsunit/regress/regress-crbug-609029.js
new file mode 100644
index 0000000000..bd77de28a9
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-609029.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt --function-context-specialization --gc-interval=14
+// Flags: --turbo-filter=match --verify-heap
+"xxx".match();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-609046.js b/deps/v8/test/mjsunit/regress/regress-crbug-609046.js
new file mode 100644
index 0000000000..10b63af3e3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-609046.js
@@ -0,0 +1,36 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+// Test that hidden scopes are correctly walked in the scope chain.
+
+var Debug = debug.Debug;
+var exception = null;
+var delegate = null;
+var done = false;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    assertEquals([ debug.ScopeType.Block,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global ],
+                 exec_state.frame(0).allScopes().map(s => s.scopeType()));
+    done = true;
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+for(let a = 0; a < 3; a++) {
+  debugger;
+  eval();  // Force context-allocation of everything.
+}
+
+Debug.setListener(null);
+assertNull(exception);
+assertTrue(done);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-610207.js b/deps/v8/test/mjsunit/regress/regress-crbug-610207.js
new file mode 100644
index 0000000000..4396a56a77
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-610207.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = function(exception, frames) {
+  return frames[0].getEvalOrigin();
+}
+
+try {
+  Realm.eval(0, "throw new Error('boom');");
+} catch(e) {
+  print(e.stack);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-612109.js b/deps/v8/test/mjsunit/regress/regress-crbug-612109.js
new file mode 100644
index 0000000000..202bd96c77
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-612109.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+s = "string for triggering osr in __f_0";
+for (var i = 0; i < 16; i++) s = s + s;
+decodeURI(encodeURI(s));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-612142.js b/deps/v8/test/mjsunit/regress/regress-crbug-612142.js
new file mode 100644
index 0000000000..de2dc8d04a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-612142.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = {[Symbol.toPrimitive]: function(e) { throw e }};
+try {
+  for (var i = 0; i < 10; i++) { }
+  for (var i = 0.5; i < 100000; ++i) { }
+  for (var i = 16 | 0 || 0 || this || 1; i;) { String.fromCharCode(thrower); }
+} catch (e) { }
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-613494.js b/deps/v8/test/mjsunit/regress/regress-crbug-613494.js
new file mode 100644
index 0000000000..6fcc1e94f4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-613494.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape --noanalyze-environment-liveness
+
+function f() {
+  var bound = 0;
+  function g() { return bound }
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-613570.js b/deps/v8/test/mjsunit/regress/regress-crbug-613570.js
new file mode 100644
index 0000000000..3cd9857761
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-613570.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("[\n\u26031,\n\u26032\n]",
+             JSON.stringify([1, 2], null, "\u2603"));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-613905.js b/deps/v8/test/mjsunit/regress/regress-crbug-613905.js
new file mode 100644
index 0000000000..8bb38c9b9d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-613905.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
+
+try {
+  (new CallSiteConstructor(3, 6)).toString();
+} catch (e) {
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-613919.js b/deps/v8/test/mjsunit/regress/regress-crbug-613919.js
new file mode 100644
index 0000000000..cbd3e43b96
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-613919.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function g(a) {
+  if (a) return arguments;
+  %DeoptimizeNow();
+  return 23;
+}
+function f() {
+  return g(false);
+}
+assertEquals(23, f());
+assertEquals(23, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(23, f());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-614292.js b/deps/v8/test/mjsunit/regress/regress-crbug-614292.js
new file mode 100644
index 0000000000..3a67c17f60
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-614292.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return [] | 0 && values[0] || false;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+try {
+  foo();
+} catch (e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-614644.js b/deps/v8/test/mjsunit/regress/regress-crbug-614644.js
new file mode 100644
index 0000000000..d219cd3b92
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-614644.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, x) {
+  a.shift(2, a.length = 2);
+  a[0] = x;
+}
+
+f([ ], 1.1);
+f([1], 1.1);
+%OptimizeFunctionOnNextCall(f);
+f([1], 1.1);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-614727.js b/deps/v8/test/mjsunit/regress/regress-crbug-614727.js
new file mode 100644
index 0000000000..0845afc5ac
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-614727.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function f(a, b, c) { return arguments }
+function g(...args) { return args }
+
+// On 64-bit machine this produces a 768K array which is sufficiently small to
+// not cause a stack overflow, but big enough to move the allocated arguments
+// object into large object space (kMaxRegularHeapObjectSize == 600K).
+var length = Math.pow(2, 15) * 3;
+var args = new Array(length);
+assertEquals(length, f.apply(null, args).length);
+assertEquals(length, g.apply(null, args).length);
+
+// On 32-bit machines this produces an equally sized array, however it might in
+// turn trigger a stack overflow on 64-bit machines, which we need to catch.
+var length = Math.pow(2, 16) * 3;
+var args = new Array(length);
+try { f.apply(null, args) } catch(e) {}
+try { g.apply(null, args) } catch(e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-615774.js b/deps/v8/test/mjsunit/regress/regress-crbug-615774.js
new file mode 100644
index 0000000000..ea5e67513e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-615774.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
+
+try {
+  (new CallSiteConstructor(CallSiteConstructor, 6)).toString();
+} catch (e) {
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-616709-1.js b/deps/v8/test/mjsunit/regress/regress-crbug-616709-1.js
new file mode 100644
index 0000000000..75abe3c2e1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-616709-1.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Make the Object prototype have dictionary properties.
+for (var i = 0; i < 2000; i++) {
+  Object.prototype['X'+i] = true;
+}
+
+function boom(a1) {
+  return a1[0];
+}
+
+var a = new Array(1);
+a[0] = 0.1;
+boom(a);
+boom(a);
+%OptimizeFunctionOnNextCall(boom);
+boom(a);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-616709-2.js b/deps/v8/test/mjsunit/regress/regress-crbug-616709-2.js
new file mode 100644
index 0000000000..27e5d2d9da
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-616709-2.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Make the Array prototype have dictionary properties.
+for (var i = 0; i < 2000; i++) {
+  Array.prototype['X'+i] = true;
+}
+
+function boom(a1) {
+  return a1[0];
+}
+
+var a = new Array(1);
+a[0] = 0.1;
+boom(a);
+boom(a);
+%OptimizeFunctionOnNextCall(boom);
+boom(a);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-617527.js b/deps/v8/test/mjsunit/regress/regress-crbug-617527.js
new file mode 100644
index 0000000000..cf4662871c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-617527.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+Object.defineProperty(Array.prototype, "1", { get: toLocaleString });
+assertThrows(_ => new RegExp(0, 0));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-617567.js b/deps/v8/test/mjsunit/regress/regress-crbug-617567.js
new file mode 100644
index 0000000000..f0c696e14b
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-617567.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=* --allow-natives-syntax
+
+var v1 = {};
+function g() {
+  v1 = [];
+  for (var i = 0; i < 1; i++) {
+    v1[i]();
+  }
+}
+
+var v2 = {};
+var v3 = {};
+function f() {
+  v3 = v2;
+  g();
+}
+
+assertThrows(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-618788.js b/deps/v8/test/mjsunit/regress/regress-crbug-618788.js
new file mode 100644
index 0000000000..a104d8d39e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-618788.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slice and splice both try to set the length property of their return
+// value. Add a bogus setter to allow that.
+Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
+
+(function testSlice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.slice() instanceof Int32Array);
+})();
+
+(function testSplice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.splice(1) instanceof Int32Array);
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-618845.js b/deps/v8/test/mjsunit/regress/regress-crbug-618845.js
new file mode 100644
index 0000000000..ea3baba0bb
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-618845.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+Object.defineProperty(Foo.prototype, "name",
+                      {get: function() { return "FooName"; }});
+
+function ic(f) {
+  return f.prototype.name;
+}
+
+assertEquals("FooName", ic(Foo));
+assertEquals("FooName", ic(Foo));  // Don't crash, don't time out.
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-620119.js b/deps/v8/test/mjsunit/regress/regress-crbug-620119.js
new file mode 100644
index 0000000000..cbe5a78713
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-620119.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-lazy
+
+assertEquals(0, ((x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) => { x(); return y })(42, {}));
+assertEquals(0, (function (x, {[(x = function() { y = 0 }, "foo")]: y = eval(1)}) { x(); return y })(42, {}));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-620253.js b/deps/v8/test/mjsunit/regress/regress-crbug-620253.js
new file mode 100644
index 0000000000..811a4e7715
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-620253.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --throws
+
+load("test/mjsunit/regress/regress-crbug-620253.js");
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-620650.js b/deps/v8/test/mjsunit/regress/regress-crbug-620650.js
new file mode 100644
index 0000000000..25a92cab20
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-620650.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  function f(src, dst, i) {
+    dst[i] = src[i];
+  }
+  var buf = new ArrayBuffer(16);
+  var view_int32 = new Int32Array(buf);
+  view_int32[1] = 0xFFF7FFFF;
+  var view_f64 = new Float64Array(buf);
+  var arr = [,0.1];
+  f(view_f64, arr, -1);
+  f(view_f64, arr, 0);
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-621361.js b/deps/v8/test/mjsunit/regress/regress-crbug-621361.js
new file mode 100644
index 0000000000..f9496ae87d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-621361.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+var steps = 0;
+var exception = null;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    assertEquals([ debug.ScopeType.Local,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global],
+                 execState.frame().allScopes().map(s => s.scopeType()));
+    var x_value = execState.frame().evaluate("x").value();
+    if (steps < 2) {
+      assertEquals(undefined, x_value);
+      execState.prepareStep(Debug.StepAction.StepIn);
+    } else {
+      assertEquals("l => l", x_value.toString());
+    }
+    steps++;
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+(function() {
+  debugger;
+  var x = l => l;
+})();
+
+Debug.setListener(null);
+assertNull(exception);
+assertEquals(3, steps);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-621611.js b/deps/v8/test/mjsunit/regress/regress-crbug-621611.js
new file mode 100644
index 0000000000..bf9a4605cd
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-621611.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(Math.E, Math.exp(1));
+assertEquals(Math.LN10, Math.log(10));
+assertEquals(Math.LN2, Math.log(2));
+assertEquals(Math.LOG10E, Math.log10(Math.E));
+assertEquals(Math.LOG2E, Math.log2(Math.E));
+assertEquals(Math.SQRT1_2, Math.sqrt(0.5));
+assertEquals(Math.SQRT2, Math.sqrt(2));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-621816.js b/deps/v8/test/mjsunit/regress/regress-crbug-621816.js
new file mode 100644
index 0000000000..ca7f5ac6df
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-621816.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo
+
+function f() {
+  var o = {};
+  o.a = 1;
+}
+function g() {
+  var o = { ['a']: function(){} };
+  f();
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-624747.js b/deps/v8/test/mjsunit/regress/regress-crbug-624747.js
new file mode 100644
index 0000000000..7927263f8e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-624747.js
@@ -0,0 +1,22 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --es-staging
+
+"use strict";
+
+function bar() {
+  try {
+    unref;
+  } catch (e) {
+    return (1 instanceof TypeError) && unref();  // Call in tail position!
+  }
+}
+
+function foo() {
+  return bar();  // Call in tail position!
+}
+
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-624919.js b/deps/v8/test/mjsunit/regress/regress-crbug-624919.js
new file mode 100644
index 0000000000..5a2b100daf
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-624919.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b, c, d, e) {
+  if (a && (b, c ? d() : e())) return 0;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-625547.js b/deps/v8/test/mjsunit/regress/regress-crbug-625547.js
new file mode 100644
index 0000000000..20eb85db5e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-625547.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var v1 = {};
+v1 = 0;
+var v2 = {};
+v2 = 0;
+gc();
+
+var minus_zero = {z:-0.0}.z;
+var nan = undefined + 1;
+function f() {
+  v1 = minus_zero;
+  v2 = nan;
+};
+%OptimizeFunctionOnNextCall(f);
+f();
+gc();  // Boom!
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-625590.js b/deps/v8/test/mjsunit/regress/regress-crbug-625590.js
new file mode 100644
index 0000000000..aa9ff8a5df
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-625590.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = {};
+function f() {}
+f.prototype = {
+  mSloppy() {
+    super[obj] = 15;
+  }
+};
+new f().mSloppy();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-626715.js b/deps/v8/test/mjsunit/regress/regress-crbug-626715.js
new file mode 100644
index 0000000000..e842fa61c7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-626715.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Create a prototype object which has a lot of fast properties.
+var body = "";
+for (var i = 0; i < 100; i++) {
+  body += `this.a${i} = 0;\n`;
+}
+var Proto = new Function(body);
+
+function A() {}
+A.prototype = new Proto();
+
+// Create a object and add properties that already exist in the prototype.
+// At some point the object will turn into a dictionary mode and one of
+// the fast details from the prototype will be reinterpreted as a details
+// for a new property ...
+var o = new A();
+for (var i = 0; i < 100; i++) {
+  o["a" + i] = i;
+}
+
+// ... which will break the enumeration order of the slow properties.
+var names = Object.getOwnPropertyNames(o);
+for (var i = 0; i < 100; i++) {
+  assertEquals("a" + i, names[i]);
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-627828.js b/deps/v8/test/mjsunit/regress/regress-crbug-627828.js
new file mode 100644
index 0000000000..75ff77cb64
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-627828.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function TestDeoptFromCopmputedNameInObjectLiteral() {
+  function f() {
+    var o = {
+      toString: function() {
+        %DeoptimizeFunction(f);
+        return "x";
+      }
+    };
+    return { [o]() { return 23 } };
+  }
+  assertEquals(23, f().x());
+  assertEquals(23, f().x());
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals(23, f().x());
+})();
+
+(function TestDeoptFromCopmputedNameInClassLiteral() {
+  function g() {
+    var o = {
+      toString: function() {
+        %DeoptimizeFunction(g);
+        return "y";
+      }
+    };
+    class C {
+      [o]() { return 42 };
+    }
+    return new C();
+  }
+  assertEquals(42, g().y());
+  assertEquals(42, g().y());
+  %OptimizeFunctionOnNextCall(g);
+  assertEquals(42, g().y());
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-627934.js b/deps/v8/test/mjsunit/regress/regress-crbug-627934.js
new file mode 100644
index 0000000000..242dc4a78e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-627934.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = "1".repeat(32 * 1024 * 1024);
+for (var z = x;;) {
+  try {
+    z += {toString: function() { return x; }};
+  } catch (e) {
+    break;
+  }
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-627935.js b/deps/v8/test/mjsunit/regress/regress-crbug-627935.js
new file mode 100644
index 0000000000..fdc4d2acde
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-627935.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if (this.Intl) {
+  assertThrows("Intl.DateTimeFormat('en-US', {timeZone: 0})", RangeError);
+  assertThrows("Intl.DateTimeFormat('en-US', {timeZone: true})", RangeError);
+  assertThrows("Intl.DateTimeFormat('en-US', {timeZone: null})", RangeError);
+
+  var object = { toString: function() { return "UTC" } };
+  assertDoesNotThrow("Intl.DateTimeFormat('en-US', {timeZone: object})");
+}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-628573.js b/deps/v8/test/mjsunit/regress/regress-crbug-628573.js
new file mode 100644
index 0000000000..5ba184d9ab
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-628573.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var z = {valueOf: function() { return 3; }};
+
+(function() {
+  try {
+    var tmp = { x: 12 };
+    with (tmp) {
+      z++;
+    }
+    throw new Error("boom");
+  } catch(e) {}
+})();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-629062.js b/deps/v8/test/mjsunit/regress/regress-crbug-629062.js
new file mode 100644
index 0000000000..228ae6d2d5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-629062.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return 1 + ((1 == 0) && undefined);
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(true);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-629435.js b/deps/v8/test/mjsunit/regress/regress-crbug-629435.js
new file mode 100644
index 0000000000..b73f601c71
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-629435.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(v) {
+  v.constructor;
+}
+
+bar([]);
+bar([]);
+
+function foo() {
+  var x = -0;
+  bar(x + 1);
+}
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-629823.js b/deps/v8/test/mjsunit/regress/regress-crbug-629823.js
new file mode 100644
index 0000000000..bbf74b80af
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-629823.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {}
+function bar() {
+  o[0] = +o[0];
+  o = /\u23a1|__v_4/;
+}
+bar();
+bar();
+bar();
+function foo() { bar(); }
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-629996.js b/deps/v8/test/mjsunit/regress/regress-crbug-629996.js
new file mode 100644
index 0000000000..025a86ee72
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-629996.js
@@ -0,0 +1,9 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// // Flags: --expose-debug-as debug
+
+var mirror = debug.MakeMirror(new Proxy({}, {}));
+// As long as we have no special mirror for proxies, we use an object mirror.
+assertEquals("object", mirror.type());
diff --git a/deps/v8/test/mjsunit/regress/regress-449070.js b/deps/v8/test/mjsunit/regress/regress-crbug-630559.js
index 7a0f0a838c..f9623ed879 100644
--- a/deps/v8/test/mjsunit/regress/regress-449070.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-630559.js
@@ -1,10 +1,7 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
+// Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
+
 // Flags: --allow-natives-syntax
 
-try {
-  %NormalizeElements(this);
-} catch(e) {
-}
+assertThrows("try{}%");
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-630561.js b/deps/v8/test/mjsunit/regress/regress-crbug-630561.js
new file mode 100644
index 0000000000..798f33d658
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-630561.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-interval=30
+
+var dict_elements = {};
+
+for (var i= 0; i< 100; i++) {
+  dict_elements[2147483648 + i] = i;
+}
+
+var keys = Object.keys(dict_elements);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-630923.js b/deps/v8/test/mjsunit/regress/regress-crbug-630923.js
new file mode 100644
index 0000000000..ff0d2dd05e
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-630923.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {};
+function bar(o) {
+  return 1 + (o.t ? 1 : 2);
+}
+function foo() {
+  bar(o);
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-630951.js b/deps/v8/test/mjsunit/regress/regress-crbug-630951.js
new file mode 100644
index 0000000000..58af024d3a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-630951.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  "use asm";
+  var o = new Int32Array(64 * 1024);
+  return () => { o[i1 >> 2] | 0; }
+}
+assertThrows(foo());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-630952.js b/deps/v8/test/mjsunit/regress/regress-crbug-630952.js
new file mode 100644
index 0000000000..42d30a3ec1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-630952.js
@@ -0,0 +1,25 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+try {
+function __f_4(sign_bit,
+                          mantissa_29_bits) {
+}
+__f_4.prototype.returnSpecial = function() {
+                     this.mantissa_29_bits * mantissa_29_shift;
+}
+__f_4.prototype.toSingle = function() {
+  if (-65535) return this.toSingleSubnormal();
+}
+__f_4.prototype.toSingleSubnormal = function() {
+  if (__v_15) {
+      var __v_7 = this.mantissa_29_bits == -1 &&
+                 (__v_13 & __v_10 ) == 0;
+    }
+  __v_8 >>= __v_7;
+}
+__v_14 = new __f_4();
+__v_14.toSingle();
+} catch(e) {}
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-1.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-1.js
new file mode 100644
index 0000000000..bd40dcd3a2
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-1.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x < x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-10.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-10.js
new file mode 100644
index 0000000000..1c4fccaac1
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-10.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x << x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-11.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-11.js
new file mode 100644
index 0000000000..a03a125ede
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-11.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x >> x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-12.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-12.js
new file mode 100644
index 0000000000..f710bd0149
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-12.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x >>> x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-13.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-13.js
new file mode 100644
index 0000000000..7a784481ee
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-13.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x & x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-14.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-14.js
new file mode 100644
index 0000000000..829bf900b6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-14.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x | x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-15.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-15.js
new file mode 100644
index 0000000000..1257d797ae
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-15.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x ^ x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-2.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-2.js
new file mode 100644
index 0000000000..ce46b27886
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-2.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x > x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-3.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-3.js
new file mode 100644
index 0000000000..4258b15508
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-3.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x >= x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-4.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-4.js
new file mode 100644
index 0000000000..7e8cdf8f56
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-4.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x <= x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-5.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-5.js
new file mode 100644
index 0000000000..acdedcba13
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-5.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x + x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-6.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-6.js
new file mode 100644
index 0000000000..d17772f17c
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-6.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x / x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-7.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-7.js
new file mode 100644
index 0000000000..7d03fa8551
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-7.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x * x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-8.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-8.js
new file mode 100644
index 0000000000..474110b53d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-8.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x % x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631318-9.js b/deps/v8/test/mjsunit/regress/regress-crbug-631318-9.js
new file mode 100644
index 0000000000..ad472e0722
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631318-9.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) { return x - x; }
+foo(1);
+foo(2);
+
+function bar(x) { foo(x); }
+%OptimizeFunctionOnNextCall(bar);
+
+assertThrows(() => bar(Symbol.toPrimitive));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-631917.js b/deps/v8/test/mjsunit/regress/regress-crbug-631917.js
new file mode 100644
index 0000000000..ca7a94c844
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-631917.js
@@ -0,0 +1,38 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var b = { toString: function() { return "b"; } };
+var c = { toString: function() { return "c"; } };
+
+(function() {
+  var expected_receiver;
+  var obj1 = {
+    a: 100,
+    b_: 200,
+    get b() { assertEquals(expected_receiver, this); return this.b_; },
+    set b(v) { assertEquals(expected_receiver, this); this.b_ = v; },
+    c_: 300,
+    get c() { assertEquals(expected_receiver, this); return this.c_; },
+    set c(v) { assertEquals(expected_receiver, this); this.c_ = v; },
+  };
+  var obj2 = {
+    boom() {
+      super.a++;
+      super[b]++;
+      super[c]++;
+    },
+  }
+  Object.setPrototypeOf(obj2, obj1);
+
+  expected_receiver = obj2;
+  obj2.boom();
+  assertEquals(101, obj2.a);
+  assertEquals(201, obj2[b]);
+  assertEquals(301, obj2[c]);
+
+  expected_receiver = obj1;
+  assertEquals(100, obj1.a);
+  assertEquals(200, obj1[b]);
+  assertEquals(300, obj1[c]);
+}());
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-632800.js b/deps/v8/test/mjsunit/regress/regress-crbug-632800.js
new file mode 100644
index 0000000000..6296572c17
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-632800.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --ignition-osr --turbo-from-bytecode
+
+function osr() {
+  for (var i = 0; i < 50000; ++i) Math.random();
+}
+osr();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-633585.js b/deps/v8/test/mjsunit/regress/regress-crbug-633585.js
new file mode 100644
index 0000000000..c483e47bbc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-633585.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --turbo --always-opt
+
+function f() { this.x = this.x.x; }
+gc();
+f.prototype.x = { x:1 }
+new f();
+new f();
+
+function g() {
+  function h() {};
+  h.prototype = { set x(value) { } };
+  new f();
+}
+g();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-633884.js b/deps/v8/test/mjsunit/regress/regress-crbug-633884.js
new file mode 100644
index 0000000000..6f46e96725
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-633884.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+  // Leave "blarg" as the hole in a new ScriptContext.
+  Realm.eval(Realm.current(), "throw Error(); let blarg");
+} catch (e) { }
+
+// Access "blarg" via a dynamic lookup. Should not crash!
+assertThrows(function() {
+  // Prevent full-codegen from optimizing away the %LoadLookupSlot call.
+  eval("var x = 5");
+  blarg;
+});
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-633999.js b/deps/v8/test/mjsunit/regress/regress-crbug-633999.js
new file mode 100644
index 0000000000..3f16908610
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-633999.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --noturbo
+
+var Debug = debug.Debug
+var exception = null;
+var step = 0;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Exception) return;
+  try {
+    step++;
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setBreakOnException();
+Debug.setListener(listener);
+
+(function () {
+  "use asm";
+  function f() {
+    try {
+      throw 666;
+    } catch (e) {
+    }
+  }
+  f();
+  f();
+  %OptimizeFunctionOnNextCall(f);
+  f();
+  assertOptimized(f);
+})();
+
+Debug.setListener(null);
+assertNull(exception);
+assertEquals(3, step);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-635798.js b/deps/v8/test/mjsunit/regress/regress-crbug-635798.js
new file mode 100644
index 0000000000..5456682ddc
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-635798.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  var x = [];
+  var y = [];
+  x.__proto__ = y;
+  for (var i = 0; i < 200000; ++i) {
+    y[i] = 1;
+  }
+}
+foo();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-638551.js b/deps/v8/test/mjsunit/regress/regress-crbug-638551.js
new file mode 100644
index 0000000000..baa8e9b051
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-638551.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --ignition-staging --no-lazy
+
+function f() {
+  for (var i = 0; i < 10; i++) if (i == 5) %OptimizeOsr();
+  function g() {}
+  %OptimizeFunctionOnNextCall(g);
+  g();
+}
+f();
+gc();  // Make sure that ...
+gc();  // ... code flushing ...
+gc();  // ... clears code ...
+gc();  // ... attached to {g}.
+f();
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-390925.js b/deps/v8/test/mjsunit/regress/regress-crbug-640369.js
index c4d98adb3e..97982d1224 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-390925.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-640369.js
@@ -4,7 +4,12 @@
 
 // Flags: --allow-natives-syntax
 
-var a = new Array();
-var b = new Array();
-Object.freeze(a);
-assertThrows(function() { %LiveEditCheckAndDropActivations(a, b, true); });
+function A() {
+  this.x = 0;
+  for (var i = 0; i < max; ) {}
+}
+function foo() {
+  for (var i = 0; i < 1; i = 2) %OptimizeOsr();
+  return new A();
+}
+try { foo(); } catch (e) { }
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-642056.js b/deps/v8/test/mjsunit/regress/regress-crbug-642056.js
new file mode 100644
index 0000000000..ca9fc78ef6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-642056.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+  return o.x instanceof Array;
+}
+
+var o = { x : 1.5 };
+o.x = 0;
+
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+f(o);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-644215.js b/deps/v8/test/mjsunit/regress/regress-crbug-644215.js
new file mode 100644
index 0000000000..c74112542d
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-644215.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var arr = [...[],,];
+assertTrue(%HasFastHoleyElements(arr));
+assertEquals(1, arr.length);
+assertFalse(arr.hasOwnProperty(0));
+assertEquals(undefined, arr[0]);
+// Should not crash.
+assertThrows(() => arr[0][0], TypeError);
diff --git a/deps/v8/test/mjsunit/regress/regress-double-canonicalization.js b/deps/v8/test/mjsunit/regress/regress-double-canonicalization.js
new file mode 100644
index 0000000000..2b345d2bb7
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-double-canonicalization.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var ab = new ArrayBuffer(8);
+var i_view = new Int32Array(ab);
+i_view[0] = %GetHoleNaNUpper()
+i_view[1] = %GetHoleNaNLower();
+var hole_nan = (new Float64Array(ab))[0];
+
+var array = [];
+
+function write() {
+  array[0] = hole_nan;
+}
+
+write();
+%OptimizeFunctionOnNextCall(write);
+write();
+array[1] = undefined;
+assertTrue(isNaN(array[0]));
+assertEquals("number", typeof array[0]);
diff --git a/deps/v8/test/mjsunit/regress/regress-object-assign-deprecated-2.js b/deps/v8/test/mjsunit/regress/regress-object-assign-deprecated-2.js
new file mode 100644
index 0000000000..89693de1a4
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-object-assign-deprecated-2.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {a:1, b:2};
+Object.defineProperty(x, "c", {set(v) {}})
+var y = {get c() { return {a:1, b:2.5} }};
+Object.assign(x, y, x);
diff --git a/deps/v8/test/mjsunit/regress/regress-object-assign-deprecated.js b/deps/v8/test/mjsunit/regress/regress-object-assign-deprecated.js
new file mode 100644
index 0000000000..d2e60f99e5
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-object-assign-deprecated.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = {a:1, b:2};
+var y = {a:1, b:2.5};
+Object.assign(x, x);
diff --git a/deps/v8/test/mjsunit/regress/regress-observe-map-cache.js b/deps/v8/test/mjsunit/regress/regress-observe-map-cache.js
deleted file mode 100644
index c71759c0cc..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-observe-map-cache.js
+++ /dev/null
@@ -1,15 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-object-observe
-// Flags: --allow-natives-syntax --enable-slow-asserts
-
-function f() {
-  var x = new Array(0);
-  x[-1] = -1;
-  Object.observe(x, function() { });
-}
-
-f();
-f();
diff --git a/deps/v8/test/mjsunit/regress/regress-put-prototype-transition.js b/deps/v8/test/mjsunit/regress/regress-put-prototype-transition.js
index 70f0074683..c5b4c5abc0 100644
--- a/deps/v8/test/mjsunit/regress/regress-put-prototype-transition.js
+++ b/deps/v8/test/mjsunit/regress/regress-put-prototype-transition.js
@@ -30,7 +30,7 @@ function __f_1(__v_4, add_first, __v_6, same_map_as) {
     __f_4(__v_1);
     assertFalse(%HasFastProperties(__v_1));
     __f_0(__v_1, __v_6);
-    assertTrue(%HasFastProperties(__v_1));
+    assertFalse(%HasFastProperties(__v_1));
   } else {
     __f_0(__v_1, __v_6);
     assertTrue(%HasFastProperties(__v_1));
diff --git a/deps/v8/test/mjsunit/regress/regress-recurse-patch-binary-op.js b/deps/v8/test/mjsunit/regress/regress-recurse-patch-binary-op.js
new file mode 100644
index 0000000000..842cc79fc8
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-recurse-patch-binary-op.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var i = 0
+function valueOf() {
+  while (true) return i++ < 4 ? 1 + this : 2
+}
+
+1 + ({valueOf})
diff --git a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js b/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
deleted file mode 100644
index 444fe4beb4..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-// stubbed version of ToNumber
-function ToNumber(x) {
-  return 311;
-}
-
-// Reduced version of String.fromCharCode;
-// does not actually do the same calculation but exhibits untagging bug.
-function StringFromCharCode(code) {
-  var n = arguments.length;
-  var one_byte = %NewString(n, true);
-  var i;
-  for (i = 0; i < n; i++) {
-    var code = arguments[i];
-    if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
-    if (code > 0xff) break;
-  }
-
-  var two_byte = %NewString(n - i, false);
-  for (var j = 0; i < n; i++, j++) {
-    var code = arguments[i];
-    %_TwoByteSeqStringSetChar(j, code, two_byte);
-  }
-  return one_byte + two_byte;
-}
-
-StringFromCharCode(0xFFF, 0xFFF);
-StringFromCharCode(0x7C, 0x7C);
-%OptimizeFunctionOnNextCall(StringFromCharCode);
-StringFromCharCode(0x7C, 0x7C);
-StringFromCharCode(0xFFF, 0xFFF);
diff --git a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js b/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
deleted file mode 100644
index 0a6b211648..0000000000
--- a/deps/v8/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-function test() {
-  var string = %NewString(10, true);
-  for (var i = 0; i < 10; i++) {
-    %_OneByteSeqStringSetChar(i, 65, string);
-    %_OneByteSeqStringSetChar(i, 66, string);
-  }
-  for (var i = 0; i < 10; i++) {
-    assertEquals("B", string[i]);
-  }
-}
-
-test();
-test();
-%OptimizeFunctionOnNextCall(test);
-test();
diff --git a/deps/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js b/deps/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
new file mode 100644
index 0000000000..a02a2778b6
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var thrower = { [Symbol.toPrimitive]: function() { FAIL } };
+
+function testTrace(func) {
+  try {
+    func(thrower);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue(e.stack.indexOf("fromCharCode") >= 0);
+  }
+}
+
+testTrace(String.fromCharCode);
+
+function foo(x) { return String.fromCharCode(x); }
+
+foo(1);
+foo(2);
+testTrace(foo);
+%OptimizeFunctionOnNextCall(foo);
+testTrace(foo);
diff --git a/deps/v8/test/mjsunit/regress/regress-typedarray-length.js b/deps/v8/test/mjsunit/regress/regress-typedarray-length.js
index a0b99980c7..0dde61fc27 100644
--- a/deps/v8/test/mjsunit/regress/regress-typedarray-length.js
+++ b/deps/v8/test/mjsunit/regress/regress-typedarray-length.js
@@ -108,13 +108,13 @@ assertEquals(undefined, get(a));
   assertEquals("blah", get(a));
 })();
 
-// Ensure we cannot delete length, byteOffset, byteLength.
+// Ensure we can delete length, byteOffset, byteLength.
 assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("length"));
 assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteOffset"));
 assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteLength"));
-assertFalse(delete Int32Array.prototype.__proto__.length);
-assertFalse(delete Int32Array.prototype.__proto__.byteOffset);
-assertFalse(delete Int32Array.prototype.__proto__.byteLength);
+assertTrue(delete Int32Array.prototype.__proto__.length);
+assertTrue(delete Int32Array.prototype.__proto__.byteOffset);
+assertTrue(delete Int32Array.prototype.__proto__.byteLength);
 
 a = new Int32Array(100);
 
@@ -122,28 +122,28 @@ get = function(a) {
   return a.length;
 }
 
-assertEquals(100, get(a));
-assertEquals(100, get(a));
-assertEquals(100, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
 %OptimizeFunctionOnNextCall(get);
-assertEquals(100, get(a));
+assertEquals(undefined, get(a));
 
 get = function(a) {
   return a.byteLength;
 }
 
-assertEquals(400, get(a));
-assertEquals(400, get(a));
-assertEquals(400, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
 %OptimizeFunctionOnNextCall(get);
-assertEquals(400, get(a));
+assertEquals(undefined, get(a));
 
 get = function(a) {
   return a.byteOffset;
 }
 
-assertEquals(0, get(a));
-assertEquals(0, get(a));
-assertEquals(0, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
 %OptimizeFunctionOnNextCall(get);
-assertEquals(0, get(a));
+assertEquals(undefined, get(a));
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-5254-1.js b/deps/v8/test/mjsunit/regress/regress-v8-5254-1.js
new file mode 100644
index 0000000000..624c85f477
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-5254-1.js
@@ -0,0 +1,27 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+  "use asm";
+  var a = new Uint16Array(2);
+  a[0] = 32815;
+  a[1] = 32114;
+
+  function foo() {
+    var x = a[0]|0;
+    var y = a[1]|0;
+    if (x < 0) x = 4294967296 + x|0;
+    if (y < 0) y = 4294967296 + y|0;
+    return x >= y;
+  }
+
+  return foo;
+})();
+
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-5254-2.js b/deps/v8/test/mjsunit/regress/regress-v8-5254-2.js
new file mode 100644
index 0000000000..f486fa8aa3
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-5254-2.js
@@ -0,0 +1,27 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+  "use asm";
+  var a = new Uint8Array(2);
+  a[0] = 128;
+  a[1] = 127;
+
+  function foo() {
+    var x = a[0]|0;
+    var y = a[1]|0;
+    if (x < 0) x = 4294967296 + x|0;
+    if (y < 0) y = 4294967296 + y|0;
+    return x >= y;
+  }
+
+  return foo;
+})();
+
+assertTrue(foo());
+assertTrue(foo());
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo());
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-5255-1.js b/deps/v8/test/mjsunit/regress/regress-v8-5255-1.js
new file mode 100644
index 0000000000..cd14d63792
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-5255-1.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return (x ? true : "7") >> 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-5255-2.js b/deps/v8/test/mjsunit/regress/regress-v8-5255-2.js
new file mode 100644
index 0000000000..5ae57ce64a
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-5255-2.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return (x ? true : "7") << 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));
diff --git a/deps/v8/test/mjsunit/regress/regress-v8-5255-3.js b/deps/v8/test/mjsunit/regress/regress-v8-5255-3.js
new file mode 100644
index 0000000000..004d6874ad
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-v8-5255-3.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return (x ? true : "7") >>> 0;
+}
+
+assertEquals(1, foo(1));
+assertEquals(1, foo(1));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(7, foo(0));
diff --git a/deps/v8/test/mjsunit/regress/regress-wasm-crbug-599413.js b/deps/v8/test/mjsunit/regress/regress-wasm-crbug-599413.js
new file mode 100644
index 0000000000..8f11ee0425
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-wasm-crbug-599413.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_100() {
+  "use asm";
+  function __f_76() {
+    var __v_39 = 0;
+    outer: while (1) {
+      while (__v_39 == 4294967295) {
+      }
+    }
+  }
+  return {__f_76: __f_76};
+}
+assertTrue(%IsNotAsmWasmCode(__f_100));
diff --git a/deps/v8/test/mjsunit/regress/regress-wasm-crbug-618602.js b/deps/v8/test/mjsunit/regress/regress-wasm-crbug-618602.js
new file mode 100644
index 0000000000..7aafe18475
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-wasm-crbug-618602.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --validate-asm --allow-natives-syntax
+
+function __f_1() {
+  'use asm';
+  function __f_3() {
+    var __v_11 = 1, __v_10 = 0, __v_12 = 0;
+    __v_12 = (__v_10 | 12) % 4294967295 | -1073741824;
+  }
+  return { __f_3: __f_3 };
+}
+assertTrue(%IsNotAsmWasmCode(__f_1));
diff --git a/deps/v8/test/mjsunit/regress/string-set-char-deopt.js b/deps/v8/test/mjsunit/regress/string-set-char-deopt.js
deleted file mode 100644
index 8956e287db..0000000000
--- a/deps/v8/test/mjsunit/regress/string-set-char-deopt.js
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-(function OneByteSeqStringSetCharDeoptOsr() {
-  function deopt() {
-    %DeoptimizeFunction(f);
-  }
-
-  function f(string, osr) {
-    var world = " world";
-    %_OneByteSeqStringSetChar(0, (deopt(), 0x48), string);
-
-    for (var i = 0; osr && i < 2; i++) %OptimizeOsr();
-
-    return string + world;
-  }
-
-  assertEquals("Hello " + "world", f("hello", false));
-  %OptimizeFunctionOnNextCall(f);
-  assertEquals("Hello " + "world", f("hello", true));
-})();
-
-
-(function OneByteSeqStringSetCharDeopt() {
-  function deopt() {
-    %DeoptimizeFunction(f);
-  }
-
-  function g(x) {
-  }
-
-  function f(string) {
-    g(%_OneByteSeqStringSetChar(0, (deopt(), 0x48), string));
-    return string;
-  }
-
-  assertEquals("Hell" + "o", f("hello"));
-  %OptimizeFunctionOnNextCall(f);
-  assertEquals("Hell" + "o", f("hello"));
-})();
-
-
-(function TwoByteSeqStringSetCharDeopt() {
-  function deopt() {
-    %DeoptimizeFunction(f);
-  }
-
-  function g(x) {
-  }
-
-  function f(string) {
-    g(%_TwoByteSeqStringSetChar(0, (deopt(), 0x48), string));
-    return string;
-  }
-
-  assertEquals("Hell" + "o", f("\u20ACello"));
-  %OptimizeFunctionOnNextCall(f);
-  assertEquals("Hell" + "o", f("\u20ACello"));
-})();