deps: upgrade to V8 4.9.385.27

Pick up the latest known good release from the V8 4.9 branch: 4.9.385.27.
V8 Commits: https://github.com/v8/v8/compare/4.9.385.18...4.9.385.27

PR-URL: https://github.com/nodejs/node/pull/5494
Reviewed-By: bnoordhuis - Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: targos - Michaël Zasso <mic.besace@gmail.com>

26 files changed, 226 insertions, 84 deletions

diff --git a/deps/v8/include/v8-version.h b/deps/v8/include/v8-version.h
index 5fc15a3061..28f15a4e74 100644
--- a/deps/v8/include/v8-version.h
+++ b/deps/v8/include/v8-version.h
@@ -11,7 +11,7 @@
 #define V8_MAJOR_VERSION 4
 #define V8_MINOR_VERSION 9
 #define V8_BUILD_NUMBER 385
-#define V8_PATCH_LEVEL 18
+#define V8_PATCH_LEVEL 27
 
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/deps/v8/include/v8.h b/deps/v8/include/v8.h
index 36df60a5f5..d9ad17cc54 100644
--- a/deps/v8/include/v8.h
+++ b/deps/v8/include/v8.h
@@ -1609,7 +1609,8 @@ class V8_EXPORT StackFrame {
   /**
    * Returns the name of the resource that contains the script for the
    * function for this StackFrame or sourceURL value if the script name
-   * is undefined and its source ends with //# sourceURL=... string.
+   * is undefined and its source ends with //# sourceURL=... string or
+   * deprecated //@ sourceURL=... string.
    */
   Local<String> GetScriptNameOrSourceURL() const;
 
diff --git a/deps/v8/src/builtins.cc b/deps/v8/src/builtins.cc
index 77df498a07..34b370fe66 100644
--- a/deps/v8/src/builtins.cc
+++ b/deps/v8/src/builtins.cc
@@ -1610,11 +1610,35 @@ BUILTIN(ObjectKeys) {
   ASSIGN_RETURN_FAILURE_ON_EXCEPTION(isolate, receiver,
                                      Execution::ToObject(isolate, object));
   Handle<FixedArray> keys;
-  ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
-      isolate, keys,
-      JSReceiver::GetKeys(receiver, JSReceiver::OWN_ONLY, ENUMERABLE_STRINGS,
-                          CONVERT_TO_STRING));
-  return *isolate->factory()->NewJSArrayWithElements(keys);
+
+  int enum_length = receiver->map()->EnumLength();
+  if (enum_length != kInvalidEnumCacheSentinel &&
+      JSObject::cast(*receiver)->elements() ==
+          isolate->heap()->empty_fixed_array()) {
+    DCHECK(receiver->IsJSObject());
+    DCHECK(!JSObject::cast(*receiver)->HasNamedInterceptor());
+    DCHECK(!JSObject::cast(*receiver)->IsAccessCheckNeeded());
+    DCHECK(!HeapObject::cast(receiver->map()->prototype())
+                ->map()
+                ->is_hidden_prototype());
+    DCHECK(JSObject::cast(*receiver)->HasFastProperties());
+    if (enum_length == 0) {
+      keys = isolate->factory()->empty_fixed_array();
+    } else {
+      Handle<FixedArray> cache(
+          receiver->map()->instance_descriptors()->GetEnumCache());
+      keys = isolate->factory()->NewFixedArray(enum_length);
+      for (int i = 0; i < enum_length; i++) {
+        keys->set(i, cache->get(i));
+      }
+    }
+  } else {
+    ASSIGN_RETURN_FAILURE_ON_EXCEPTION(
+        isolate, keys,
+        JSReceiver::GetKeys(receiver, JSReceiver::OWN_ONLY, ENUMERABLE_STRINGS,
+                            CONVERT_TO_STRING));
+  }
+  return *isolate->factory()->NewJSArrayWithElements(keys, FAST_ELEMENTS);
 }
 
 
diff --git a/deps/v8/src/compiler/ppc/code-generator-ppc.cc b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
index 6fe674e4f2..154cd644bd 100644
--- a/deps/v8/src/compiler/ppc/code-generator-ppc.cc
+++ b/deps/v8/src/compiler/ppc/code-generator-ppc.cc
@@ -1221,11 +1221,18 @@ void CodeGenerator::AssembleArchInstruction(Instruction* instr) {
 #if V8_TARGET_ARCH_PPC64
       if (check_conversion) {
         // Set 2nd output to zero if conversion fails.
-        CRBit crbit = static_cast<CRBit>(VXCVI % CRWIDTH);
-        __ mcrfs(cr7, VXCVI);  // extract FPSCR field containing VXCVI into cr7
-        __ li(i.OutputRegister(1), Operand(1));
-        __ isel(i.OutputRegister(1), r0, i.OutputRegister(1),
-                v8::internal::Assembler::encode_crbit(cr7, crbit));
+        CRegister cr = cr7;
+        int crbit = v8::internal::Assembler::encode_crbit(
+            cr, static_cast<CRBit>(VXCVI % CRWIDTH));
+        __ mcrfs(cr, VXCVI);  // extract FPSCR field containing VXCVI into cr7
+        if (CpuFeatures::IsSupported(ISELECT)) {
+          __ li(i.OutputRegister(1), Operand(1));
+          __ isel(i.OutputRegister(1), r0, i.OutputRegister(1), crbit);
+        } else {
+          __ li(i.OutputRegister(1), Operand::Zero());
+          __ bc(v8::internal::Assembler::kInstrSize * 2, BT, crbit);
+          __ li(i.OutputRegister(1), Operand(1));
+        }
       }
 #endif
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
@@ -1241,11 +1248,18 @@ void CodeGenerator::AssembleArchInstruction(Instruction* instr) {
                                       i.OutputRegister(0), kScratchDoubleReg);
       if (check_conversion) {
         // Set 2nd output to zero if conversion fails.
-        CRBit crbit = static_cast<CRBit>(VXCVI % CRWIDTH);
-        __ mcrfs(cr7, VXCVI);  // extract FPSCR field containing VXCVI into cr7
-        __ li(i.OutputRegister(1), Operand(1));
-        __ isel(i.OutputRegister(1), r0, i.OutputRegister(1),
-                v8::internal::Assembler::encode_crbit(cr7, crbit));
+        CRegister cr = cr7;
+        int crbit = v8::internal::Assembler::encode_crbit(
+            cr, static_cast<CRBit>(VXCVI % CRWIDTH));
+        __ mcrfs(cr, VXCVI);  // extract FPSCR field containing VXCVI into cr7
+        if (CpuFeatures::IsSupported(ISELECT)) {
+          __ li(i.OutputRegister(1), Operand(1));
+          __ isel(i.OutputRegister(1), r0, i.OutputRegister(1), crbit);
+        } else {
+          __ li(i.OutputRegister(1), Operand::Zero());
+          __ bc(v8::internal::Assembler::kInstrSize * 2, BT, crbit);
+          __ li(i.OutputRegister(1), Operand(1));
+        }
       }
       DCHECK_EQ(LeaveRC, i.OutputRCBit());
       break;
@@ -1440,8 +1454,8 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   PPCOperandConverter i(this, instr);
   Label done;
   ArchOpcode op = instr->arch_opcode();
-  bool check_unordered = (op == kPPC_CmpDouble);
   CRegister cr = cr0;
+  int reg_value = -1;
 
   // Materialize a full 32-bit 1 or 0 value. The result register is always the
   // last output of the instruction.
@@ -1449,44 +1463,44 @@ void CodeGenerator::AssembleArchBoolean(Instruction* instr,
   Register reg = i.OutputRegister(instr->OutputCount() - 1);
 
   Condition cond = FlagsConditionToCondition(condition, op);
-  switch (cond) {
-    case eq:
-    case lt:
+  if (op == kPPC_CmpDouble) {
+    // check for unordered if necessary
+    if (cond == le) {
+      reg_value = 0;
       __ li(reg, Operand::Zero());
-      __ li(kScratchReg, Operand(1));
-      __ isel(cond, reg, kScratchReg, reg, cr);
-      break;
-    case ne:
-    case ge:
+      __ bunordered(&done, cr);
+    } else if (cond == gt) {
+      reg_value = 1;
       __ li(reg, Operand(1));
-      __ isel(NegateCondition(cond), reg, r0, reg, cr);
-      break;
-    case gt:
-      if (check_unordered) {
-        __ li(reg, Operand(1));
+      __ bunordered(&done, cr);
+    }
+    // Unnecessary for eq/lt & ne/ge since only FU bit will be set.
+  }
+
+  if (CpuFeatures::IsSupported(ISELECT)) {
+    switch (cond) {
+      case eq:
+      case lt:
+      case gt:
+        if (reg_value != 1) __ li(reg, Operand(1));
         __ li(kScratchReg, Operand::Zero());
-        __ bunordered(&done, cr);
         __ isel(cond, reg, reg, kScratchReg, cr);
-      } else {
-        __ li(reg, Operand::Zero());
-        __ li(kScratchReg, Operand(1));
-        __ isel(cond, reg, kScratchReg, reg, cr);
-      }
-      break;
-    case le:
-      if (check_unordered) {
-        __ li(reg, Operand::Zero());
-        __ li(kScratchReg, Operand(1));
-        __ bunordered(&done, cr);
-        __ isel(NegateCondition(cond), reg, r0, kScratchReg, cr);
-      } else {
-        __ li(reg, Operand(1));
+        break;
+      case ne:
+      case ge:
+      case le:
+        if (reg_value != 1) __ li(reg, Operand(1));
+        // r0 implies logical zero in this form
         __ isel(NegateCondition(cond), reg, r0, reg, cr);
-      }
-      break;
+        break;
     default:
       UNREACHABLE();
       break;
+    }
+  } else {
+    if (reg_value != 0) __ li(reg, Operand::Zero());
+    __ b(NegateCondition(cond), &done, cr);
+    __ li(reg, Operand(1));
   }
   __ bind(&done);
 }
diff --git a/deps/v8/src/compiler/wasm-linkage.cc b/deps/v8/src/compiler/wasm-linkage.cc
index 7419a5c31f..92363dd430 100644
--- a/deps/v8/src/compiler/wasm-linkage.cc
+++ b/deps/v8/src/compiler/wasm-linkage.cc
@@ -122,8 +122,8 @@ LinkageLocation stackloc(int i) {
 // ===========================================================================
 #define GP_PARAM_REGISTERS r3, r4, r5, r6, r7, r8, r9, r10
 #define GP_RETURN_REGISTERS r3, r4
-#define FP_PARAM_REGISTERS d0, d1, d2, d3, d4, d5, d6, d7
-#define FP_RETURN_REGISTERS d0, d1
+#define FP_PARAM_REGISTERS d1, d2, d3, d4, d5, d6, d7, d8
+#define FP_RETURN_REGISTERS d1, d2
 
 #else
 // ===========================================================================
diff --git a/deps/v8/src/debug/debug.h b/deps/v8/src/debug/debug.h
index 4b098db49a..7dcc2b5e34 100644
--- a/deps/v8/src/debug/debug.h
+++ b/deps/v8/src/debug/debug.h
@@ -477,6 +477,7 @@ class Debug {
     return !!base::NoBarrier_Load(&thread_local_.current_debug_scope_);
   }
   void set_break_points_active(bool v) { break_points_active_ = v; }
+  bool break_points_active() const { return break_points_active_; }
 
   StackFrame::Id break_frame_id() { return thread_local_.break_frame_id_; }
   int break_id() { return thread_local_.break_id_; }
diff --git a/deps/v8/src/js/harmony-unicode-regexps.js b/deps/v8/src/js/harmony-unicode-regexps.js
index aa8fc76bd5..b24bbdf2c5 100644
--- a/deps/v8/src/js/harmony-unicode-regexps.js
+++ b/deps/v8/src/js/harmony-unicode-regexps.js
@@ -24,8 +24,10 @@ utils.Import(function(from) {
 // ES6 21.2.5.15.
 function RegExpGetUnicode() {
   if (!IS_REGEXP(this)) {
+    // TODO(littledan): Remove this RegExp compat workaround
     if (this === GlobalRegExpPrototype) {
       %IncrementUseCounter(kRegExpPrototypeUnicodeGetter);
+      return UNDEFINED;
     }
     throw MakeTypeError(kRegExpNonRegExp, "RegExp.prototype.unicode");
   }
diff --git a/deps/v8/src/js/messages.js b/deps/v8/src/js/messages.js
index 6b7306a7d3..feb14d3788 100644
--- a/deps/v8/src/js/messages.js
+++ b/deps/v8/src/js/messages.js
@@ -432,10 +432,11 @@ function ScriptLineEnd(n) {
  * If sourceURL comment is available returns sourceURL comment contents.
  * Otherwise, script name is returned. See
  * http://fbug.googlecode.com/svn/branches/firebug1.1/docs/ReleaseNotes_1.1.txt
- * and Source Map Revision 3 proposal for details on using //# sourceURL
- * comment to identify scripts that don't have name.
+ * and Source Map Revision 3 proposal for details on using //# sourceURL and
+ * deprecated //@ sourceURL comment to identify scripts that don't have name.
  *
- * @return {?string} script name if present, value for //# sourceURL comment.
+ * @return {?string} script name if present, value for //# sourceURL comment or
+ * deprecated //@ sourceURL comment otherwise.
  */
 function ScriptNameOrSourceURL() {
   if (this.source_url) return this.source_url;
diff --git a/deps/v8/src/js/regexp.js b/deps/v8/src/js/regexp.js
index a163952451..eeacd6eb9e 100644
--- a/deps/v8/src/js/regexp.js
+++ b/deps/v8/src/js/regexp.js
@@ -114,7 +114,10 @@ function RegExpCompileJS(pattern, flags) {
     pattern = REGEXP_SOURCE(pattern);
   }
 
-  return RegExpInitialize(this, pattern, flags);
+  RegExpInitialize(this, pattern, flags);
+
+  // Return undefined for compatibility with JSC.
+  // See http://crbug.com/585775 for web compat details.
 }
 
 
@@ -456,6 +459,10 @@ function RegExpMakeCaptureGetter(n) {
 // ES6 21.2.5.4.
 function RegExpGetGlobal() {
   if (!IS_REGEXP(this)) {
+    // TODO(littledan): Remove this RegExp compat workaround
+    if (this === GlobalRegExpPrototype) {
+      return UNDEFINED;
+    }
     throw MakeTypeError(kRegExpNonRegExp, "RegExp.prototype.global");
   }
   return !!REGEXP_GLOBAL(this);
@@ -467,6 +474,10 @@ function RegExpGetGlobal() {
 // ES6 21.2.5.5.
 function RegExpGetIgnoreCase() {
   if (!IS_REGEXP(this)) {
+    // TODO(littledan): Remove this RegExp compat workaround
+    if (this === GlobalRegExpPrototype) {
+      return UNDEFINED;
+    }
     throw MakeTypeError(kRegExpNonRegExp, "RegExp.prototype.ignoreCase");
   }
   return !!REGEXP_IGNORE_CASE(this);
@@ -478,6 +489,10 @@ function RegExpGetIgnoreCase() {
 // ES6 21.2.5.7.
 function RegExpGetMultiline() {
   if (!IS_REGEXP(this)) {
+    // TODO(littledan): Remove this RegExp compat workaround
+    if (this === GlobalRegExpPrototype) {
+      return UNDEFINED;
+    }
     throw MakeTypeError(kRegExpNonRegExp, "RegExp.prototype.multiline");
   }
   return !!REGEXP_MULTILINE(this);
@@ -489,6 +504,10 @@ function RegExpGetMultiline() {
 // ES6 21.2.5.10.
 function RegExpGetSource() {
   if (!IS_REGEXP(this)) {
+    // TODO(littledan): Remove this RegExp compat workaround
+    if (this === GlobalRegExpPrototype) {
+      return UNDEFINED;
+    }
     throw MakeTypeError(kRegExpNonRegExp, "RegExp.prototype.source");
   }
   return REGEXP_SOURCE(this);
diff --git a/deps/v8/src/objects.cc b/deps/v8/src/objects.cc
index ef846d6c42..d9d8213e24 100644
--- a/deps/v8/src/objects.cc
+++ b/deps/v8/src/objects.cc
@@ -8653,10 +8653,17 @@ static Maybe<bool> GetKeysFromJSObject(Isolate* isolate,
     // use the cache says yes, so we should not create a cache.
     Handle<JSFunction> arguments_function(
         JSFunction::cast(isolate->sloppy_arguments_map()->GetConstructor()));
+    bool has_hidden_prototype = false;
+    Object* prototype = object->map()->prototype();
+    if (prototype->IsJSObject()) {
+      has_hidden_prototype =
+          JSObject::cast(prototype)->map()->is_hidden_prototype();
+    }
     bool cache_enum_length =
         ((object->map()->GetConstructor() != *arguments_function) &&
          !object->IsJSValue() && !object->IsAccessCheckNeeded() &&
-         !object->HasNamedInterceptor() && !object->HasIndexedInterceptor());
+         !object->HasNamedInterceptor() && !object->HasIndexedInterceptor() &&
+         !has_hidden_prototype);
     // Compute the property keys and cache them if possible.
     Handle<FixedArray> enum_keys =
         JSObject::GetEnumPropertyKeys(object, cache_enum_length);
diff --git a/deps/v8/src/parsing/parser-base.h b/deps/v8/src/parsing/parser-base.h
index 2955b0b9d9..d9da445977 100644
--- a/deps/v8/src/parsing/parser-base.h
+++ b/deps/v8/src/parsing/parser-base.h
@@ -2151,7 +2151,8 @@ ParserBase<Traits>::ParseYieldExpression(ExpressionClassifier* classifier,
   // YieldExpression ::
   //   'yield' ([no line terminator] '*'? AssignmentExpression)?
   int pos = peek_position();
-  BindingPatternUnexpectedToken(classifier);
+  classifier->RecordPatternError(scanner()->peek_location(),
+                                 MessageTemplate::kInvalidDestructuringTarget);
   FormalParameterInitializerUnexpectedToken(classifier);
   Expect(Token::YIELD, CHECK_OK);
   ExpressionT generator_object =
@@ -3060,7 +3061,7 @@ ParserBase<Traits>::ParseArrowFunctionLiteral(
       // Multiple statement body
       Consume(Token::LBRACE);
       bool is_lazily_parsed =
-          (mode() == PARSE_LAZILY && scope_->AllowsLazyCompilation());
+          (mode() == PARSE_LAZILY && scope_->AllowsLazyParsing());
       if (is_lazily_parsed) {
         body = this->NewStatementList(0, zone());
         this->SkipLazyFunctionBody(&materialized_literal_count,
diff --git a/deps/v8/src/parsing/scanner.cc b/deps/v8/src/parsing/scanner.cc
index 19fab9355e..73175934b5 100644
--- a/deps/v8/src/parsing/scanner.cc
+++ b/deps/v8/src/parsing/scanner.cc
@@ -356,7 +356,7 @@ Token::Value Scanner::SkipSourceURLComment() {
 
 
 void Scanner::TryToParseSourceURLComment() {
-  // Magic comments are of the form: //[#]\s<name>=\s*<value>\s*.* and this
+  // Magic comments are of the form: //[#@]\s<name>=\s*<value>\s*.* and this
   // function will just return if it cannot parse a magic comment.
   if (c0_ < 0 || !unicode_cache_->IsWhiteSpace(c0_)) return;
   Advance();
@@ -574,7 +574,7 @@ void Scanner::Scan() {
         Advance();
         if (c0_ == '/') {
           Advance();
-          if (c0_ == '#') {
+          if (c0_ == '#' || c0_ == '@') {
             Advance();
             token = SkipSourceURLComment();
           } else {
diff --git a/deps/v8/src/runtime/runtime-debug.cc b/deps/v8/src/runtime/runtime-debug.cc
index d94c75fa0e..80791dea76 100644
--- a/deps/v8/src/runtime/runtime-debug.cc
+++ b/deps/v8/src/runtime/runtime-debug.cc
@@ -30,7 +30,9 @@ RUNTIME_FUNCTION(Runtime_DebugBreak) {
 RUNTIME_FUNCTION(Runtime_HandleDebuggerStatement) {
   SealHandleScope shs(isolate);
   DCHECK(args.length() == 0);
-  isolate->debug()->HandleDebugBreak();
+  if (isolate->debug()->break_points_active()) {
+    isolate->debug()->HandleDebugBreak();
+  }
   return isolate->heap()->undefined_value();
 }
 
diff --git a/deps/v8/test/cctest/test-api.cc b/deps/v8/test/cctest/test-api.cc
index ca3f446a41..b78d450fcb 100644
--- a/deps/v8/test/cctest/test-api.cc
+++ b/deps/v8/test/cctest/test-api.cc
@@ -17060,6 +17060,8 @@ TEST(SourceURLInStackTrace) {
   i::ScopedVector<char> code(1024);
   i::SNPrintF(code, source, "//# sourceURL=eval_url");
   CHECK(CompileRun(code.start())->IsUndefined());
+  i::SNPrintF(code, source, "//@ sourceURL=eval_url");
+  CHECK(CompileRun(code.start())->IsUndefined());
 }
 
 
@@ -17140,6 +17142,8 @@ TEST(InlineScriptWithSourceURLInStackTrace) {
   i::ScopedVector<char> code(1024);
   i::SNPrintF(code, source, "//# sourceURL=source_url");
   CHECK(CompileRunWithOrigin(code.start(), "url", 0, 1)->IsUndefined());
+  i::SNPrintF(code, source, "//@ sourceURL=source_url");
+  CHECK(CompileRunWithOrigin(code.start(), "url", 0, 1)->IsUndefined());
 }
 
 
@@ -17184,6 +17188,8 @@ TEST(DynamicWithSourceURLInStackTrace) {
   i::ScopedVector<char> code(1024);
   i::SNPrintF(code, source, "//# sourceURL=source_url");
   CHECK(CompileRunWithOrigin(code.start(), "url", 0, 0)->IsUndefined());
+  i::SNPrintF(code, source, "//@ sourceURL=source_url");
+  CHECK(CompileRunWithOrigin(code.start(), "url", 0, 0)->IsUndefined());
 }
 
 
diff --git a/deps/v8/test/cctest/test-debug.cc b/deps/v8/test/cctest/test-debug.cc
index e35227ab23..914bda1d4e 100644
--- a/deps/v8/test/cctest/test-debug.cc
+++ b/deps/v8/test/cctest/test-debug.cc
@@ -4405,6 +4405,23 @@ TEST(DisableBreak) {
   CheckDebuggerUnloaded(env->GetIsolate());
 }
 
+
+TEST(DisableDebuggerStatement) {
+  DebugLocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+
+  // Register a debug event listener which sets the break flag and counts.
+  v8::Debug::SetDebugEventListener(env->GetIsolate(), DebugEventCounter);
+  CompileRun("debugger;");
+  CHECK_EQ(1, break_point_hit_count);
+
+  // Check that we ignore debugger statement when breakpoints aren't active.
+  i::Isolate* isolate = reinterpret_cast<i::Isolate*>(env->GetIsolate());
+  isolate->debug()->set_break_points_active(false);
+  CompileRun("debugger;");
+  CHECK_EQ(1, break_point_hit_count);
+}
+
 static const char* kSimpleExtensionSource =
   "(function Foo() {"
   "  return 4;"
diff --git a/deps/v8/test/cctest/test-parsing.cc b/deps/v8/test/cctest/test-parsing.cc
index 7269e2d5b2..52493145dc 100644
--- a/deps/v8/test/cctest/test-parsing.cc
+++ b/deps/v8/test/cctest/test-parsing.cc
@@ -2308,6 +2308,7 @@ TEST(ErrorsYieldSloppy) {
 
 
 TEST(NoErrorsGenerator) {
+  // clang-format off
   const char* context_data[][2] = {
     { "function * gen() {", "}" },
     { "(function * gen() {", "})" },
@@ -2345,6 +2346,8 @@ TEST(NoErrorsGenerator) {
     // Yield is still a valid key in object literals.
     "({ yield: 1 })",
     "({ get yield() { } })",
+    // And in assignment pattern computed properties
+    "({ [yield]: x } = { })",
     // Yield without RHS.
     "yield;",
     "yield",
@@ -2362,12 +2365,17 @@ TEST(NoErrorsGenerator) {
     "yield\nfor (;;) {}",
     NULL
   };
+  // clang-format on
 
-  RunParserSyncTest(context_data, statement_data, kSuccess);
+  static const ParserFlag always_flags[] = {
+      kAllowHarmonyDestructuringAssignment};
+  RunParserSyncTest(context_data, statement_data, kSuccess, nullptr, 0,
+                    always_flags, arraysize(always_flags));
 }
 
 
 TEST(ErrorsYieldGenerator) {
+  // clang-format off
   const char* context_data[][2] = {
     { "function * gen() {", "}" },
     { "\"use strict\"; function * gen() {", "}" },
@@ -2408,8 +2416,19 @@ TEST(ErrorsYieldGenerator) {
     "yield\n{yield: 42}",
     "yield /* comment */\n {yield: 42}",
     "yield //comment\n {yield: 42}",
+    // Destructuring binding and assignment are both disallowed
+    "var [yield] = [42];",
+    "var {foo: yield} = {a: 42};",
+    "[yield] = [42];",
+    "({a: yield} = {a: 42});",
+    // Also disallow full yield expressions on LHS
+    "var [yield 24] = [42];",
+    "var {foo: yield 24} = {a: 42};",
+    "[yield 24] = [42];",
+    "({a: yield 24} = {a: 42});",
     NULL
   };
+  // clang-format on
 
   RunParserSyncTest(context_data, statement_data, kError);
 }
diff --git a/deps/v8/test/mjsunit/es6/regexp-flags.js b/deps/v8/test/mjsunit/es6/regexp-flags.js
index 2f1222197d..79b0197e91 100644
--- a/deps/v8/test/mjsunit/es6/regexp-flags.js
+++ b/deps/v8/test/mjsunit/es6/regexp-flags.js
@@ -50,11 +50,9 @@ assertEquals(4, get_count);
 
 
 function testName(name) {
-  if (name === "sticky") {
-    assertEquals(undefined, RegExp.prototype[name]);
-  } else {
-    assertThrows(() => RegExp.prototype[name], TypeError);
-  }
+  // TODO(littledan): For web compatibility, we don't throw an exception,
+  // but ES2015 expects an exception to be thrown from this getter.
+  assertEquals(undefined, RegExp.prototype[name]);
   assertEquals(
       "get " + name,
       Object.getOwnPropertyDescriptor(RegExp.prototype, name).get.name);
diff --git a/deps/v8/test/mjsunit/regress/regress-585775.js b/deps/v8/test/mjsunit/regress/regress-585775.js
new file mode 100644
index 0000000000..8e4346c137
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-585775.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var pattern = /foo/;
+assertEquals(undefined, pattern.compile(pattern));
diff --git a/deps/v8/test/mjsunit/regress/regress-conditional-position.js b/deps/v8/test/mjsunit/regress/regress-conditional-position.js
index 7f9d3034ff..ae5a3acb58 100644
--- a/deps/v8/test/mjsunit/regress/regress-conditional-position.js
+++ b/deps/v8/test/mjsunit/regress/regress-conditional-position.js
@@ -86,9 +86,9 @@ test(test1, 58);
 test(test2, 65);
 test(test3, 72);
 
-eval(test1.toString() + "//# sourceUrl=foo");
-eval(test2.toString() + "//# sourceUrl=foo");
-eval(test3.toString() + "//# sourceUrl=foo");
+eval(test1.toString() + "//@ sourceUrl=foo");
+eval(test2.toString() + "//@ sourceUrl=foo");
+eval(test3.toString() + "//@ sourceUrl=foo");
 
 test(test1, 2);
 test(test2, 3);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
index 0a4153f04e..20285f614d 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-109362.js
@@ -15,20 +15,20 @@ function test(expectation, f) {
 
 /*
 (function() {
-1 + reference_error //# sourceURL=evaltest
+1 + reference_error //@ sourceURL=evaltest
 })
 */
 test("2:5", new Function(
-    '1 + reference_error //# sourceURL=evaltest'));
+    '1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x
 /\**\/) {
 
- 1 + reference_error //# sourceURL=evaltest
+ 1 + reference_error //@ sourceURL=evaltest
 })
 */
 test("4:6", new Function(
-    'x', '\n 1 + reference_error //# sourceURL=evaltest'));
+    'x', '\n 1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x
 
@@ -36,24 +36,24 @@ test("4:6", new Function(
 ,y
 /\**\/) {
 
- 1 + reference_error //# sourceURL=evaltest
+ 1 + reference_error //@ sourceURL=evaltest
 })
 */
 test("7:6", new Function(
-    'x\n\n', "z//\n", "y", '\n 1 + reference_error //# sourceURL=evaltest'));
+    'x\n\n', "z//\n", "y", '\n 1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function(x/\*,z//
 ,y*\/
 /\**\/) {
-1 + reference_error //# sourceURL=evaltest
+1 + reference_error //@ sourceURL=evaltest
 })
 */
 test("4:5", new Function(
-    'x/*', "z//\n", "y*/", '1 + reference_error //# sourceURL=evaltest'));
+    'x/*', "z//\n", "y*/", '1 + reference_error //@ sourceURL=evaltest'));
 /*
 (function () {
- 1 + reference_error //# sourceURL=evaltest5
+ 1 + reference_error //@ sourceURL=evaltest5
 })
 */
 test("2:6", eval(
-    '(function () {\n 1 + reference_error //# sourceURL=evaltest\n})'));
+    '(function () {\n 1 + reference_error //@ sourceURL=evaltest\n})'));
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-481896.js b/deps/v8/test/mjsunit/regress/regress-crbug-481896.js
index 1ef0e5010a..0d5c650f1e 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-481896.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-481896.js
@@ -29,7 +29,7 @@ function install() {
   eval("this.dynamic = function dynamic() { \n" +
        "  print(\"> dynamic\");  // Break\n" +
        "}\n" +
-       "//# sourceURL=dynamicScript");
+       "//@ sourceURL=dynamicScript");
 }
 
 install();
@@ -53,4 +53,4 @@ Debug.setListener(null);
 assertNull(exception);
 assertEquals(2, break_count);
 
-//# sourceURL=staticScript
+//@ sourceURL=staticScript
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-517592.js b/deps/v8/test/mjsunit/regress/regress-crbug-517592.js
index 5d61db95dc..760d892439 100644
--- a/deps/v8/test/mjsunit/regress/regress-crbug-517592.js
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-517592.js
@@ -8,7 +8,7 @@ var source =
   "var foo = function foo() {\n" +
   "  return 1;\n" +
   "}\n" +
-  "//# sourceURL=test";
+  "//@ sourceURL=test";
 
 Debug = debug.Debug;
 Debug.setListener(listener);
diff --git a/deps/v8/test/mjsunit/regress/regress-crbug-580934.js b/deps/v8/test/mjsunit/regress/regress-crbug-580934.js
new file mode 100644
index 0000000000..02cbfca796
--- /dev/null
+++ b/deps/v8/test/mjsunit/regress/regress-crbug-580934.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --min-preparse-length=0
+
+"use strict";
+{
+  let one = () => {
+    return "example.com";
+  };
+
+  let two = () => {
+    return one();
+  };
+
+  assertEquals("example.com", two());
+}
diff --git a/deps/v8/test/mjsunit/stack-traces.js b/deps/v8/test/mjsunit/stack-traces.js
index 1123c0bc1d..41de146346 100644
--- a/deps/v8/test/mjsunit/stack-traces.js
+++ b/deps/v8/test/mjsunit/stack-traces.js
@@ -69,7 +69,7 @@ function testEvalWithSourceURL() {
 
 function testNestedEvalWithSourceURL() {
   var x = "FAIL";
-  var innerEval = 'function Inner() { eval(x); }\n//# sourceURL=res://inner-eval';
+  var innerEval = 'function Inner() { eval(x); }\n//@ sourceURL=res://inner-eval';
   eval("function Outer() { eval(innerEval); Inner(); }; Outer();\n//# sourceURL=res://outer-eval");
 }
 
diff --git a/deps/v8/test/test262/test262.status b/deps/v8/test/test262/test262.status
index 3444f37557..a7f76a4e27 100644
--- a/deps/v8/test/test262/test262.status
+++ b/deps/v8/test/test262/test262.status
@@ -412,6 +412,12 @@
   # https://bugs.chromium.org/p/v8/issues/detail?id=4639
   'built-ins/ArrayBuffer/allocation-limit': [SKIP],
 
+  # https://code.google.com/p/chromium/issues/detail?id=581577
+  'built-ins/RegExp/prototype/source/15.10.7.1-1': [FAIL],
+  'built-ins/RegExp/prototype/global/15.10.7.2-1': [FAIL],
+  'built-ins/RegExp/prototype/ignoreCase/15.10.7.3-1': [FAIL],
+  'built-ins/RegExp/prototype/multiline/15.10.7.4-1': [FAIL],
+
   ######################## NEEDS INVESTIGATION ###########################
 
   # These test failures are specific to the intl402 suite and need investigation
diff --git a/deps/v8/test/webkit/fast/regex/toString-expected.txt b/deps/v8/test/webkit/fast/regex/toString-expected.txt
index ea1fbc3ee6..154411242e 100644
--- a/deps/v8/test/webkit/fast/regex/toString-expected.txt
+++ b/deps/v8/test/webkit/fast/regex/toString-expected.txt
@@ -28,7 +28,7 @@ On success, you will see a series of "PASS" messages, followed by "TEST COMPLETE
 
 PASS RegExp('/').source is "\\/"
 PASS RegExp('').source is "(?:)"
-FAIL RegExp.prototype.source should be (?:). Threw exception TypeError: RegExp.prototype.source getter called on non-RegExp object
+FAIL RegExp.prototype.source should be (?:) (of type string). Was undefined (of type undefined).
 PASS RegExp('/').toString() is "/\\//"
 PASS RegExp('').toString() is "/(?:)/"
 PASS RegExp.prototype.toString() is "/(?:)/"