Merge V8 5.3.332.45.  DO NOT MERGE

Test: Manual

FPIIM-449

Change-Id: Id3254828b068abdea3cb10442e0172a8c9a98e03
(cherry picked from commit 13e2dadd00298019ed862f2b2fc5068bba730bcf)
diff --git a/test/mjsunit/array-sort.js b/test/mjsunit/array-sort.js
index ae9f6ef..fdd2333 100644
--- a/test/mjsunit/array-sort.js
+++ b/test/mjsunit/array-sort.js
@@ -479,3 +479,68 @@
   }
 }
 TestSortOnProxy();
+
+
+// Test special prototypes
+(function testSortSpecialPrototypes() {
+  function test(proto, length, expected) {
+    var result = {
+       length: length,
+       __proto__: proto,
+     };
+    Array.prototype.sort.call(result);
+    assertEquals(expected.length, result.length, "result.length");
+    for (var i = 0; i<expected.length; i++) {
+      assertEquals(expected[i], result[i], "result["+i+"]");
+    }
+  }
+
+  (function fast() {
+    // Fast elements, non-empty
+    test(arguments, 0, []);
+    test(arguments, 1, [2]);
+    test(arguments, 2, [1, 2]);
+    test(arguments, 4, [1, 2, 3, 4]);
+    delete arguments[0]
+    // sort copies down the properties to the receiver, hence result[1]
+    // is read on the arguments through the hole on the receiver.
+    test(arguments, 2, [1, 1]);
+    arguments[0] = undefined;
+    test(arguments, 2, [1, undefined]);
+  })(2, 1, 4, 3);
+
+  (function fastSloppy(a) {
+    // Fast sloppy
+    test(arguments, 0, []);
+    test(arguments, 1, [2]);
+    test(arguments, 2, [1, 2]);
+    delete arguments[0]
+    test(arguments, 2, [1, 1]);
+    arguments[0] = undefined;
+    test(arguments, 2, [1, undefined]);
+  })(2, 1);
+
+  (function fastEmpty() {
+    test(arguments, 0, []);
+    test(arguments, 1, [undefined]);
+    test(arguments, 2, [undefined, undefined]);
+  })();
+
+  (function stringWrapper() {
+    // cannot redefine string wrapper properties
+    assertThrows(() => test(new String('cba'), 3, []), TypeError);
+  })();
+
+  (function typedArrys() {
+    test(new Int32Array(0), 0, []);
+    test(new Int32Array(1), 1, [0]);
+    var array = new Int32Array(3);
+    array[0] = 2;
+    array[1] = 1;
+    array[2] = 3;
+    test(array, 1, [2]);
+    test(array, 2, [1, 2]);
+    test(array, 3, [1, 2, 3]);
+  })()
+
+})();
diff --git a/test/mjsunit/asm/construct-double.js b/test/mjsunit/asm/construct-double.js
deleted file mode 100644
index 8bb5000..0000000
--- a/test/mjsunit/asm/construct-double.js
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax
-
-var stdlib = this;
-var foreign = {};
-var heap = new ArrayBuffer(64 * 1024);
-
-
-var m = (function(stdlib, foreign, heap) {
-  "use asm";
-  function cd1(i, j) {
-    i = i|0;
-    j = j|0;
-    return +%_ConstructDouble(i, j);
-  }
-  function cd2(i) {
-    i = i|0;
-    return +%_ConstructDouble(0, i);
-  }
-  return { cd1: cd1, cd2: cd2 };
-})(stdlib, foreign, heap);
-
-assertEquals(0.0, m.cd1(0, 0));
-assertEquals(%ConstructDouble(0, 1), m.cd2(1));
-for (var i = -2147483648; i < 2147483648; i += 3999773) {
-  assertEquals(%ConstructDouble(0, i), m.cd2(i));
-  for (var j = -2147483648; j < 2147483648; j += 3999773) {
-    assertEquals(%ConstructDouble(i, j), m.cd1(i, j));
-  }
-}
diff --git a/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js b/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
new file mode 100644
index 0000000..02bd8d9
--- /dev/null
+++ b/test/mjsunit/compiler/dont-constant-fold-deopting-checks.js
@@ -0,0 +1,10 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function bar(a) { a[0](true); }
+function foo(a) { return bar(1); }
+%OptimizeFunctionOnNextCall(foo);
+assertThrows(function() {bar([foo])}, TypeError);
diff --git a/test/mjsunit/compiler/inline-dead-jscreate.js b/test/mjsunit/compiler/inline-dead-jscreate.js
new file mode 100644
index 0000000..a977875
--- /dev/null
+++ b/test/mjsunit/compiler/inline-dead-jscreate.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var bar = 0;
+
+function baz() { return this; }
+
+function foo() {
+  bar += 1;
+  if (bar === 2) throw new baz();
+}
+
+foo();
diff --git a/test/mjsunit/compiler/optimized-instanceof-1.js b/test/mjsunit/compiler/optimized-instanceof-1.js
index 538b0ef..242b4be 100644
--- a/test/mjsunit/compiler/optimized-instanceof-1.js
+++ b/test/mjsunit/compiler/optimized-instanceof-1.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-instanceof
+// Flags: --allow-natives-syntax
 
 function F() {}
 var f = new F
diff --git a/test/mjsunit/compiler/optimized-instanceof-2.js b/test/mjsunit/compiler/optimized-instanceof-2.js
index 80bbdcd..38a35b7 100644
--- a/test/mjsunit/compiler/optimized-instanceof-2.js
+++ b/test/mjsunit/compiler/optimized-instanceof-2.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-instanceof
+// Flags: --allow-natives-syntax
 
 function F() {}
 var f = new F
diff --git a/test/mjsunit/compiler/regress-5074.js b/test/mjsunit/compiler/regress-5074.js
new file mode 100644
index 0000000..903b54a
--- /dev/null
+++ b/test/mjsunit/compiler/regress-5074.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var s = [,0.1];
+
+function foo(a, b) {
+  var x = s[a];
+  s[1] = 0.1;
+  return x + b;
+}
+
+assertEquals(2.1, foo(1, 2));
+assertEquals(2.1, foo(1, 2));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("undefined2", foo(0, "2"));
diff --git a/test/mjsunit/compiler/regress-5100.js b/test/mjsunit/compiler/regress-5100.js
new file mode 100644
index 0000000..694cd8a
--- /dev/null
+++ b/test/mjsunit/compiler/regress-5100.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, 1];
+a["true"] = "true";
+a["false"] = "false";
+a["null"] = "null";
+a["undefined"] = "undefined";
+
+// Ensure we don't accidentially truncate true when used to index arrays.
+(function() {
+  function f(x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("true", f(true));
+})();
+
+// Ensure we don't accidentially truncate false when used to index arrays.
+(function() {
+  function f( x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("false", f(false));
+})();
+
+// Ensure we don't accidentially truncate null when used to index arrays.
+(function() {
+  function f( x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("null", f(null));
+})();
+
+// Ensure we don't accidentially truncate undefined when used to index arrays.
+(function() {
+  function f( x) { return a[x]; }
+
+  assertEquals(0, f(0));
+  assertEquals(0, f(0));
+  %OptimizeFunctionOnNextCall(f);
+  assertEquals("undefined", f(undefined));
+})();
diff --git a/test/mjsunit/compiler/regress-5129.js b/test/mjsunit/compiler/regress-5129.js
new file mode 100644
index 0000000..1d100ab
--- /dev/null
+++ b/test/mjsunit/compiler/regress-5129.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo($a,$b) {
+ $a = $a|0;
+ $b = $b|0;
+ var $sub = $a - $b;
+ return ($sub|0) < 0;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(0x7fffffff,-1));
diff --git a/test/mjsunit/compiler/regress-621423.js b/test/mjsunit/compiler/regress-621423.js
new file mode 100644
index 0000000..962176f
--- /dev/null
+++ b/test/mjsunit/compiler/regress-621423.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [0, ""];
+a[0] = 0;
+
+function g(array) {
+  array[1] = undefined;
+}
+
+function f() {
+  g(function() {});
+  g(a);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/compiler/regress-number-is-hole-nan.js b/test/mjsunit/compiler/regress-number-is-hole-nan.js
new file mode 100644
index 0000000..368c837
--- /dev/null
+++ b/test/mjsunit/compiler/regress-number-is-hole-nan.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = [, 2.121736758e-314];
+
+function foo() { return a[1]; }
+
+assertEquals(2.121736758e-314, foo());
+assertEquals(2.121736758e-314, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(2.121736758e-314, foo());
diff --git a/test/mjsunit/compiler/regress-store-holey-double-array.js b/test/mjsunit/compiler/regress-store-holey-double-array.js
new file mode 100644
index 0000000..8123198
--- /dev/null
+++ b/test/mjsunit/compiler/regress-store-holey-double-array.js
@@ -0,0 +1,43 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function StoreHoleBitPattern() {
+  function g(src, dst, i) {
+    dst[i] = src[i];
+  }
+
+  var b = new ArrayBuffer(16);
+  var i32 = new Int32Array(b);
+  i32[0] = 0xFFF7FFFF;
+  i32[1] = 0xFFF7FFFF;
+  i32[3] = 0xFFF7FFFF;
+  i32[4] = 0xFFF7FFFF;
+  var f64 = new Float64Array(b);
+
+  var a = [,0.1];
+
+  g(f64, a, 1);
+  g(f64, a, 1);
+  %OptimizeFunctionOnNextCall(g);
+  g(f64, a, 0);
+
+  assertTrue(Number.isNaN(a[0]));
+})();
+
+
+(function ConvertHoleToNumberAndStore() {
+  function g(a, i) {
+    var x = a[i];
+    a[i] = +x;
+  }
+
+  var a=[,0.1];
+  g(a, 1);
+  g(a, 1);
+  %OptimizeFunctionOnNextCall(g);
+  g(a, 0);
+  assertTrue(Number.isNaN(a[0]));
+})();
diff --git a/test/mjsunit/compiler/regress-string-to-number-add.js b/test/mjsunit/compiler/regress-string-to-number-add.js
new file mode 100644
index 0000000..e872401
--- /dev/null
+++ b/test/mjsunit/compiler/regress-string-to-number-add.js
@@ -0,0 +1,15 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-type-feedback
+
+function f(x) {
+  var s = x ? "0" : "1";
+  return 1 + Number(s);
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(2, f(0));
diff --git a/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js b/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
new file mode 100644
index 0000000..1dc3042
--- /dev/null
+++ b/test/mjsunit/compiler/regress-truncate-number-or-undefined-to-float64.js
@@ -0,0 +1,19 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g(a, b) {
+  a = +a;
+  if (b) {
+    a = undefined;
+  }
+  print(a);
+  return +a;
+}
+
+g(0);
+g(0);
+%OptimizeFunctionOnNextCall(g);
+assertTrue(Number.isNaN(g(0, true)));
diff --git a/test/mjsunit/compiler/turbo-number-feedback.js b/test/mjsunit/compiler/turbo-number-feedback.js
new file mode 100644
index 0000000..059a0ca
--- /dev/null
+++ b/test/mjsunit/compiler/turbo-number-feedback.js
@@ -0,0 +1,58 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-type-feedback
+
+(function AddSubtractSmis() {
+  function f0(a, b, c) {
+    return a + b - c;
+  }
+
+  assertEquals(4, f0(3, 2, 1));
+  assertEquals(4, f0(3, 2, 1));
+  %OptimizeFunctionOnNextCall(f0);
+  assertEquals(4, f0(3, 2, 1));
+})();
+
+(function AddSubtractDoubles() {
+  function f1(a, b, c) {
+    return a + b - c;
+  }
+
+  assertEquals(4.5, f1(3.5, 2.5, 1.5));
+  assertEquals(4.5, f1(3.5, 2.5, 1.5));
+  %OptimizeFunctionOnNextCall(f1);
+  assertEquals(4.5, f1(3.5, 2.5, 1.5));
+  assertEquals(4, f1(3, 2, 1));
+  assertTrue(isNaN(f1(3, 2, undefined)));
+  assertTrue(isNaN(f1(3, undefined, 1)));
+})();
+
+(function CheckUint32ToInt32Conv() {
+  function f2(a) {
+    return (a >>> 0) + 1;
+  }
+
+  assertEquals(1, f2(0));
+  assertEquals(1, f2(0));
+  %OptimizeFunctionOnNextCall(f2);
+  assertEquals(1, f2(0));
+  assertEquals(4294967295, f2(-2));
+})();
+
+(function CheckFloat64ToInt32Conv() {
+  function f3(a, b) {
+    var x = 0;
+    if (a) {
+      x = 0.5;
+    }
+    return x + b;
+  }
+
+  assertEquals(1, f3(0, 1));
+  assertEquals(1, f3(0, 1));
+  %OptimizeFunctionOnNextCall(f3);
+  assertEquals(1, f3(0, 1));
+  assertEquals(1.5, f3(1, 1));
+})();
diff --git a/test/mjsunit/debug-generator-break-on-stack.js b/test/mjsunit/debug-generator-break-on-stack.js
new file mode 100644
index 0000000..b743488
--- /dev/null
+++ b/test/mjsunit/debug-generator-break-on-stack.js
@@ -0,0 +1,46 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --ignition-generators
+
+var Debug = debug.Debug;
+
+var break_count = 0;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    break_count++;
+    var line = exec_state.frame(0).sourceLineText();
+    print(line);
+    assertTrue(line.indexOf(`B${break_count}`) > 0);
+  } catch (e) {
+    exception = e;
+  }
+}
+
+
+function* g() {
+  setbreaks();
+  yield 1;  // B1
+}
+
+function* f() {
+  yield* g();
+  return 2;  // B2
+}
+
+function setbreaks() {
+  Debug.setListener(listener);
+  Debug.setBreakPoint(g, 2);
+  Debug.setBreakPoint(f, 2);
+}
+
+for (let _ of f()) { }
+
+assertEquals(2, break_count);
+assertNull(exception);
+
+Debug.setListener(null);
diff --git a/test/mjsunit/debug-generator-break.js b/test/mjsunit/debug-generator-break.js
new file mode 100644
index 0000000..4ab601b
--- /dev/null
+++ b/test/mjsunit/debug-generator-break.js
@@ -0,0 +1,44 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --ignition-generators
+
+var Debug = debug.Debug;
+
+var break_count = 0;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    break_count++;
+    var line = exec_state.frame(0).sourceLineText();
+    assertTrue(line.indexOf(`B${break_count}`) > 0);
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+function* g() {
+  yield 1;
+}
+
+function* f() {
+  yield* g();                    // B1
+  assertEquals(2, break_count);  // B2
+  return 1;                      // B3
+}
+
+Debug.setBreakPoint(f, 1);
+Debug.setBreakPoint(f, 2);
+Debug.setBreakPoint(f, 3);
+
+for (let _ of f()) { }
+
+assertEquals(3, break_count);
+assertNull(exception);
+
+Debug.setListener(null);
diff --git a/test/mjsunit/debug-handle.js b/test/mjsunit/debug-handle.js
index 1582b9f..ca02592 100644
--- a/test/mjsunit/debug-handle.js
+++ b/test/mjsunit/debug-handle.js
@@ -108,7 +108,7 @@
     var handle_a = evaluateRequest(exec_state, '{"expression":"b","frame":1}');
     assertEquals(handle_o, handle_a);
     assertEquals(handle_a, handle_b);
-    assertFalse(handle_o == handle_p, "o and p have he same handle");
+    assertFalse(handle_o == handle_p, "o and p have the same handle");
 
     var response;
     var count;
@@ -140,7 +140,7 @@
     var handle_g = evaluateRequest(exec_state, '{"expression":"g"}');
     var handle_caller = evaluateRequest(exec_state, '{"expression":"f.caller"}');
 
-    assertFalse(handle_f == handle_g, "f and g have he same handle");
+    assertFalse(handle_f == handle_g, "f and g have the same handle");
     assertEquals(handle_g, handle_caller, "caller for f should be g");
 
     response = lookupRequest(exec_state, '{"handles":[' + handle_f + ']}', true);
diff --git a/test/mjsunit/debug-script.js b/test/mjsunit/debug-script.js
index 5396415..3bedb74 100644
--- a/test/mjsunit/debug-script.js
+++ b/test/mjsunit/debug-script.js
@@ -84,11 +84,6 @@
 assertEquals('native math.js', math_script.name);
 assertEquals(Debug.ScriptType.Native, math_script.type);
 
-// Test a builtins delay loaded script.
-var date_delay_script = Debug.findScript('native json.js');
-assertEquals('native json.js', date_delay_script.name);
-assertEquals(Debug.ScriptType.Native, date_delay_script.type);
-
 // Test a debugger script.
 var debug_delay_script = Debug.findScript('native debug.js');
 assertEquals('native debug.js', debug_delay_script.name);
diff --git a/test/mjsunit/debug-sourceinfo.js b/test/mjsunit/debug-sourceinfo.js
index cb41107..b79fb8e 100644
--- a/test/mjsunit/debug-sourceinfo.js
+++ b/test/mjsunit/debug-sourceinfo.js
@@ -63,12 +63,11 @@
 
 // This is the last position in the entire file (note: this equals
 // file size of <debug-sourceinfo.js> - 1, since starting at 0).
-var last_position = 11519;
+var last_position = 8126;
 // This is the last line of entire file (note: starting at 0).
-var last_line = 269;
-// This is the last column of last line (note: starting at 0 and +1, due
-// to trailing <LF>).
-var last_column = 1;
+var last_line = 200;
+// This is the last column of last line (note: starting at 0).
+var last_column = 71;
 
 // This magic number is the length or the first line comment (actually number
 // of characters before 'function a(...'.
@@ -168,66 +167,6 @@
 assertEquals(11, script.locationFromPosition(start_d).line - comment_lines);
 assertEquals(10, script.locationFromPosition(start_d).column);
 
-// Test first line.
-assertEquals(0, script.locationFromLine().position);
-assertEquals(0, script.locationFromLine().line);
-assertEquals(0, script.locationFromLine().column);
-assertEquals(0, script.locationFromLine(0).position);
-assertEquals(0, script.locationFromLine(0).line);
-assertEquals(0, script.locationFromLine(0).column);
-
-// Test first line column 1.
-assertEquals(1, script.locationFromLine(0, 1).position);
-assertEquals(0, script.locationFromLine(0, 1).line);
-assertEquals(1, script.locationFromLine(0, 1).column);
-
-// Test first line offset 1.
-assertEquals(1, script.locationFromLine(0, 0, 1).position);
-assertEquals(0, script.locationFromLine(0, 0, 1).line);
-assertEquals(1, script.locationFromLine(0, 0, 1).column);
-
-// Test offset function a().
-assertEquals(start_a, script.locationFromLine(void 0, void 0, start_a).position);
-assertEquals(0, script.locationFromLine(void 0, void 0, start_a).line - comment_lines);
-assertEquals(10, script.locationFromLine(void 0, void 0, start_a).column);
-assertEquals(start_a, script.locationFromLine(0, void 0, start_a).position);
-assertEquals(0, script.locationFromLine(0, void 0, start_a).line - comment_lines);
-assertEquals(10, script.locationFromLine(0, void 0, start_a).column);
-assertEquals(start_a, script.locationFromLine(0, 0, start_a).position);
-assertEquals(0, script.locationFromLine(0, 0, start_a).line - comment_lines);
-assertEquals(10, script.locationFromLine(0, 0, start_a).column);
-
-// Test second line offset function a().
-assertEquals(start_a + 13, script.locationFromLine(1, 0, start_a).position);
-assertEquals(1, script.locationFromLine(1, 0, start_a).line - comment_lines);
-assertEquals(0, script.locationFromLine(1, 0, start_a).column);
-
-// Test second line column 2 offset function a().
-assertEquals(start_a + 13 + 1, script.locationFromLine(1, 1, start_a).position);
-assertEquals(1, script.locationFromLine(1, 2, start_a).line - comment_lines);
-assertEquals(2, script.locationFromLine(1, 2, start_a).column);
-
-// Test offset function b().
-assertEquals(start_b, script.locationFromLine(0, 0, start_b).position);
-assertEquals(1, script.locationFromLine(0, 0, start_b).line - comment_lines);
-assertEquals(13, script.locationFromLine(0, 0, start_b).column);
-
-// Test second line offset function b().
-assertEquals(start_b + 5, script.locationFromLine(1, 0, start_b).position);
-assertEquals(2, script.locationFromLine(1, 0, start_b).line - comment_lines);
-assertEquals(0, script.locationFromLine(1, 0, start_b).column);
-
-// Test second line column 10 offset function b().
-assertEquals(start_b + 5 + 10, script.locationFromLine(1, 10, start_b).position);
-assertEquals(2, script.locationFromLine(1, 10, start_b).line - comment_lines);
-assertEquals(10, script.locationFromLine(1, 10, start_b).column);
-
-// Test second line column 11 offset function b. Second line in b is 10 long
-// using column 11 wraps to next line.
-assertEquals(start_b + 5 + 11, script.locationFromLine(1, 11, start_b).position);
-assertEquals(3, script.locationFromLine(1, 11, start_b).line - comment_lines);
-assertEquals(0, script.locationFromLine(1, 11, start_b).column);
-
 // Test the Debug.findSourcePosition which wraps SourceManager.
 assertEquals(0 + start_a, Debug.findFunctionSourceLocation(a, 0, 0).position);
 assertEquals(0 + start_b, Debug.findFunctionSourceLocation(b, 0, 0).position);
@@ -260,11 +199,3 @@
 assertEquals(last_line + 1,
              script.locationFromPosition(last_position + 1).line);
 assertEquals(0, script.locationFromPosition(last_position + 1).column);
-
-// Test that script.sourceLine(line) works.
-var location;
-
-for (line = 0; line < num_lines_d; line++) {
-  var line_content_regexp = new RegExp("  x = " + (line + 1));
-  assertTrue(line_content_regexp.test(script.sourceLine(start_line_d + line)));
-}
diff --git a/test/mjsunit/debug-sourceslice.js b/test/mjsunit/debug-sourceslice.js
deleted file mode 100644
index db9a3e7..0000000
--- a/test/mjsunit/debug-sourceslice.js
+++ /dev/null
@@ -1,74 +0,0 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --expose-debug-as debug
-// Source lines for test.
-var lines = [ 'function a() { b(); };\n',
-              'function    b() {\n',
-              '  c(true);\n',
-              '};\n',
-              '  function c(x) {\n',
-              '    if (x) {\n',
-              '      return 1;\n',
-              '    } else {\n',
-              '      return 1;\n',
-              '    }\n',
-              '  };\n' ];
-
-// Build source by putting all lines together
-var source = '';
-for (var i = 0; i < lines.length; i++) {
-  source += lines[i];
-}
-eval(source);
-
-// Flags: --expose-debug-as debug
-// Get the Debug object exposed from the debug context global object.
-Debug = debug.Debug
-
-// Get the script object from one of the functions in the source.
-var script = Debug.findScript(a);
-
-// Make sure that the source is as expected.
-assertEquals(source, script.source);
-assertEquals(source, script.sourceSlice().sourceText());
-
-// Try all possible line interval slices.
-for (var slice_size = 0; slice_size < lines.length; slice_size++) {
-  for (var n = 0; n < lines.length - slice_size; n++) {
-    var slice = script.sourceSlice(n, n + slice_size);
-    assertEquals(n, slice.from_line);
-    assertEquals(n + slice_size, slice.to_line);
-
-    var text = slice.sourceText();
-    var expected = '';
-    for (var i = 0; i < slice_size; i++) {
-      expected += lines[n + i];
-    }
-    assertEquals(expected, text);
-  }
-}
diff --git a/test/mjsunit/dictionary-properties.js b/test/mjsunit/dictionary-properties.js
index 0659268..33360d7 100644
--- a/test/mjsunit/dictionary-properties.js
+++ b/test/mjsunit/dictionary-properties.js
@@ -39,7 +39,13 @@
 SlowPrototype.prototype.bar = 2;
 SlowPrototype.prototype.baz = 3;
 delete SlowPrototype.prototype.baz;
-new SlowPrototype;
+assertFalse(%HasFastProperties(SlowPrototype.prototype));
+var slow_proto = new SlowPrototype;
+// ICs make prototypes fast.
+function ic() { return slow_proto.bar; }
+ic();
+ic();
+assertTrue(%HasFastProperties(slow_proto.__proto__));
 
 // Prototypes stay fast even after deleting properties.
 assertTrue(%HasFastProperties(SlowPrototype.prototype));
diff --git a/test/mjsunit/double-intrinsics.js b/test/mjsunit/double-intrinsics.js
index 16d6538..b50038e 100644
--- a/test/mjsunit/double-intrinsics.js
+++ b/test/mjsunit/double-intrinsics.js
@@ -7,10 +7,10 @@
 function assertDoubleBits(hi, lo, x) {
   hi = hi | 0;
   lo = lo | 0;
-  assertEquals(x, %_ConstructDouble(hi, lo));
+  assertEquals(x, %ConstructDouble(hi, lo));
   assertEquals(hi, %_DoubleHi(x));
   assertEquals(lo, %_DoubleLo(x));
-  assertEquals(x, %_ConstructDouble(%_DoubleHi(x), %_DoubleLo(x)));
+  assertEquals(x, %ConstructDouble(%_DoubleHi(x), %_DoubleLo(x)));
 }
 
 
diff --git a/test/mjsunit/harmony/array-species-constructor-accessor.js b/test/mjsunit/es6/array-species-constructor-accessor.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-constructor-accessor.js
rename to test/mjsunit/es6/array-species-constructor-accessor.js
index 4c852f0..7ebf328 100644
--- a/test/mjsunit/harmony/array-species-constructor-accessor.js
+++ b/test/mjsunit/es6/array-species-constructor-accessor.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting the constructor of an instance updates the protector
 
diff --git a/test/mjsunit/harmony/array-species-constructor-delete.js b/test/mjsunit/es6/array-species-constructor-delete.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-constructor-delete.js
rename to test/mjsunit/es6/array-species-constructor-delete.js
index f341282..fff22a2 100644
--- a/test/mjsunit/harmony/array-species-constructor-delete.js
+++ b/test/mjsunit/es6/array-species-constructor-delete.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting the constructor of an instance updates the protector
 
diff --git a/test/mjsunit/harmony/array-species-constructor.js b/test/mjsunit/es6/array-species-constructor.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-constructor.js
rename to test/mjsunit/es6/array-species-constructor.js
index d766e09..0d888f4 100644
--- a/test/mjsunit/harmony/array-species-constructor.js
+++ b/test/mjsunit/es6/array-species-constructor.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting the constructor of an instance updates the protector
 
diff --git a/test/mjsunit/harmony/array-species-delete.js b/test/mjsunit/es6/array-species-delete.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-delete.js
rename to test/mjsunit/es6/array-species-delete.js
index ba49414..16a2fa2 100644
--- a/test/mjsunit/harmony/array-species-delete.js
+++ b/test/mjsunit/es6/array-species-delete.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting the constructor of an instance updates the protector
 
diff --git a/test/mjsunit/harmony/array-species-modified.js b/test/mjsunit/es6/array-species-modified.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-modified.js
rename to test/mjsunit/es6/array-species-modified.js
index 73c52b9..58feb31 100644
--- a/test/mjsunit/harmony/array-species-modified.js
+++ b/test/mjsunit/es6/array-species-modified.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting Array[Symbol.species] updates the protector
 
diff --git a/test/mjsunit/harmony/array-species-parent-constructor.js b/test/mjsunit/es6/array-species-parent-constructor.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-parent-constructor.js
rename to test/mjsunit/es6/array-species-parent-constructor.js
index 347732e..b4fb1d5 100644
--- a/test/mjsunit/harmony/array-species-parent-constructor.js
+++ b/test/mjsunit/es6/array-species-parent-constructor.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting Array.prototype.constructor updates the protector
 
diff --git a/test/mjsunit/harmony/array-species-proto.js b/test/mjsunit/es6/array-species-proto.js
similarity index 94%
rename from test/mjsunit/harmony/array-species-proto.js
rename to test/mjsunit/es6/array-species-proto.js
index 70db751..6b55881 100644
--- a/test/mjsunit/harmony/array-species-proto.js
+++ b/test/mjsunit/es6/array-species-proto.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Overwriting an array instance's __proto__ updates the protector
 
diff --git a/test/mjsunit/harmony/array-species.js b/test/mjsunit/es6/array-species.js
similarity index 99%
rename from test/mjsunit/harmony/array-species.js
rename to test/mjsunit/es6/array-species.js
index 19ed1d8..25edf55 100644
--- a/test/mjsunit/harmony/array-species.js
+++ b/test/mjsunit/es6/array-species.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
-
 // Test the ES2015 @@species feature
 
 'use strict';
diff --git a/test/mjsunit/harmony/arraybuffer-species.js b/test/mjsunit/es6/arraybuffer-species.js
similarity index 97%
rename from test/mjsunit/harmony/arraybuffer-species.js
rename to test/mjsunit/es6/arraybuffer-species.js
index 0445a4b..1ac6efb 100644
--- a/test/mjsunit/harmony/arraybuffer-species.js
+++ b/test/mjsunit/es6/arraybuffer-species.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
-
 // ArrayBuffer.prototype.slice makes subclass and checks length
 
 class MyArrayBuffer extends ArrayBuffer { }
diff --git a/test/mjsunit/es6/block-eval-var-over-let.js b/test/mjsunit/es6/block-eval-var-over-let.js
index febc83f..b68dbdd 100644
--- a/test/mjsunit/es6/block-eval-var-over-let.js
+++ b/test/mjsunit/es6/block-eval-var-over-let.js
@@ -8,13 +8,13 @@
 assertThrows(function() {
   let x = 1;
   eval('var x');
-}, TypeError);
+}, SyntaxError);
 
 // If the eval is in its own block scope, throws
 assertThrows(function() {
   let y = 1;
   { eval('var y'); }
-}, TypeError);
+}, SyntaxError);
 
 // If the let is in its own block scope, with the eval, throws
 assertThrows(function() {
@@ -22,7 +22,7 @@
     let x = 1;
     eval('var x');
   }
-}, TypeError);
+}, SyntaxError);
 
 // Legal if the let is no longer visible
 assertDoesNotThrow(function() {
@@ -37,13 +37,13 @@
 assertThrows(function() {
   const x = 1;
   eval('var x');
-}, TypeError);
+}, SyntaxError);
 
 // If the eval is in its own block scope, throws
 assertThrows(function() {
   const y = 1;
   { eval('var y'); }
-}, TypeError);
+}, SyntaxError);
 
 // If the const is in its own block scope, with the eval, throws
 assertThrows(function() {
@@ -51,7 +51,7 @@
     const x = 1;
     eval('var x');
   }
-}, TypeError);
+}, SyntaxError);
 
 // Legal if the const is no longer visible
 assertDoesNotThrow(function() {
diff --git a/test/mjsunit/es6/classes-subclass-builtins.js b/test/mjsunit/es6/classes-subclass-builtins.js
index 7669ef3..dca514c 100644
--- a/test/mjsunit/es6/classes-subclass-builtins.js
+++ b/test/mjsunit/es6/classes-subclass-builtins.js
@@ -2,8 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax --harmony-regexp-subclass
-// Flags: --expose-gc
+// Flags: --allow-natives-syntax --expose-gc
 
 "use strict";
 
diff --git a/test/mjsunit/es6/debug-promises/async-task-event.js b/test/mjsunit/es6/debug-promises/async-task-event.js
index 88030a2..0b0fa1e 100644
--- a/test/mjsunit/es6/debug-promises/async-task-event.js
+++ b/test/mjsunit/es6/debug-promises/async-task-event.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug
+// Flags: --expose-debug-as debug --allow-natives-syntax
 
 Debug = debug.Debug;
 
@@ -16,8 +16,8 @@
   "didHandle #1",
   "willHandle #2",
   "then #2",
-  "enqueue #3",
   "didHandle #2",
+  "enqueue #3",
   "willHandle #3",
   "didHandle #3"
 ];
@@ -58,4 +58,6 @@
 });
 resolver();
 
+%RunMicrotasks();
+
 assertNull(exception);
diff --git a/test/mjsunit/es6/debug-promises/evaluate-across-microtasks.js b/test/mjsunit/es6/debug-promises/evaluate-across-microtasks.js
new file mode 100644
index 0000000..73718ee
--- /dev/null
+++ b/test/mjsunit/es6/debug-promises/evaluate-across-microtasks.js
@@ -0,0 +1,66 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+
+var Debug = debug.Debug;
+var listenerComplete = false;
+var exception = null;
+var count = 0;
+var log = [];
+var done = false;
+
+function LogX(x) {
+  var stored_count = count;
+  return function() {
+    log.push(`[${stored_count}] ${x}`);
+  };
+}
+
+function DebuggerStatement() {
+  log.push(`[${count}] debugger`);
+  if (count++ < 3) {
+    debugger;
+  }
+}
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var p = Promise.resolve();
+    var q = p.then(LogX("then 1"));
+    p.then(LogX("then 2"));
+    q.then(LogX("then 3"));
+    q.then(DebuggerStatement);
+    var r = q.then(() => { throw 1; });
+    r.catch(LogX("catch"));
+    listenerComplete = true;
+  } catch (e) {
+    exception = e;
+    print(e, e.stack);
+    quit(1);
+  };
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+DebuggerStatement();
+LogX("start")();
+
+// Make sure that the debug event listener was invoked.
+assertTrue(listenerComplete);
+
+%RunMicrotasks();
+
+var expectation =
+  [ "[0] debugger", "[1] start", "[1] then 1",
+    "[1] then 2", "[1] then 3", "[1] debugger",
+    "[2] then 1", "[2] then 2", "[1] catch",
+    "[2] then 3", "[2] debugger", "[3] then 1",
+    "[3] then 2", "[2] catch", "[3] then 3",
+    "[3] debugger", "[3] catch",
+  ];
+
+assertEquals(expectation, log);
diff --git a/test/mjsunit/es6/debug-step-into-regexp-subclass.js b/test/mjsunit/es6/debug-step-into-regexp-subclass.js
index 599fe05..5e5eb47 100644
--- a/test/mjsunit/es6/debug-step-into-regexp-subclass.js
+++ b/test/mjsunit/es6/debug-step-into-regexp-subclass.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --harmony-regexp-subclass
+// Flags: --expose-debug-as debug
 
 Debug = debug.Debug
 
diff --git a/test/mjsunit/es6/debug-stepin-generators.js b/test/mjsunit/es6/debug-stepin-generators.js
index 081dfb7..6e548b4 100644
--- a/test/mjsunit/es6/debug-stepin-generators.js
+++ b/test/mjsunit/es6/debug-stepin-generators.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug
+// Flags: --expose-debug-as debug --ignition-generators
 
 Debug = debug.Debug
 var exception = null;
diff --git a/test/mjsunit/harmony/function-name.js b/test/mjsunit/es6/function-name.js
similarity index 99%
rename from test/mjsunit/harmony/function-name.js
rename to test/mjsunit/es6/function-name.js
index 66a69e0..152a631 100644
--- a/test/mjsunit/harmony/function-name.js
+++ b/test/mjsunit/es6/function-name.js
@@ -1,8 +1,6 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-function-name
 
 (function testVariableDeclarationsFunction() {
   'use strict';
diff --git a/test/mjsunit/es6/generators-debug-liveedit.js b/test/mjsunit/es6/generators-debug-liveedit.js
index 987a42c..2bbbfc2 100644
--- a/test/mjsunit/es6/generators-debug-liveedit.js
+++ b/test/mjsunit/es6/generators-debug-liveedit.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --ignition-generators
 
 var Debug = debug.Debug;
 var LiveEdit = Debug.LiveEdit;
diff --git a/test/mjsunit/es6/generators-debug-scopes.js b/test/mjsunit/es6/generators-debug-scopes.js
index 126572d..b2a1ded 100644
--- a/test/mjsunit/es6/generators-debug-scopes.js
+++ b/test/mjsunit/es6/generators-debug-scopes.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug
+// Flags: --expose-debug-as debug --ignition-generators
 
 var Debug = debug.Debug;
 
diff --git a/test/mjsunit/es6/generators-iteration.js b/test/mjsunit/es6/generators-iteration.js
index ae4c682..8f0a774 100644
--- a/test/mjsunit/es6/generators-iteration.js
+++ b/test/mjsunit/es6/generators-iteration.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --expose-gc
+// Flags: --expose-gc --ignition-generators
 
 // Test generator iteration.
 
diff --git a/test/mjsunit/es6/generators-mirror.js b/test/mjsunit/es6/generators-mirror.js
index bf21f4d..62fbae0 100644
--- a/test/mjsunit/es6/generators-mirror.js
+++ b/test/mjsunit/es6/generators-mirror.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug
+// Flags: --expose-debug-as debug --ignition-generators
 // Test the mirror object for functions.
 
 function *generator(f) {
diff --git a/test/mjsunit/es6/generators-objects.js b/test/mjsunit/es6/generators-objects.js
index 2d23841..9a07518 100644
--- a/test/mjsunit/es6/generators-objects.js
+++ b/test/mjsunit/es6/generators-objects.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --ignition-generators
 
 // Test instantations of generators.
 
@@ -113,3 +113,17 @@
   assertSame(generator_prototype, Object.getPrototypeOf(g()));
 }
 TestPrototype();
+
+
+function TestComputedPropertyNames() {
+  function* f1() { return {[yield]: 42} }
+  var g1 = f1();
+  g1.next();
+  assertEquals(42, g1.next('a').value.a);
+
+  function* f2() { return {['a']: yield} }
+  var g2 = f2();
+  g2.next();
+  assertEquals(42, g2.next(42).value.a);
+}
+TestComputedPropertyNames();
diff --git a/test/mjsunit/es6/generators-parsing.js b/test/mjsunit/es6/generators-parsing.js
index f3f8cad..143c3d7 100644
--- a/test/mjsunit/es6/generators-parsing.js
+++ b/test/mjsunit/es6/generators-parsing.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --ignition-generators
+
 // Test basic generator syntax.
 
 // Yield statements.
diff --git a/test/mjsunit/es6/generators-poisoned-properties.js b/test/mjsunit/es6/generators-poisoned-properties.js
index e861022..5a0c652 100644
--- a/test/mjsunit/es6/generators-poisoned-properties.js
+++ b/test/mjsunit/es6/generators-poisoned-properties.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --ignition-generators
+
 (function testRestrictedPropertiesStrict() {
   function* generator() { "use strict"; }
   assertFalse(generator.hasOwnProperty("arguments"));
diff --git a/test/mjsunit/es6/generators-relocation.js b/test/mjsunit/es6/generators-relocation.js
index 2636f52..28311a8 100644
--- a/test/mjsunit/es6/generators-relocation.js
+++ b/test/mjsunit/es6/generators-relocation.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug
+// Flags: --expose-debug-as debug --ignition-generators
 
 var Debug = debug.Debug;
 
diff --git a/test/mjsunit/es6/generators-runtime.js b/test/mjsunit/es6/generators-runtime.js
index 5c426b2..0cdbfca 100644
--- a/test/mjsunit/es6/generators-runtime.js
+++ b/test/mjsunit/es6/generators-runtime.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --ignition-generators
+
 // Test aspects of the generator runtime.
 
 // See:
diff --git a/test/mjsunit/es6/generators-states.js b/test/mjsunit/es6/generators-states.js
index 4e8c580..fb6b14a 100644
--- a/test/mjsunit/es6/generators-states.js
+++ b/test/mjsunit/es6/generators-states.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --ignition-generators
+
 // Test generator states.
 
 function Foo() {}
diff --git a/test/mjsunit/harmony/instanceof-es6.js b/test/mjsunit/es6/instanceof.js
similarity index 97%
rename from test/mjsunit/harmony/instanceof-es6.js
rename to test/mjsunit/es6/instanceof.js
index 4971c9c..6bf2259 100644
--- a/test/mjsunit/harmony/instanceof-es6.js
+++ b/test/mjsunit/es6/instanceof.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-instanceof
-
 // Make sure it's an error if @@hasInstance isn't a function.
 (function() {
   var F = {};
diff --git a/test/mjsunit/harmony/iterator-close.js b/test/mjsunit/es6/iterator-close.js
similarity index 99%
rename from test/mjsunit/harmony/iterator-close.js
rename to test/mjsunit/es6/iterator-close.js
index 03cdeac..1a96bee 100644
--- a/test/mjsunit/harmony/iterator-close.js
+++ b/test/mjsunit/es6/iterator-close.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-iterator-close
-
 
 function* g() { yield 42; return 88 };
 
diff --git a/test/mjsunit/es6/json.js b/test/mjsunit/es6/json.js
index 4c1ada8..c049a25 100644
--- a/test/mjsunit/es6/json.js
+++ b/test/mjsunit/es6/json.js
@@ -9,5 +9,7 @@
   assertTrue(desc.configurable);
   assertFalse(desc.writable);
   assertEquals("JSON", desc.value);
+  delete JSON[Symbol.toStringTag];
+  assertEquals('[object Object]', "" + JSON);
 }
 testJSONToString();
diff --git a/test/mjsunit/es6/legacy-subclassing.js b/test/mjsunit/es6/legacy-subclassing.js
deleted file mode 100644
index dbf666d..0000000
--- a/test/mjsunit/es6/legacy-subclassing.js
+++ /dev/null
@@ -1,38 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --noharmony-species
-
-// Before Symbol.species was added, ArrayBuffer subclasses constructed
-// ArrayBuffers, and Array subclasses constructed Arrays, but TypedArray and
-// Promise subclasses constructed an instance of the subclass.
-
-'use strict';
-
-assertEquals(undefined, Symbol.species);
-
-class MyArray extends Array { }
-let myArray = new MyArray();
-assertEquals(MyArray, myArray.constructor);
-assertEquals(Array, myArray.map(x => x + 1).constructor);
-assertEquals(Array, myArray.concat().constructor);
-
-class MyUint8Array extends Uint8Array { }
-Object.defineProperty(MyUint8Array.prototype, "BYTES_PER_ELEMENT", {value: 1});
-let myTypedArray = new MyUint8Array(3);
-assertEquals(MyUint8Array, myTypedArray.constructor);
-assertEquals(MyUint8Array, myTypedArray.map(x => x + 1).constructor);
-
-class MyArrayBuffer extends ArrayBuffer { }
-let myBuffer = new MyArrayBuffer(0);
-assertEquals(MyArrayBuffer, myBuffer.constructor);
-assertEquals(ArrayBuffer, myBuffer.slice().constructor);
-
-class MyPromise extends Promise { }
-let myPromise = new MyPromise(() => {});
-assertEquals(MyPromise, myPromise.constructor);
-assertEquals(MyPromise, myPromise.then().constructor);
-
-// However, subarray instantiates members of the parent class
-assertEquals(Uint8Array, myTypedArray.subarray(1).constructor);
diff --git a/test/mjsunit/es6/math-log2-log10.js b/test/mjsunit/es6/math-log2-log10.js
index b1a7736..ea17a79 100644
--- a/test/mjsunit/es6/math-log2-log10.js
+++ b/test/mjsunit/es6/math-log2-log10.js
@@ -57,13 +57,13 @@
 var n = -1074;
 // This loop covers n from -1074 to -1043
 for (var lowbits = 1; lowbits <= 0x80000000; lowbits *= 2) {
-  var x = %_ConstructDouble(0, lowbits);
+  var x = %ConstructDouble(0, lowbits);
   assertEquals(n, Math.log2(x));
   n++;
 }
 // This loop covers n from -1042 to -1023
 for (var hibits = 1; hibits <= 0x80000; hibits *= 2) {
-  var x = %_ConstructDouble(hibits, 0);
+  var x = %ConstructDouble(hibits, 0);
   assertEquals(n, Math.log2(x));
   n++;
 }
diff --git a/test/mjsunit/es6/math.js b/test/mjsunit/es6/math.js
index cb43bd5..dc761d6 100644
--- a/test/mjsunit/es6/math.js
+++ b/test/mjsunit/es6/math.js
@@ -9,5 +9,7 @@
   assertTrue(desc.configurable);
   assertFalse(desc.writable);
   assertEquals("Math", desc.value);
+  delete Math[Symbol.toStringTag];
+  assertEquals('[object Object]', "" + Math);
 }
 testMathToString();
diff --git a/test/mjsunit/es6/no-unicode-regexp-flag.js b/test/mjsunit/es6/no-unicode-regexp-flag.js
deleted file mode 100644
index 82d070e..0000000
--- a/test/mjsunit/es6/no-unicode-regexp-flag.js
+++ /dev/null
@@ -1,24 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Before Unicode RegExps are shipped, we shouldn't have the 'unicode'
-// property on RegExp.prototype, or read it from 'flags'.
-// mjsunit/es6/regexp-flags tests that the property is there when the
-// flag is on.
-
-// Flags: --no-harmony-unicode-regexps
-
-'use strict';
-
-assertFalse(RegExp.prototype.hasOwnProperty('unicode'));
-
-// If we were going to be really strict, we could have a test like this,
-// with the assertTrue replaced by assertFalse, since flags shouldn't
-// Get the 'unicode' property. However, it is probably OK to omit this
-// detailed fix.
-var x = /a/;
-var y = false;
-Object.defineProperty(x, 'unicode', { get() { y = true; } });
-assertEquals("", x.flags);
-assertTrue(y);
diff --git a/test/mjsunit/es6/object-tostring.js b/test/mjsunit/es6/object-tostring.js
index 29d07f2..bc7d968 100644
--- a/test/mjsunit/es6/object-tostring.js
+++ b/test/mjsunit/es6/object-tostring.js
@@ -15,15 +15,16 @@
   RegExp:   [ RegExp ],
   Error:    [ Error, TypeError, RangeError, SyntaxError, ReferenceError,
               EvalError, URIError ]
-}
-for (f in funs) {
-  for (i in funs[f]) {
+};
+for (var f in funs) {
+  for (var i in funs[f]) {
+
     assertEquals("[object " + f + "]",
-                 Object.prototype.toString.call(new funs[f][i]),
-                 funs[f][i]);
+      Object.prototype.toString.call(new funs[f][i]),
+      funs[f][i]);
     assertEquals("[object Function]",
-                 Object.prototype.toString.call(funs[f][i]),
-                 funs[f][i]);
+      Object.prototype.toString.call(funs[f][i]),
+      funs[f][i]);
   }
 }
 
@@ -130,11 +131,11 @@
 }
 testObjectToStringPropertyDesc();
 
-function testObjectToStringOwnNonStringValue() {
-  var obj = Object.defineProperty({}, Symbol.toStringTag, { value: 1 });
+function testObjectToStringOnNonStringValue(obj) {
+  Object.defineProperty(obj, Symbol.toStringTag, { value: 1 });
   assertEquals("[object Object]", ({}).toString.call(obj));
 }
-testObjectToStringOwnNonStringValue();
+testObjectToStringOnNonStringValue({});
 
 
 // Proxies
@@ -149,11 +150,77 @@
 assertTag("Foo", new Proxy(() => 42, {get() {return "Foo"}}));
 assertTag("Function", new Proxy(() => 42, {get() {return 666}}));
 
-revocable = Proxy.revocable([], {});
+var revocable = Proxy.revocable([], {});
 revocable.revoke();
 assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
 
-handler = {};
+var handler = {};
 revocable = Proxy.revocable([], handler);
+// The first get() call, i.e., toString() revokes the proxy
 handler.get = () => revocable.revoke();
+assertEquals("[object Array]", Object.prototype.toString.call(revocable.proxy));
 assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
+
+revocable = Proxy.revocable([], handler);
+handler.get = () => {revocable.revoke(); return "value";};
+assertEquals("[object value]", Object.prototype.toString.call(revocable.proxy));
+assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
+
+
+revocable = Proxy.revocable(function() {}, handler);
+handler.get = () => revocable.revoke();
+assertEquals("[object Function]", Object.prototype.toString.call(revocable.proxy));
+assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
+
+function* gen() { yield 1; }
+
+assertTag("GeneratorFunction", gen);
+Object.defineProperty(gen, Symbol.toStringTag, {writable: true});
+gen[Symbol.toStringTag] = "different string";
+assertTag("different string", gen);
+gen[Symbol.toStringTag] = 1;
+assertTag("Function", gen);
+
+function overwriteToStringTagWithNonStringValue(tag, obj) {
+  assertTag(tag, obj);
+
+  Object.defineProperty(obj, Symbol.toStringTag, {
+    configurable: true,
+    value: "different string"
+  });
+  assertTag("different string", obj);
+
+  testObjectToStringOnNonStringValue(obj);
+}
+
+overwriteToStringTagWithNonStringValue("global", global);
+overwriteToStringTagWithNonStringValue("Generator", gen());
+
+var arrayBuffer = new ArrayBuffer();
+overwriteToStringTagWithNonStringValue("ArrayBuffer", arrayBuffer);
+overwriteToStringTagWithNonStringValue("DataView", new DataView(arrayBuffer));
+
+overwriteToStringTagWithNonStringValue("Int8Array", new Int8Array());
+overwriteToStringTagWithNonStringValue("Uint8Array", new Uint8Array());
+overwriteToStringTagWithNonStringValue("Uint8ClampedArray",
+  new Uint8ClampedArray());
+overwriteToStringTagWithNonStringValue("Int16Array", new Int16Array());
+overwriteToStringTagWithNonStringValue("Uint16Array", new Uint16Array());
+overwriteToStringTagWithNonStringValue("Int32Array", new Int32Array());
+overwriteToStringTagWithNonStringValue("Uint32Array", new Uint32Array());
+overwriteToStringTagWithNonStringValue("Float32Array", new Float32Array());
+overwriteToStringTagWithNonStringValue("Float64Array", new Float64Array());
+
+var set = new Set();
+var map = new Map();
+
+overwriteToStringTagWithNonStringValue("Set", set);
+overwriteToStringTagWithNonStringValue("Map", map);
+
+overwriteToStringTagWithNonStringValue("Set Iterator", set[Symbol.iterator]());
+overwriteToStringTagWithNonStringValue("Map Iterator", map[Symbol.iterator]());
+
+overwriteToStringTagWithNonStringValue("WeakSet", new WeakSet());
+overwriteToStringTagWithNonStringValue("WeakMap", new WeakMap());
+
+overwriteToStringTagWithNonStringValue("Promise", new Promise(function() {}));
diff --git a/test/mjsunit/es6/pattern-brand-check.js b/test/mjsunit/es6/pattern-brand-check.js
index 9b0c011..2e32294 100644
--- a/test/mjsunit/es6/pattern-brand-check.js
+++ b/test/mjsunit/es6/pattern-brand-check.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-subclass
-
 function createNonRegExp(calls) {
   return {
     get [Symbol.match]() {
diff --git a/test/mjsunit/harmony/promise-species.js b/test/mjsunit/es6/promise-species.js
similarity index 95%
rename from test/mjsunit/harmony/promise-species.js
rename to test/mjsunit/es6/promise-species.js
index 12244f2..f6f2e7a 100644
--- a/test/mjsunit/harmony/promise-species.js
+++ b/test/mjsunit/es6/promise-species.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species --allow-natives-syntax
+// Flags: --allow-natives-syntax
 
 // Test that Promises use @@species appropriately
 
diff --git a/test/mjsunit/es6/proxies-for.js b/test/mjsunit/es6/proxies-for.js
index a171227..2b3060b 100644
--- a/test/mjsunit/es6/proxies-for.js
+++ b/test/mjsunit/es6/proxies-for.js
@@ -151,7 +151,7 @@
   object.__proto__ = proxy;
   assertEquals(["0"], keys(object));
 
-  // The Proxy doesn't set his ownKeys enumerable.
+  // The Proxy doesn't set its ownKeys enumerable.
   delete object[0];
   assertEquals([], keys(object));
 
diff --git a/test/mjsunit/es6/proxies-json.js b/test/mjsunit/es6/proxies-json.js
index d48d539..6b40e3e 100644
--- a/test/mjsunit/es6/proxies-json.js
+++ b/test/mjsunit/es6/proxies-json.js
@@ -35,7 +35,10 @@
   // Test fast case that bails out to slow case.
   assertEquals(expected, JSON.stringify(object));
   // Test slow case.
-  assertEquals(expected, JSON.stringify(object, undefined, 0));
+  assertEquals(expected, JSON.stringify(object, (key, value) => value));
+  // Test gap.
+  assertEquals(JSON.stringify(object, null, "="),
+               JSON.stringify(object, (key, value) => value, "="));
 }
 
 
@@ -67,6 +70,7 @@
 
 var parent1a = { b: proxy1 };
 testStringify('{"b":{"a":"A","b":"B","c":"C"}}', parent1a);
+testStringify('{"b":{"a":"A","b":"B","c":"C"}}', parent1a);
 
 var parent1b = { a: 123, b: proxy1, c: true };
 testStringify('{"a":123,"b":{"a":"A","b":"B","c":"C"},"c":true}', parent1b);
@@ -503,3 +507,56 @@
 assertEquals(["get", target, "length", proxy], log[0]);
 assertEquals(["get", target, "0", proxy], log[1]);
 assertEquals(["deleteProperty", target, "0"], log[2]);
+
+proxy = new Proxy([], {
+  get: function(target, property) {
+    if (property == "length") return 7;
+    return 0;
+  },
+});
+assertEquals('[[0,0,0,0,0,0,0]]', JSON.stringify([proxy]));
+
+proxy = new Proxy([], {
+  get: function(target, property) {
+    if (property == "length") return 1E40;
+    return 0;
+  },
+});
+assertThrows(() => JSON.stringify([proxy]), RangeError);
+
+log = [];
+proxy = new Proxy({}, {
+  ownKeys: function() {
+    log.push("ownKeys");
+    return ["0", "a", "b"];
+  },
+  get: function(target, property) {
+    log.push("get " + property);
+    return property.toUpperCase();
+  },
+  getOwnPropertyDescriptor: function(target, property) {
+    log.push("descriptor " + property);
+    return {enumerable: true, configurable: true};
+  },
+  isExtensible: assertUnreachable,
+  has: assertUnreachable,
+  getPrototypeOf: assertUnreachable,
+  setPrototypeOf: assertUnreachable,
+  preventExtensions: assertUnreachable,
+  setPrototypeOf: assertUnreachable,
+  defineProperty: assertUnreachable,
+  set: assertUnreachable,
+  deleteProperty: assertUnreachable,
+  apply: assertUnreachable,
+  construct: assertUnreachable,
+});
+
+assertEquals('[{"0":"0","a":"A","b":"B"}]', JSON.stringify([proxy]));
+assertEquals(['get toJSON',
+              'ownKeys',
+              'descriptor 0',
+              'descriptor a',
+              'descriptor b',
+              'get 0',
+              'get a',
+              'get b'], log);
diff --git a/test/mjsunit/es6/proxies-keys.js b/test/mjsunit/es6/proxies-keys.js
index 65dea6a..2635ac3 100644
--- a/test/mjsunit/es6/proxies-keys.js
+++ b/test/mjsunit/es6/proxies-keys.js
@@ -48,3 +48,31 @@
   assertEquals(["1","2"], Object.getOwnPropertyNames(p));
   assertEquals([symbol], Object.getOwnPropertySymbols(p));
 })();
+
+(function testNoProxyTraps() {
+  var test_sym = Symbol("sym1");
+  var test_sym2 = Symbol("sym2");
+  var target = {
+    one: 1,
+    two: 2,
+    [test_sym]: 4,
+    0: 0,
+  };
+  Object.defineProperty(
+      target, "non-enum",
+      { enumerable: false, value: "nope", configurable: true, writable: true });
+  target.__proto__ = {
+    target_proto: 3,
+    1: 1,
+    [test_sym2]: 5
+  };
+  Object.defineProperty(
+      target.__proto__, "non-enum2",
+      { enumerable: false, value: "nope", configurable: true, writable: true });
+  var proxy = new Proxy(target, {});
+
+  assertEquals(["0", "one", "two"], Object.keys(proxy));
+  assertEquals(["0", "one", "two", "non-enum"],
+               Object.getOwnPropertyNames(proxy));
+  assertEquals([test_sym], Object.getOwnPropertySymbols(proxy));
+})();
diff --git a/test/mjsunit/es6/reflect.js b/test/mjsunit/es6/reflect.js
index ee272b0..d597a78 100644
--- a/test/mjsunit/es6/reflect.js
+++ b/test/mjsunit/es6/reflect.js
@@ -541,6 +541,13 @@
       [s2]: 0, "-1": 0, "88": 0, "aaa": 0 };
   assertEquals(["0", "42", "88", "bla", "-1", "aaa", s1, s2],
       Reflect.ownKeys(obj));
+  // Force dict-mode elements.
+  delete obj[0];
+  assertEquals(["42", "88", "bla", "-1", "aaa", s1, s2],
+      Reflect.ownKeys(obj));
+  // Force dict-mode properties.
+  delete obj["bla"];
+  assertEquals(["42", "88", "-1", "aaa", s1, s2], Reflect.ownKeys(obj));
 })();
 
 
diff --git a/test/mjsunit/es6/regexp-constructor.js b/test/mjsunit/es6/regexp-constructor.js
index 559ac00..b685ff2 100644
--- a/test/mjsunit/es6/regexp-constructor.js
+++ b/test/mjsunit/es6/regexp-constructor.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-subclass
-
 "use strict";
 
 function should_not_be_called() {
diff --git a/test/mjsunit/es6/regexp-flags.js b/test/mjsunit/es6/regexp-flags.js
index 480222d..2bcccfa 100644
--- a/test/mjsunit/es6/regexp-flags.js
+++ b/test/mjsunit/es6/regexp-flags.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 var r1 = /abc/gi;
 assertEquals("abc", r1.source);
 assertTrue(r1.global);
diff --git a/test/mjsunit/harmony/species.js b/test/mjsunit/es6/species.js
similarity index 97%
rename from test/mjsunit/harmony/species.js
rename to test/mjsunit/es6/species.js
index da1df43..39156a4 100644
--- a/test/mjsunit/harmony/species.js
+++ b/test/mjsunit/es6/species.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
-
 // Test the ES2015 @@species feature
 
 'use strict';
diff --git a/test/mjsunit/harmony/string-match.js b/test/mjsunit/es6/string-match.js
similarity index 94%
rename from test/mjsunit/harmony/string-match.js
rename to test/mjsunit/es6/string-match.js
index 25a3ca2..2c7affe 100644
--- a/test/mjsunit/harmony/string-match.js
+++ b/test/mjsunit/es6/string-match.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-subclass
-
 var pattern = {};
 pattern[Symbol.match] = function(string) {
   return string.length;
diff --git a/test/mjsunit/harmony/string-replace.js b/test/mjsunit/es6/string-replace.js
similarity index 94%
rename from test/mjsunit/harmony/string-replace.js
rename to test/mjsunit/es6/string-replace.js
index 208c483..0beb57a 100644
--- a/test/mjsunit/harmony/string-replace.js
+++ b/test/mjsunit/es6/string-replace.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-subclass
-
 var pattern = {
   [Symbol.replace]: (string, newValue) => string + newValue
 };
diff --git a/test/mjsunit/es6/string-search.js b/test/mjsunit/es6/string-search.js
index dc02982..cbdf33d 100644
--- a/test/mjsunit/es6/string-search.js
+++ b/test/mjsunit/es6/string-search.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-subclass
-
 var pattern = {};
 pattern[Symbol.search] = function(string) {
   return string.length;
diff --git a/test/mjsunit/harmony/string-split.js b/test/mjsunit/es6/string-split.js
similarity index 94%
rename from test/mjsunit/harmony/string-split.js
rename to test/mjsunit/es6/string-split.js
index 1240d84..8ca655c 100644
--- a/test/mjsunit/harmony/string-split.js
+++ b/test/mjsunit/es6/string-split.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-subclass
-
 var pattern = {};
 var limit = { value: 3 };
 pattern[Symbol.split] = function(string, limit) {
diff --git a/test/mjsunit/es6/symbols.js b/test/mjsunit/es6/symbols.js
index 9bac41f..a21afb3 100644
--- a/test/mjsunit/es6/symbols.js
+++ b/test/mjsunit/es6/symbols.js
@@ -555,7 +555,9 @@
 
 function TestStringify(expected, input) {
   assertEquals(expected, JSON.stringify(input));
-  assertEquals(expected, JSON.stringify(input, null, 0));
+  assertEquals(expected, JSON.stringify(input, (key, value) => value));
+  assertEquals(JSON.stringify(input, null, "="),
+               JSON.stringify(input, (key, value) => value, "="));
 }
 
 TestStringify(undefined, Symbol("a"));
diff --git a/test/mjsunit/es6/tail-call-megatest.js b/test/mjsunit/es6/tail-call-megatest.js
index 1de8ec6..3d2ecb8 100644
--- a/test/mjsunit/es6/tail-call-megatest.js
+++ b/test/mjsunit/es6/tail-call-megatest.js
@@ -10,6 +10,7 @@
   return error.message + "\n    at " + stack.join("\n    at ");
 }
 
+var verbose = typeof(arguments) !== "undefined" && arguments.indexOf("-v") >= 0;
 
 function checkStackTrace(expected) {
   var e = new Error();
@@ -340,32 +341,32 @@
     return source;
   }
 
-  var f_args_variants = ["", "1", "1, 2"];
-  var g_args_variants = ["", "10", "10, 20"];
+  var f_args_variants = [/*"", "1",*/ "1, 2"];
+  var g_args_variants = [/*"", "10",*/ "10, 20"];
   var f_inlinable_variants = [true, false];
   var g_inlinable_variants = [true, false];
   // This is to avoid bailing out because of referencing new.target.
-  var check_new_target_variants = [true, false];
+  var check_new_target_variants = [/*true,*/ false];
   var deopt_mode_variants = ["none", "f", "g", "test"];
   var f_variants = [
       f_cfg_sloppy,
       f_cfg_strict,
       f_cfg_bound,
       f_cfg_proxy,
-      f_cfg_possibly_eval,
+//      f_cfg_possibly_eval,
   ];
   var g_variants = [
       g_cfg_normal,
-      g_cfg_reflect_apply,
+//      g_cfg_reflect_apply,
       g_cfg_function_apply,
-      g_cfg_function_apply_arguments_object,
+//      g_cfg_function_apply_arguments_object,
       g_cfg_function_call,
   ];
   var test_warmup_counts = [0, 1, 2];
 
   var iter = 0;
   var tests_executed = 0;
-  if (shard !== undefined) {
+  if (verbose && shard !== undefined) {
     print("Running shard #" + shard);
   }
   f_variants.forEach((f_cfg) => {
@@ -378,7 +379,9 @@
                 g_inlinable_variants.forEach((g_inlinable) => {
                   test_warmup_counts.forEach((test_warmup_count) => {
                     if (shard !== undefined && (iter++) % SHARDS_COUNT != shard) {
-                      print("skipping...");
+                      if (verbose) {
+                        print("skipping...");
+                      }
                       return;
                     }
                     tests_executed++;
@@ -396,8 +399,10 @@
                       deopt_mode,
                     };
                     var source = test_template(cfg);
-                    print("====================");
-                    print(source);
+                    if (verbose) {
+                      // print("====================");
+                      // print(source);
+                    }
                     eval(source);
                   });
                 });
@@ -408,7 +413,9 @@
       });
     });
   });
-  print("Number of tests executed: " + tests_executed);
+  if (verbose) {
+    print("Number of tests executed: " + tests_executed);
+  }
 }
 
 // Uncomment to run all the tests at once or use shard runners.
diff --git a/test/mjsunit/es6/typedarray-set-length-internal.js b/test/mjsunit/es6/typedarray-set-length-internal.js
new file mode 100644
index 0000000..22b8f67
--- /dev/null
+++ b/test/mjsunit/es6/typedarray-set-length-internal.js
@@ -0,0 +1,35 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var typedArrayConstructors = [
+  Uint8Array,
+  Int8Array,
+  Uint16Array,
+  Int16Array,
+  Uint32Array,
+  Int32Array,
+  Uint8ClampedArray,
+  Float32Array,
+  Float64Array
+];
+
+var descriptor = { get: function() { throw new Error("accessed length"); } };
+
+for (var constructor of typedArrayConstructors) {
+  var differentConstructor =
+    constructor === Uint8Array ? Int8Array : Uint8Array;
+  var target = new constructor(16);
+  Object.defineProperty(target, "length", descriptor);
+
+  var sameBuffer = new differentConstructor(target.buffer, 0, 2);
+  Object.defineProperty(sameBuffer, "length", descriptor);
+  target.set(sameBuffer);
+
+  var differentBuffer = new differentConstructor(16);
+  Object.defineProperty(differentBuffer, "length", descriptor);
+  target.set(differentBuffer);
+
+  var array = [0, 1, 2];
+  target.set(array);
+}
diff --git a/test/mjsunit/harmony/typedarray-species.js b/test/mjsunit/es6/typedarray-species.js
similarity index 98%
rename from test/mjsunit/harmony/typedarray-species.js
rename to test/mjsunit/es6/typedarray-species.js
index 35a9ea1..020d65c 100644
--- a/test/mjsunit/harmony/typedarray-species.js
+++ b/test/mjsunit/es6/typedarray-species.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
-
 // Subclasses of %TypedArray% construct themselves under map, etc
 
 var typedArrayConstructors = [
diff --git a/test/mjsunit/harmony/unicode-character-ranges.js b/test/mjsunit/es6/unicode-character-ranges.js
similarity index 98%
rename from test/mjsunit/harmony/unicode-character-ranges.js
rename to test/mjsunit/es6/unicode-character-ranges.js
index e4f5247..f39004f 100644
--- a/test/mjsunit/harmony/unicode-character-ranges.js
+++ b/test/mjsunit/es6/unicode-character-ranges.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps --harmony-regexp-lookbehind
+// Flags: --harmony-regexp-lookbehind
 
 function execl(expectation, regexp, subject) {
   if (regexp instanceof String) regexp = new RegExp(regexp, "u");
diff --git a/test/mjsunit/harmony/unicode-escapes-in-regexps.js b/test/mjsunit/es6/unicode-escapes-in-regexps.js
similarity index 99%
rename from test/mjsunit/harmony/unicode-escapes-in-regexps.js
rename to test/mjsunit/es6/unicode-escapes-in-regexps.js
index 7ea6f62..2d2d118 100644
--- a/test/mjsunit/harmony/unicode-escapes-in-regexps.js
+++ b/test/mjsunit/es6/unicode-escapes-in-regexps.js
@@ -4,8 +4,6 @@
 
 // ES6 extends the \uxxxx escape and also allows \u{xxxxx}.
 
-// Flags: --harmony-unicode-regexps
-
 function testRegexpHelper(r) {
   assertTrue(r.test("foo"));
   assertTrue(r.test("boo"));
diff --git a/test/mjsunit/harmony/unicode-regexp-backrefs.js b/test/mjsunit/es6/unicode-regexp-backrefs.js
similarity index 96%
rename from test/mjsunit/harmony/unicode-regexp-backrefs.js
rename to test/mjsunit/es6/unicode-regexp-backrefs.js
index e02301b..56b9c5e 100644
--- a/test/mjsunit/harmony/unicode-regexp-backrefs.js
+++ b/test/mjsunit/es6/unicode-regexp-backrefs.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps --harmony-regexp-lookbehind
+// Flags: --harmony-regexp-lookbehind
 
 // Back reference does not end in the middle of a surrogate pair.
 function replace(string) {
diff --git a/test/mjsunit/harmony/unicode-regexp-ignore-case-noi18n.js b/test/mjsunit/es6/unicode-regexp-ignore-case-noi18n.js
similarity index 97%
rename from test/mjsunit/harmony/unicode-regexp-ignore-case-noi18n.js
rename to test/mjsunit/es6/unicode-regexp-ignore-case-noi18n.js
index a4cb9dc..a998942 100644
--- a/test/mjsunit/harmony/unicode-regexp-ignore-case-noi18n.js
+++ b/test/mjsunit/es6/unicode-regexp-ignore-case-noi18n.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 // Non-unicode use toUpperCase mappings.
 assertFalse(/[\u00e5]/i.test("\u212b"));
 assertFalse(/[\u212b]/i.test("\u00e5\u1234"));
diff --git a/test/mjsunit/harmony/unicode-regexp-ignore-case.js b/test/mjsunit/es6/unicode-regexp-ignore-case.js
similarity index 98%
rename from test/mjsunit/harmony/unicode-regexp-ignore-case.js
rename to test/mjsunit/es6/unicode-regexp-ignore-case.js
index 291b866..dd02ca9 100644
--- a/test/mjsunit/harmony/unicode-regexp-ignore-case.js
+++ b/test/mjsunit/es6/unicode-regexp-ignore-case.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 // Non-unicode use toUpperCase mappings.
 assertFalse(/[\u00e5]/i.test("\u212b"));
 assertFalse(/[\u212b]/i.test("\u00e5\u1234"));
diff --git a/test/mjsunit/harmony/unicode-regexp-last-index.js b/test/mjsunit/es6/unicode-regexp-last-index.js
similarity index 97%
rename from test/mjsunit/harmony/unicode-regexp-last-index.js
rename to test/mjsunit/es6/unicode-regexp-last-index.js
index 4a075d4..67fbac7 100644
--- a/test/mjsunit/harmony/unicode-regexp-last-index.js
+++ b/test/mjsunit/es6/unicode-regexp-last-index.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps --harmony-regexp-lookbehind
+// Flags: --harmony-regexp-lookbehind
 
 var r = /./ug;
 assertEquals(["\ud800\udc00"], r.exec("\ud800\udc00\ud801\udc01"));
diff --git a/test/mjsunit/harmony/unicode-regexp-restricted-syntax.js b/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
similarity index 97%
rename from test/mjsunit/harmony/unicode-regexp-restricted-syntax.js
rename to test/mjsunit/es6/unicode-regexp-restricted-syntax.js
index d129cc3..dd4fa39 100644
--- a/test/mjsunit/harmony/unicode-regexp-restricted-syntax.js
+++ b/test/mjsunit/es6/unicode-regexp-restricted-syntax.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 // test262/data/test/language/literals/regexp/u-dec-esc
 assertThrows("/\\1/u", SyntaxError);
 // test262/language/literals/regexp/u-invalid-char-range-a
diff --git a/test/mjsunit/harmony/unicode-regexp-unanchored-advance.js b/test/mjsunit/es6/unicode-regexp-unanchored-advance.js
similarity index 87%
rename from test/mjsunit/harmony/unicode-regexp-unanchored-advance.js
rename to test/mjsunit/es6/unicode-regexp-unanchored-advance.js
index 97960e1..c471122 100644
--- a/test/mjsunit/harmony/unicode-regexp-unanchored-advance.js
+++ b/test/mjsunit/es6/unicode-regexp-unanchored-advance.js
@@ -2,7 +2,5 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 var s = "a".repeat(1E7) + "\u1234";
 assertEquals(["\u1234", "\u1234"], /(\u1234)/u.exec(s));
diff --git a/test/mjsunit/harmony/unicode-regexp-zero-length.js b/test/mjsunit/es6/unicode-regexp-zero-length.js
similarity index 97%
rename from test/mjsunit/harmony/unicode-regexp-zero-length.js
rename to test/mjsunit/es6/unicode-regexp-zero-length.js
index bbc17dc..42bb2d7 100644
--- a/test/mjsunit/harmony/unicode-regexp-zero-length.js
+++ b/test/mjsunit/es6/unicode-regexp-zero-length.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 var L = "\ud800";
 var T = "\udc00";
 var x = "x";
diff --git a/test/mjsunit/es7/array-includes.js b/test/mjsunit/es7/array-includes.js
index 303042a..3981797 100644
--- a/test/mjsunit/es7/array-includes.js
+++ b/test/mjsunit/es7/array-includes.js
@@ -673,3 +673,8 @@
   assertFalse(Array.prototype.includes.call(new Uint8Array([1, 2, 3]), 4));
   assertFalse(Array.prototype.includes.call(new Uint8Array([1, 2, 3]), 2, 2));
 })();
+
+
+(function testUnscopable() {
+  assertTrue(Array.prototype[Symbol.unscopables].includes);
+})();
diff --git a/test/mjsunit/es8/syntactic-tail-call-parsing.js b/test/mjsunit/es8/syntactic-tail-call-parsing.js
index 9ceff9c..486c3e1 100644
--- a/test/mjsunit/es8/syntactic-tail-call-parsing.js
+++ b/test/mjsunit/es8/syntactic-tail-call-parsing.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax --harmony-explicit-tailcalls
-// Flags: --harmony-do-expressions
+// Flags: --harmony-do-expressions --harmony-async-await
 "use strict";
 
 var SyntaxErrorTests = [
@@ -128,7 +128,10 @@
         err: `                    ^^^^^^^^^^^^^^`,
       },
       { src: `()=>{ function* G() { yield continue foo(); } }`,
-        err: `                            ^^^^^^^^^^^^^^`,
+        err: `                                     ^^^^^`,
+      },
+      { src: `()=>{ function* G() { return continue foo(); } }`,
+        err: `                                      ^^^^^`,
       },
       { src: `()=>{ (1, 2, 3, continue f() ) => {} }`,
         err: `                ^^^^^^^^^^^^`,
@@ -235,6 +238,9 @@
       { src: `class A extends continue f () {}; }`,
         err: `                ^^^^^^^^^^^^^`,
       },
+      { src: `async() => continue foo()`,
+        err: `                    ^^^^^`,
+      },
     ],
   },
   { msg: "Tail call expression in try block",
@@ -311,7 +317,6 @@
   `()=>{ return a || continue f() ; }`,
   `()=>{ return a && continue f() ; }`,
   `()=>{ return a , continue f() ; }`,
-  `()=>{ function* G() { return continue foo(); } }`,
   `()=>{ class A { foo() { return continue super.f() ; } } }`,
   `()=>{ function B() { return continue new.target() ; } }`,
   `()=>{ return continue do { x ? foo() : bar() ; }() }`,
diff --git a/test/mjsunit/fast-prototype.js b/test/mjsunit/fast-prototype.js
index 7432ecc..aa0a62e 100644
--- a/test/mjsunit/fast-prototype.js
+++ b/test/mjsunit/fast-prototype.js
@@ -46,14 +46,20 @@
 
 
 function DoProtoMagic(proto, set__proto__) {
+  var receiver;
   if (set__proto__) {
-    (new Sub()).__proto__ = proto;
+    receiver = new Sub();
+    receiver.__proto__ = proto;
   } else {
     Sub.prototype = proto;
     // Need to instantiate Sub to mark .prototype as prototype. Make sure the
     // instantiated object is used so that the allocation is not optimized away.
-    %DebugPrint(new Sub());
+    receiver = new Sub();
   }
+  // Prototypes are made fast when ICs encounter them.
+  function ic() { return typeof receiver.foo; }
+  ic();
+  ic();
 }
 
 
diff --git a/test/mjsunit/harmony/async-await-basic.js b/test/mjsunit/harmony/async-await-basic.js
index d0888ea..ba0350f 100644
--- a/test/mjsunit/harmony/async-await-basic.js
+++ b/test/mjsunit/harmony/async-await-basic.js
@@ -343,5 +343,27 @@
 assertEquals("async x => x", (async x => x).toString());
 assertEquals("async x => { return x }", (async x => { return x }).toString());
 class AsyncMethod { async foo() { } }
-assertEquals("async foo() { }", Function.prototype.toString.call(AsyncMethod.prototype.foo));
-assertEquals("async foo() { }", Function.prototype.toString.call({async foo() { }}.foo));
+assertEquals("async foo() { }",
+             Function.prototype.toString.call(AsyncMethod.prototype.foo));
+assertEquals("async foo() { }",
+             Function.prototype.toString.call({async foo() { }}.foo));
+
+// Async functions are not constructible
+assertThrows(() => class extends (async function() {}) {}, TypeError);
+
+// Regress v8:5148
+assertEqualsAsync("1", () => (async({ a = NaN }) => a)({ a: "1" }));
+assertEqualsAsync(
+    "10", () => (async(foo, { a = NaN }) => foo + a)("1", { a: "0" }));
+assertEqualsAsync("2", () => (async({ a = "2" }) => a)({ a: undefined }));
+assertEqualsAsync(
+    "20", () => (async(foo, { a = "0" }) => foo + a)("2", { a: undefined }));
+assertThrows(() => eval("async({ foo = 1 })"), SyntaxError);
+assertThrows(() => eval("async(a, { foo = 1 })"), SyntaxError);
+
+// https://bugs.chromium.org/p/chromium/issues/detail?id=638019
+async function gaga() {
+  let i = 1;
+  while (i-- > 0) { await 42 }
+}
+assertDoesNotThrow(gaga);
diff --git a/test/mjsunit/harmony/async-debug-basic.js b/test/mjsunit/harmony/async-debug-basic.js
new file mode 100644
index 0000000..a490972
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-basic.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags:  --harmony-async-await --allow-natives-syntax --expose-debug-as debug
+
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+listenerComplete = false;
+breakPointCount = 0;
+
+async function f() {
+  await (async function() { var a = "a"; await 1; debugger; })();
+
+  var b = "b";
+
+  assertTrue(listenerDone);
+  assertFalse(exception);
+  assertEquals(1, breakpointCount);
+}
+
+function listener(event, exec_state, event_data, data) {
+  try {
+    if (event != Debug.DebugEvent.Break) return;
+
+    breakpointCount++;
+    listenerDone = true;
+    assertEquals("a", exec_state.frame(0).evaluate("a"));
+    assertEquals("b", exec_state.frame(1).evaluate("b"));
+    assertEquals("c", exec_state.frame(2).evaluate("c"));
+  } catch (e) {
+    exception = e;
+  };
+};
+
+Debug.setListener(listener);
+
+var c = "c";
+f();
diff --git a/test/mjsunit/harmony/async-debug-step-abort-at-break.js b/test/mjsunit/harmony/async-debug-step-abort-at-break.js
new file mode 100644
index 0000000..be1f805
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-abort-at-break.js
@@ -0,0 +1,55 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise( // B3 StepOut
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f() {
+  var a = 1;
+  debugger;          // B0 StepNext
+  a +=               // B1 StepNext
+       await         // B4 StepNext
+             g();    // B2 StepIn
+  return a;
+}
+
+f();
+
+// Starting a new step action at an intermediate break point
+// means that we will abort the current async step.
+debugger;            // B5 StepNext
+
+late_resolve(3);     // B6 Continue
+
+%RunMicrotasks();
+
+assertEquals(7, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-continue-at-break.js b/test/mjsunit/harmony/async-debug-step-continue-at-break.js
new file mode 100644
index 0000000..5099b2f
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-continue-at-break.js
@@ -0,0 +1,55 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise( // B3 StepOut
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f() {
+  var a = 1;
+  debugger;          // B0 StepNext
+  a +=               // B1 StepNext
+       await         // B4 StepNext
+             g();    // B2 StepIn
+  return a;          // B6 StepNext
+}                    // B7 Continue
+
+f();
+
+// Continuing at an intermediate break point means that we will
+// carry on with the current async step.
+debugger;            // B5 Continue
+
+late_resolve(3);
+
+%RunMicrotasks();
+
+assertEquals(8, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-in-and-out.js b/test/mjsunit/harmony/async-debug-step-in-and-out.js
new file mode 100644
index 0000000..30fe2d6
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-in-and-out.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise(  // B3 StepOut
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f() {
+  var a = 1;
+  debugger;            // B0 StepNext
+  a +=                 // B1 StepNext
+       await           // B4 StepNext
+             g();      // B2 StepIn
+  return a;            // B5 StepNext
+}                      // B6 Continue
+
+f();
+
+late_resolve(3);
+
+%RunMicrotasks();
+
+assertEquals(7, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-in-out-out.js b/test/mjsunit/harmony/async-debug-step-in-out-out.js
new file mode 100644
index 0000000..c2f34bb
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-in-out-out.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise( // B3 StepOut
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f() {
+  var a = 1;
+  debugger;        // B0 StepNext
+  a +=             // B1 StepNext
+       await       // B4 StepOut
+             g();  // B2 StepIn
+  return a;
+}
+
+f();
+
+late_resolve(3);   // B5 Continue
+
+%RunMicrotasks();
+
+assertEquals(6, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-in.js b/test/mjsunit/harmony/async-debug-step-in.js
new file mode 100644
index 0000000..0a7de1a
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-in.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise(  // B3 StepIn
+    function(res, rej) {
+      late_resolve = res;  // B4 StepIn
+    }                      // B5 StepIn
+  );
+}                      // B6 StepIn
+
+async function f() {
+  var a = 1;
+  debugger;            // B0 StepNext
+  a +=                 // B1 StepIn
+       await           // B7 StepIn
+             g();      // B2 StepIn
+  return a;            // B8 StepIn
+}                      // B9 Continue
+
+f().then(value => assertEquals(4, value));
+
+late_resolve(3);
+
+%RunMicrotasks();
+
+assertEquals(10, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-nested.js b/test/mjsunit/harmony/async-debug-step-nested.js
new file mode 100644
index 0000000..adf7a51
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-nested.js
@@ -0,0 +1,58 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise( // B4 StepOut
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f1() {
+  var a = 1;
+  debugger;          // B0 StepNext
+  a +=               // B1 StepNext
+       await         // B6 StepNext
+             f2();   // B2 StepIn
+  return a;          // B7 StepNext
+}                    // B8 Continue
+
+async function f2() {
+  var b =
+          await      // B5 StepOut
+                g(); // B3 StepIn
+  return b;
+}
+
+f1();
+
+late_resolve(3);
+
+%RunMicrotasks();
+
+assertEquals(9, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-next-constant.js b/test/mjsunit/harmony/async-debug-step-next-constant.js
new file mode 100644
index 0000000..cea86d7
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-next-constant.js
@@ -0,0 +1,39 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+async function f() {
+  var a = 1;
+  debugger;          // B0 StepNext
+  a +=               // B1 StepNext
+       await         // B3 StepNext
+             5;      // B2 StepNext
+  return a;          // B4 StepNext
+}                    // B5 Continue
+
+f();
+
+%RunMicrotasks();
+
+assertEquals(6, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-next.js b/test/mjsunit/harmony/async-debug-step-next.js
new file mode 100644
index 0000000..952d88d
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-next.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise(
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f() {
+  var a = 1;
+  debugger;        // B0 StepNext
+  a +=             // B1 StepNext
+       await       // B3 StepNext
+             g();  // B2 StepNext
+  return a;        // B4 StepNext
+}                  // B5 Continue
+
+f();
+
+late_resolve(3);
+
+%RunMicrotasks();
+
+assertEquals(6, step_count);
diff --git a/test/mjsunit/harmony/async-debug-step-out.js b/test/mjsunit/harmony/async-debug-step-out.js
new file mode 100644
index 0000000..41779ac
--- /dev/null
+++ b/test/mjsunit/harmony/async-debug-step-out.js
@@ -0,0 +1,49 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --harmony-async-await
+
+var Debug = debug.Debug;
+var step_count = 0;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var line = execState.frame(0).sourceLineText();
+    print(line);
+    var [match, expected_count, step] = /\/\/ B(\d) (\w+)$/.exec(line);
+    assertEquals(step_count++, parseInt(expected_count));
+    if (step != "Continue") execState.prepareStep(Debug.StepAction[step]);
+  } catch (e) {
+    print(e, e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var late_resolve;
+
+function g() {
+  return new Promise(
+    function(res, rej) {
+      late_resolve = res;
+    }
+  );
+}
+
+async function f() {
+  var a = 1;
+  debugger;        // B0 StepNext
+  a += await g();  // B1 StepOut
+  return a;
+}
+
+f();
+
+late_resolve(3);   // B2 Continue
+
+%RunMicrotasks();
+
+assertEquals(3, step_count);
diff --git a/test/mjsunit/harmony/async-function-debug-evaluate.js b/test/mjsunit/harmony/async-function-debug-evaluate.js
new file mode 100644
index 0000000..edf7bca
--- /dev/null
+++ b/test/mjsunit/harmony/async-function-debug-evaluate.js
@@ -0,0 +1,139 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await --expose-debug-as debug
+
+var Debug = debug.Debug;
+var breakPointCount = 0;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  ++breakPointCount;
+  try {
+    if (breakPointCount === 1) {
+      assertEquals(
+          "inner", exec_state.frame(0).evaluate("inner").value());
+      assertThrows(() => exec_state.frame(0).evaluate("letInner").value(),
+                   ReferenceError);
+      assertThrows(() => exec_state.frame(0).evaluate("constInner").value(),
+                   ReferenceError);
+
+      assertEquals("outer", exec_state.frame(0).evaluate("outer").value());
+      assertEquals(
+          "const outer", exec_state.frame(0).evaluate("constOuter").value());
+      assertEquals(
+          "let outer", exec_state.frame(0).evaluate("letOuter").value());
+
+      assertEquals("outer", exec_state.frame(1).evaluate("outer").value());
+      assertEquals(
+          "const outer", exec_state.frame(1).evaluate("constOuter").value());
+      assertEquals(
+          "let outer", exec_state.frame(1).evaluate("letOuter").value());
+
+      assertThrows(() => exec_state.frame(0).evaluate("withVar").value(),
+                   ReferenceError);
+
+    } else if (breakPointCount === 2) {
+      assertEquals(
+          "inner", exec_state.frame(0).evaluate("inner").value());
+      assertThrows(() => exec_state.frame(0).evaluate("letInner").value(),
+                   ReferenceError);
+      assertThrows(() => exec_state.frame(0).evaluate("constInner").value(),
+                   ReferenceError);
+
+      assertEquals(57, exec_state.frame(0).evaluate("x").value());
+      assertEquals(100, exec_state.frame(0).evaluate("y").value());
+
+      // From breakPointCount === 1 and later, it's not possible to access
+      // earlier framestates.
+      assertEquals("outer", exec_state.frame(0).evaluate("outer").value());
+      assertEquals(
+          "const outer", exec_state.frame(0).evaluate("constOuter").value());
+      assertEquals(
+          "let outer", exec_state.frame(0).evaluate("letOuter").value());
+
+      exec_state.frame(0).evaluate("x = `x later(${x})`");
+      exec_state.frame(0).evaluate("y = `y later(${y})`");
+      exec_state.frame(0).evaluate("z = `ZEE`");
+
+    } else if (breakPointCount === 3) {
+      assertEquals(
+          "inner", exec_state.frame(0).evaluate("inner").value());
+      assertEquals(
+          "let inner", exec_state.frame(0).evaluate("letInner").value());
+      assertEquals(
+          "const inner", exec_state.frame(0).evaluate("constInner").value());
+
+    } else if (breakPointCount === 4) {
+      assertEquals(
+          "oop", exec_state.frame(0).evaluate("error.message").value());
+      assertEquals(
+          "Error",
+          exec_state.frame(0).evaluate("error.constructor.name").value());
+      assertEquals("floof", exec_state.frame(0).evaluate("bun").value());
+      assertThrows(() => exec_state.frame(0).evaluate("cow").value(),
+                   ReferenceError);
+
+      assertEquals("outer", exec_state.frame(0).evaluate("outer").value());
+      assertEquals(
+          "const outer", exec_state.frame(0).evaluate("constOuter").value());
+      assertEquals(
+          "let outer", exec_state.frame(0).evaluate("letOuter").value());
+    }
+  } catch (e) {
+    print(e.stack);
+    quit(1);
+  }
+}
+
+Debug.setListener(listener);
+
+var outer = "outer";
+const constOuter = "const outer";
+let letOuter = "let outer"
+
+async function thrower() {
+  return Promise.reject(new Error("oop"));
+}
+
+async function testLater() {
+  return { x: 57, y: 100 };
+}
+
+async function test() {
+  var inner = "inner";
+  debugger;
+
+  let withVar = await testLater();
+  with (withVar) {
+    debugger;
+  }
+
+  assertEquals("x later(57)", withVar.x);
+  assertEquals("y later(100)", withVar.y);
+  assertEquals(undefined, withVar.z);
+  assertEquals("ZEE", z);
+
+  let letInner = "let inner";
+  const constInner = "const inner";
+  debugger;
+
+  try {
+    await thrower();
+  } catch (error) {
+    const bun = "floof";
+    debugger;
+    let cow = "moo";
+  }
+}
+
+test().
+then(x => {
+  Debug.setListener(null);
+}).
+catch(error => {
+  print(error.stack);
+  quit(1);
+  Debug.setListener(null);
+});
diff --git a/test/mjsunit/harmony/async-function-debug-scopes.js b/test/mjsunit/harmony/async-function-debug-scopes.js
new file mode 100644
index 0000000..3d72549
--- /dev/null
+++ b/test/mjsunit/harmony/async-function-debug-scopes.js
@@ -0,0 +1,616 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await --expose-debug-as debug
+
+var Debug = debug.Debug;
+
+var AsyncFunction = (async function() {}).constructor;
+
+async function thrower() { throw 'Exception'; }
+
+async function test(name, func, args, handler, continuation) {
+  var handler_called = false;
+  var exception = null;
+
+  function listener(event, exec_state, event_data, data) {
+    try {
+      if (event == Debug.DebugEvent.Break) {
+        handler_called = true;
+        handler(exec_state);
+      }
+    } catch (e) {
+      exception = e;
+    }
+  }
+
+  Debug.setListener(listener);
+
+  var result;
+  if (typeof func === "object")
+    result = await func.method.apply(func, args);
+  else
+    result = await func.apply(null, args);
+
+  if (typeof continuation === "function") {
+    await continuation(result);
+  }
+
+  assertTrue(handler_called, `Expected ${name} handler to be called`);
+  if (exception) {
+    exception.message = `${name} / ${exception.message}`;
+    print(exception.stack);
+    quit(1);
+  }
+
+  Debug.setListener(null);
+}
+
+async function runTests() {
+
+// Simple
+await test(
+    "(AsyncFunctionExpression) Local 1",
+    async function() { debugger; }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 1 --- resume normal",
+    async function() { let z = await 2; debugger; }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({z: 2}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 1 --- resume throw",
+    async function() { let q = await 1;
+                       try { let z = await thrower(); }
+                       catch (e) { debugger; } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e: 'Exception'}, 0, exec_state);
+      CheckScopeContent({q: 1}, 1, exec_state);
+
+    });
+
+// Simple With Parameter
+await test(
+    "(AsyncFunctionExpression) Local 2",
+    async function(a) { debugger; }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ a: 1 }, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 2 --- resume normal",
+    async function(a) { let z = await 2; debugger; }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ a: 1, z: 2 }, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 2 --- resume throw",
+    async function(a) { let z = await 2;
+                        try { await thrower(); } catch (e) { debugger; } }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ e: 'Exception' }, 0, exec_state);
+      CheckScopeContent({ a: 1, z: 2 }, 1, exec_state);
+    });
+
+// Simple With Parameter and Variable
+await test(
+    "(AsyncFunctionExpression) Local 3",
+    async function(a) { var b = 2; debugger; }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ a: 1, b: 2 }, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 3 --- resume normal",
+    async function(a) { let y = await 3; var b = 2; let z = await 4;
+                        debugger; }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ a: 1, b: 2, y: 3, z: 4 }, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 3 --- resume throw",
+    async function(a) { let y = await 3;
+                        try { var b = 2; let z = await thrower(); }
+                        catch (e) { debugger; } }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ e: 'Exception' }, 0, exec_state);
+      CheckScopeContent({ a: 1, b: 2, y: 3 }, 1, exec_state);
+    });
+
+// Local scope with parameters and local variables.
+await test(
+    "(AsyncFunctionExpression) Local 4",
+    async function(a, b) { var x = 3; var y = 4; debugger; }, [1, 2],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({a:1,b:2,x:3,y:4}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 4 --- resume normal",
+    async function(a, b) { let q = await 5; var x = 3; var y = 4;
+                           let r = await 6; debugger; }, [1, 2],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({a:1,b:2,x:3,y:4, q: 5, r: 6}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 4 --- resume throw",
+    async function(a, b) { let q = await 5; var x = 3; var y = 4;
+                           try { let r = await thrower(); }
+                           catch (e) { debugger; } }, [1, 2],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e: 'Exception'}, 0, exec_state);
+      CheckScopeContent({a:1,b:2,x:3,y:4, q: 5}, 1, exec_state);
+    });
+
+// Empty local scope with use of eval.
+await test(
+    "(AsyncFunctionExpression) Local 5",
+    async function() { eval(""); debugger; }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 5 --- resume normal",
+    async function() { let x = await 1; eval(""); let y = await 2;
+                       debugger; }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ x: 1, y: 2 }, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 5 --- resume throw",
+    async function() { let x = await 1; eval("");
+                       try { let y = await thrower(); }
+                       catch (e) { debugger; } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ e: 'Exception' }, 0, exec_state);
+      CheckScopeContent({ x: 1 }, 1, exec_state);
+    });
+
+// Local introducing local variable using eval.
+await test(
+    "(AsyncFunctionExpression) Local 6",
+    async function() { eval("var i = 5"); debugger; }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({i:5}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 6 --- resume normal",
+    async function() { let x = await 1; eval("var i = 5"); let y = await 2;
+                       debugger; }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({i:5, x: 1, y: 2}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 6 --- resume throw",
+    async function() { let x = await 1; eval("var i = 5");
+                       try { let y = await thrower(); }
+                       catch (e) { debugger; } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e: 'Exception' }, 0, exec_state);
+      CheckScopeContent({i:5, x: 1}, 1, exec_state);
+    });
+
+// Local scope with parameters, local variables and local variable introduced
+// using eval.
+await test(
+    "(AsyncFunctionExpression) Local 7",
+    async function(a, b) { var x = 3; var y = 4;
+                           eval("var i = 5;"); eval("var j = 6");
+                           debugger; }, [1, 2],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({a:1,b:2,x:3,y:4,i:5,j:6}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 7 --- resume normal",
+    async function(a, b) { let z = await 7; var x = 3; var y = 4;
+                           eval("var i = 5;"); eval("var j = 6");
+                           let q = await 8;
+                           debugger; }, [1, 2],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({a:1,b:2,x:3,y:4,i:5,j:6, z:7, q:8}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Local 7 --- resume throw",
+    async function(a, b) { let z = await 7; var x = 3; var y = 4;
+                           eval("var i = 5;"); eval("var j = 6");
+                           try { let q = await thrower(); }
+                           catch (e) { debugger; } }, [1, 2],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e: 'Exception'}, 0, exec_state);
+      //CheckScopeContent({a:1,b:2,x:3,y:4,i:5,j:6, z:7}, 1, exec_state);
+    });
+
+// Nested empty with blocks.
+await test(
+    "(AsyncFunctionExpression) With",
+    async function() { with ({}) { with ({}) { debugger; } } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.With,
+                       debug.ScopeType.With,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({}, 0, exec_state);
+      CheckScopeContent({}, 1, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) With --- resume normal",
+    async function() { let x = await 1; with ({}) { with ({}) {
+                       let y = await 2; debugger; } } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Block,
+                       debug.ScopeType.With,
+                       debug.ScopeType.With,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({y:2}, 0, exec_state);
+      CheckScopeContent({}, 1, exec_state);
+      CheckScopeContent({}, 2, exec_state);
+      CheckScopeContent({x:1}, 3, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) With --- resume throw",
+    async function() { let x = await 1; with ({}) { with ({}) {
+                       try { let y = await thrower(); }
+                       catch (e) { debugger; } } } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.With,
+                       debug.ScopeType.With,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({ e: 'Exception'}, 0, exec_state);
+      CheckScopeContent({}, 1, exec_state);
+      CheckScopeContent({}, 2, exec_state);
+      CheckScopeContent({x:1}, 3, exec_state);
+    });
+
+// Simple closure formed by returning an inner function referering the outer
+// functions arguments.
+await test(
+    "(AsyncFunctionExpression) Closure 1",
+    async function(a) { return function() { debugger; return a; } }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({a:1}, 1, exec_state);
+    },
+    result => result());
+
+await test(
+    "(AsyncFunctionExpression) Closure 1 --- resume normal",
+    async function(a) { let x = await 2;
+                        return function() { debugger; return a; } }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({a:1, x: 2}, 1, exec_state);
+    },
+    result => result());
+
+await test(
+    "(AsyncFunctionExpression) Closure 1 --- resume throw",
+    async function(a) { let x = await 2;
+                        return async function() {
+                            try { await thrower(); }
+                            catch (e) { debugger; } return a; }; }, [1],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e: 'Exception'}, 0, exec_state);
+      CheckScopeContent({a:1, x: 2}, 2, exec_state);
+    },
+    result => result());
+
+await test(
+    "(AsyncFunctionExpression) Catch block 1",
+    async function() { try { throw 'Exception'; } catch (e) { debugger; } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e:'Exception'}, 0, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Catch block 1 --- resume normal",
+    async function() {
+      let x = await 1;
+      try { throw 'Exception'; } catch (e) { let y = await 2; debugger; } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Block,
+                       debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({y: 2}, 0, exec_state);
+      CheckScopeContent({e:'Exception'}, 1, exec_state);
+      CheckScopeContent({x: 1}, 2, exec_state);
+    });
+
+await test(
+    "(AsyncFunctionExpression) Catch block 1 --- resume throw",
+    async function() {
+      let x = await 1;
+      try { throw 'Exception!'; } catch (e) {
+        try { let y = await thrower(); } catch (e) { debugger; } } }, [],
+    exec_state => {
+      CheckScopeChain([debug.ScopeType.Catch,
+                       debug.ScopeType.Catch,
+                       debug.ScopeType.Local,
+                       debug.ScopeType.Closure,
+                       debug.ScopeType.Script,
+                       debug.ScopeType.Global], exec_state);
+      CheckScopeContent({e:'Exception'}, 0, exec_state);
+      CheckScopeContent({e:'Exception!'}, 1, exec_state);
+      CheckScopeContent({x: 1}, 2, exec_state);
+    });
+}
+
+runTests().catch(error => {
+  print(error.stack);
+  quit(1);
+})
+
+// Check that two scope are the same.
+function assertScopeMirrorEquals(scope1, scope2) {
+  assertEquals(scope1.scopeType(), scope2.scopeType());
+  assertEquals(scope1.frameIndex(), scope2.frameIndex());
+  assertEquals(scope1.scopeIndex(), scope2.scopeIndex());
+  assertPropertiesEqual(
+      scope1.scopeObject().value(), scope2.scopeObject().value());
+}
+
+function CheckFastAllScopes(scopes, exec_state) {
+  var fast_all_scopes = exec_state.frame().allScopes(true);
+  var length = fast_all_scopes.length;
+  assertTrue(scopes.length >= length);
+  for (var i = 0; i < scopes.length && i < length; i++) {
+    var scope = fast_all_scopes[length - i - 1];
+    assertTrue(scope.isScope());
+    assertEquals(scopes[scopes.length - i - 1], scope.scopeType());
+  }
+}
+
+// Check that the scope chain contains the expected types of scopes.
+function CheckScopeChain(scopes, exec_state) {
+  var all_scopes = exec_state.frame().allScopes();
+  assertEquals(
+      scopes.length, all_scopes.length, "FrameMirror.allScopes length");
+  for (var i = 0; i < scopes.length; i++) {
+    var scope = exec_state.frame().scope(i);
+    assertTrue(scope.isScope());
+    assertEquals(scopes[i], scope.scopeType());
+    assertScopeMirrorEquals(all_scopes[i], scope);
+
+    // Check the global object when hitting the global scope.
+    if (scopes[i] == debug.ScopeType.Global) {
+      // Objects don't have same class (one is "global", other is "Object",
+      // so just check the properties directly.
+      assertPropertiesEqual(this, scope.scopeObject().value());
+    }
+  }
+  CheckFastAllScopes(scopes, exec_state);
+
+  // Get the debug command processor.
+  var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
+
+  // Send a scopes request and check the result.
+  var json;
+  var request_json = '{"seq":0,"type":"request","command":"scopes"}';
+  var response_json = dcp.processDebugJSONRequest(request_json);
+  var response = JSON.parse(response_json);
+  assertEquals(scopes.length, response.body.scopes.length);
+  for (var i = 0; i < scopes.length; i++) {
+    var scopeRef = response.body.scopes[i].object.ref;
+    assertEquals(i, response.body.scopes[i].index);
+    assertEquals(scopes[i], response.body.scopes[i].type);
+    if (scopes[i] == debug.ScopeType.Local ||
+        scopes[i] == debug.ScopeType.Script ||
+        scopes[i] == debug.ScopeType.Closure) {
+      assertTrue(response.body.scopes[i].object.ref < 0);
+    } else {
+      assertTrue(response.body.scopes[i].object.ref >= 0);
+    }
+    var found = false;
+    for (var j = 0; j < response.refs.length && !found; j++) {
+      found = response.refs[j].handle == response.body.scopes[i].object.ref;
+    }
+    assertTrue(found, `Scope object ${scopeRef} not found`);
+  }
+}
+
+// Check that the content of the scope is as expected. For functions just check
+// that there is a function.
+function CheckScopeContent(content, number, exec_state) {
+  var scope = exec_state.frame().scope(number);
+  var count = 0;
+  for (var p in content) {
+    var property_mirror = scope.scopeObject().property(p);
+    assertFalse(property_mirror.isUndefined(),
+                `property ${p} not found in scope`);
+    if (typeof(content[p]) === 'function') {
+      assertTrue(property_mirror.value().isFunction());
+    } else {
+      assertEquals(content[p], property_mirror.value().value(),
+                   `property ${p} has unexpected value`);
+    }
+    count++;
+  }
+
+  // 'arguments' and might be exposed in the local and closure scope. Just
+  // ignore this.
+  var scope_size = scope.scopeObject().properties().length;
+  if (!scope.scopeObject().property('arguments').isUndefined()) {
+    scope_size--;
+  }
+  // Skip property with empty name.
+  if (!scope.scopeObject().property('').isUndefined()) {
+    scope_size--;
+  }
+
+  if (count != scope_size) {
+    print('Names found in scope:');
+    var names = scope.scopeObject().propertyNames();
+    for (var i = 0; i < names.length; i++) {
+      print(names[i]);
+    }
+  }
+  assertEquals(count, scope_size);
+
+  // Get the debug command processor.
+  var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
+
+  // Send a scope request for information on a single scope and check the
+  // result.
+  var request_json = `{
+    "seq": 0,
+    "type": "request",
+    "command": "scope",
+    "arguments": {
+      "number": `;
+  request_json += scope.scopeIndex();
+  request_json += '}}';
+  var response_json = dcp.processDebugJSONRequest(request_json);
+  var response = JSON.parse(response_json);
+  assertEquals(scope.scopeType(), response.body.type);
+  assertEquals(number, response.body.index);
+  if (scope.scopeType() == debug.ScopeType.Local ||
+      scope.scopeType() == debug.ScopeType.Script ||
+      scope.scopeType() == debug.ScopeType.Closure) {
+    assertTrue(response.body.object.ref < 0);
+  } else {
+    assertTrue(response.body.object.ref >= 0);
+  }
+  var found = false;
+  for (var i = 0; i < response.refs.length && !found; i++) {
+    found = response.refs[i].handle == response.body.object.ref;
+  }
+  assertTrue(found, "Scope object " + response.body.object.ref + " not found");
+}
diff --git a/test/mjsunit/harmony/async-function-stacktrace.js b/test/mjsunit/harmony/async-function-stacktrace.js
new file mode 100644
index 0000000..50df44d
--- /dev/null
+++ b/test/mjsunit/harmony/async-function-stacktrace.js
@@ -0,0 +1,115 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await
+
+async function test(func, funcs) {
+  try {
+    await func();
+    throw new Error("Expected " + func.toString() + " to throw");
+  } catch (e) {
+    var stack = e.stack.split('\n').
+        slice(1).
+        map(line => line.trim()).
+        map(line => line.match(/at (?:(.*) )?.*$/)[1]).
+        filter(x => typeof x === 'string' && x.length);
+
+    assertEquals(funcs, stack, `Unexpected stack trace ${e.stack}`);
+  }
+}
+
+function thrower() { throw new Error("NOPE"); }
+function reject() { return Promise.reject(new Error("NOPE")); }
+
+async function runTests() {
+  await test(async function a() {
+    throw new Error("FAIL");
+  },
+  ["a", "test", "runTests"]);
+
+  await test(async function a2() {
+    await 1;
+    throw new Error("FAIL");
+  }, ["a2"]);
+
+  await test(async function a3() {
+    await 1;
+    try { await thrower(); } catch (e) { throw new Error("FAIL"); }
+  }, ["a3"]);
+
+  await test(async function a4() {
+    await 1;
+    try { await reject(); } catch (e) { throw new Error("FAIL"); }
+  }, ["a4"]);
+
+  await test({ async b() {
+    throw new Error("FAIL");
+  }}.b,
+  ["b", "test", "runTests"]);
+
+  await test({ async b2() {
+    await 1;
+    throw new Error("FAIL");
+  }}.b2, ["b2"]);
+
+  await test({ async b3() {
+    await 1;
+    try { await thrower(); } catch (e) { throw new Error("FAIL"); }
+  } }.b3, ["b3"]);
+
+  await test({ async b4() {
+    await 1;
+    try { await reject(); } catch (e) { throw new Error("FAIL"); }
+  } }.b4, ["b4"]);
+
+  await test((new class { async c() {
+    throw new Error("FAIL");
+  } }).c,
+  ["c", "test", "runTests"]);
+
+  await test((new class { async c2() {
+    await 1;
+    throw new Error("FAIL");
+  } }).c2, ["c2"]);
+
+  await test((new class { async c3() {
+    await 1;
+    try { await thrower(); } catch (e) { throw new Error("FAIL"); }
+  } }).c3, ["c3"]);
+
+  await test((new class { async c4() {
+    await 1;
+    try { await reject(); } catch (e) { throw new Error("FAIL"); }
+  } }).c4, ["c4"]);
+
+  // TODO(caitp): `async` probably shouldn't be the inferred name for async
+  // arrow functions...
+  await test(async() => { throw new Error("FAIL") },
+  ["async", "test", "runTests"]);
+
+  await test(async() => { await 1; throw new Error("FAIL") }, ["async"]);
+
+  await test(async() => {
+    await 1;
+    try {
+      await thrower();
+    } catch (e) {
+      throw new Error("FAIL");
+    }
+  }, ["e"]); // TODO(caitp): FuncNameInferer is doing some weird stuff...
+
+  await test(async() => {
+    await 1;
+    try {
+      await reject();
+    } catch (e) {
+      throw new Error("FAIL");
+    }
+  }, ["e"]);
+}
+
+runTests().catch(e => {
+  print(e);
+  quit(1);
+});
diff --git a/test/mjsunit/harmony/debug-async-break-on-stack.js b/test/mjsunit/harmony/debug-async-break-on-stack.js
new file mode 100644
index 0000000..d3d9d8b
--- /dev/null
+++ b/test/mjsunit/harmony/debug-async-break-on-stack.js
@@ -0,0 +1,78 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+// Flags: --harmony-async-await --allow-natives-syntax
+
+var Debug = debug.Debug;
+
+function assertEqualsAsync(expected, run, msg) {
+  var actual;
+  var hadValue = false;
+  var hadError = false;
+  var promise = run();
+
+  if (typeof promise !== "object" || typeof promise.then !== "function") {
+    throw new MjsUnitAssertionError(
+        "Expected " + run.toString() +
+        " to return a Promise, but it returned " + promise);
+  }
+
+  promise.then(function(value) { hadValue = true; actual = value; },
+               function(error) { hadError = true; actual = error; });
+
+  assertFalse(hadValue || hadError);
+
+  %RunMicrotasks();
+
+  if (hadError) throw actual;
+
+  assertTrue(
+      hadValue, "Expected '" + run.toString() + "' to produce a value");
+
+  assertEquals(expected, actual, msg);
+}
+
+var break_count = 0;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    break_count++;
+    var line = exec_state.frame(0).sourceLineText();
+    print(line);
+    assertTrue(line.indexOf(`B${break_count}`) > 0);
+  } catch (e) {
+    exception = e;
+  }
+}
+
+
+async function g() {
+  setbreaks();
+  throw 1;  // B1
+}
+
+async function f() {
+  try {
+    await g();
+  } catch (e) {}
+  return 2;  // B2
+}
+
+function setbreaks() {
+  Debug.setListener(listener);
+  Debug.setBreakPoint(g, 2);
+  Debug.setBreakPoint(f, 4);
+}
+
+f();
+
+%RunMicrotasks();
+
+assertEqualsAsync(2, async () => break_count);
+assertEqualsAsync(null, async () => exception);
+
+Debug.setListener(null);
diff --git a/test/mjsunit/harmony/debug-async-break.js b/test/mjsunit/harmony/debug-async-break.js
new file mode 100644
index 0000000..3b6b71b
--- /dev/null
+++ b/test/mjsunit/harmony/debug-async-break.js
@@ -0,0 +1,76 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+// Flags: --harmony-async-await --allow-natives-syntax
+
+var Debug = debug.Debug;
+
+function assertEqualsAsync(expected, run, msg) {
+  var actual;
+  var hadValue = false;
+  var hadError = false;
+  var promise = run();
+
+  if (typeof promise !== "object" || typeof promise.then !== "function") {
+    throw new MjsUnitAssertionError(
+        "Expected " + run.toString() +
+        " to return a Promise, but it returned " + promise);
+  }
+
+  promise.then(function(value) { hadValue = true; actual = value; },
+               function(error) { hadError = true; actual = error; });
+
+  assertFalse(hadValue || hadError);
+
+  %RunMicrotasks();
+
+  if (hadError) throw actual;
+
+  assertTrue(
+      hadValue, "Expected '" + run.toString() + "' to produce a value");
+
+  assertEquals(expected, actual, msg);
+}
+
+var break_count = 0;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    break_count++;
+    var line = exec_state.frame(0).sourceLineText();
+    assertTrue(line.indexOf(`B${break_count}`) > 0);
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+async function g() {
+  throw 1;
+}
+
+async function f() {
+  try {
+    await g();                   // B1
+  } catch (e) {}
+  assertEquals(2, break_count);  // B2
+  return 1;                      // B3
+}
+
+Debug.setBreakPoint(f, 2);
+Debug.setBreakPoint(f, 4);
+Debug.setBreakPoint(f, 5);
+
+f();
+
+%RunMicrotasks();
+
+assertEqualsAsync(3, async () => break_count);
+assertEqualsAsync(null, async () => exception);
+
+Debug.setListener(null);
diff --git a/test/mjsunit/harmony/debug-async-function-async-task-event.js b/test/mjsunit/harmony/debug-async-function-async-task-event.js
new file mode 100644
index 0000000..249f02f
--- /dev/null
+++ b/test/mjsunit/harmony/debug-async-function-async-task-event.js
@@ -0,0 +1,70 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await --expose-debug-as debug --allow-natives-syntax
+
+Debug = debug.Debug;
+
+var base_id = -1;
+var exception = null;
+var expected = [
+  "enqueue #1",
+  "willHandle #1",
+  "then #1",
+  "enqueue #2",
+  "enqueue #3",
+  "didHandle #1",
+  "willHandle #2",
+  "then #2",
+  "didHandle #2",
+  "willHandle #3",
+  "enqueue #4",
+  "didHandle #3",
+  "willHandle #4",
+  "didHandle #4",
+];
+
+function assertLog(msg) {
+  print(msg);
+  assertTrue(expected.length > 0);
+  assertEquals(expected.shift(), msg);
+  if (!expected.length) {
+    Debug.setListener(null);
+  }
+}
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.AsyncTaskEvent) return;
+  try {
+    if (base_id < 0)
+      base_id = event_data.id();
+    var id = event_data.id() - base_id + 1;
+    assertTrue("Promise.resolve" == event_data.name() ||
+               "PromiseResolveThenableJob" == event_data.name());
+    assertLog(event_data.type() + " #" + id);
+  } catch (e) {
+    print(e + e.stack)
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+var resolver;
+var p = new Promise(function(resolve, reject) {
+  resolver = resolve;
+});
+
+async function main() {
+  await p;
+  assertLog("then #1");
+  await undefined;
+  assertLog("then #2");
+}
+main();
+resolver();
+
+%RunMicrotasks();
+
+assertNull(exception);
diff --git a/test/mjsunit/harmony/debug-async-liveedit.js b/test/mjsunit/harmony/debug-async-liveedit.js
new file mode 100644
index 0000000..c651ddb
--- /dev/null
+++ b/test/mjsunit/harmony/debug-async-liveedit.js
@@ -0,0 +1,133 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await
+// Flags: --expose-debug-as debug --allow-natives-syntax --ignition-generators
+
+var Debug = debug.Debug;
+var LiveEdit = Debug.LiveEdit;
+
+unique_id = 0;
+
+var AsyncFunction = (async function(){}).constructor;
+
+function assertPromiseValue(value, promise) {
+  promise.then(resolve => {
+    went = true;
+    if (resolve !== value) {
+      print(`expected ${value} found ${resolve}`);
+      quit(1);
+    }
+  }, reject => {
+    print(`rejected ${reject}`);
+    quit(1);
+  });
+}
+
+function MakeAsyncFunction() {
+  // Prevents eval script caching.
+  unique_id++;
+  return AsyncFunction('callback',
+      "/* " + unique_id + "*/\n" +
+      "await callback();\n" +
+      "return 'Cat';\n");
+}
+
+function MakeFunction() {
+  // Prevents eval script caching.
+  unique_id++;
+  return Function('callback',
+      "/* " + unique_id + "*/\n" +
+      "callback();\n" +
+      "return 'Cat';\n");
+}
+
+// First, try MakeGenerator with no perturbations.
+(function(){
+  var asyncfn = MakeAsyncFunction();
+  function callback() {};
+  var promise = asyncfn(callback);
+  assertPromiseValue('Cat', promise);
+})();
+
+function patch(fun, from, to) {
+  function debug() {
+    var log = new Array();
+    var script = Debug.findScript(fun);
+    var pos = script.source.indexOf(from);
+    print(`pos ${pos}`);
+    try {
+      LiveEdit.TestApi.ApplySingleChunkPatch(script, pos, from.length, to,
+                                             log);
+    } finally {
+      print("Change log: " + JSON.stringify(log) + "\n");
+    }
+  }
+  %ExecuteInDebugContext(debug);
+}
+
+// Try to edit a MakeAsyncFunction while it's running, then again while it's
+// stopped.
+(function(){
+  var asyncfn = MakeAsyncFunction();
+
+  var patch_attempted = false;
+  function attempt_patch() {
+    assertFalse(patch_attempted);
+    patch_attempted = true;
+    assertThrows(function() { patch(asyncfn, "'Cat'", "'Capybara'") },
+                 LiveEdit.Failure);
+  };
+  var promise = asyncfn(attempt_patch);
+  // Patch should not succeed because there is a live async function activation
+  // on the stack.
+  assertPromiseValue("Cat", promise);
+  assertTrue(patch_attempted);
+
+  %RunMicrotasks();
+
+  // At this point one iterator is live, but closed, so the patch will succeed.
+  patch(asyncfn, "'Cat'", "'Capybara'");
+  promise = asyncfn(function(){});
+  // Patch successful.
+  assertPromiseValue("Capybara", promise);
+
+  // Patching will fail however when an async function is suspended.
+  var resolve;
+  promise = asyncfn(function(){return new Promise(function(r){resolve = r})});
+  assertThrows(function() { patch(asyncfn, "'Capybara'", "'Tapir'") },
+               LiveEdit.Failure);
+  resolve();
+  assertPromiseValue("Capybara", promise);
+
+  // Try to patch functions with activations inside and outside async
+  // function activations.  We should succeed in the former case, but not in the
+  // latter.
+  var fun_outside = MakeFunction();
+  var fun_inside = MakeFunction();
+  var fun_patch_attempted = false;
+  var fun_patch_restarted = false;
+  function attempt_fun_patches() {
+    if (fun_patch_attempted) {
+      assertFalse(fun_patch_restarted);
+      fun_patch_restarted = true;
+      return;
+    }
+    fun_patch_attempted = true;
+    // Patching outside an async function activation must fail.
+    assertThrows(function() { patch(fun_outside, "'Cat'", "'Cobra'") },
+                 LiveEdit.Failure);
+    // Patching inside an async function activation may succeed.
+    patch(fun_inside, "'Cat'", "'Koala'");
+  }
+  promise = asyncfn(function() { return fun_inside(attempt_fun_patches) });
+  assertEquals('Cat',
+               fun_outside(function () {
+                 assertPromiseValue('Capybara', promise);
+                 assertTrue(fun_patch_restarted);
+                 assertTrue(fun_inside.toString().includes("'Koala'"));
+               }));
+})();
+
+%RunMicrotasks();
diff --git a/test/mjsunit/harmony/generators-turbo.js b/test/mjsunit/harmony/generators-turbo.js
new file mode 100644
index 0000000..23913e4
--- /dev/null
+++ b/test/mjsunit/harmony/generators-turbo.js
@@ -0,0 +1,655 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --ignition-generators --harmony-do-expressions
+// Flags: --allow-natives-syntax --turbo --turbo-from-bytecode
+
+
+// This file is identical to mjsunit/harmony/generators.js, except for its Flags
+// lines. The purpose is to explicitly mention --turbo-from-bytecode such that
+// Clusterfuzz can thoroughly test the new generators implementation.
+
+
+function MaybeOptimizeOrDeoptimize(f) {
+  let x = Math.random();  // --random-seed makes this deterministic
+  if (x <= 0.33) {
+    %OptimizeFunctionOnNextCall(f);
+  } else if (x <= 0.66) {
+    %DeoptimizeFunction(f);
+  }
+}
+
+function Next(generator, ...args) {
+  MaybeOptimizeOrDeoptimize(%GeneratorGetFunction(generator));
+  return generator.next(...args);
+}
+
+function Return(generator, ...args) {
+  MaybeOptimizeOrDeoptimize(%GeneratorGetFunction(generator));
+  return generator.return(...args);
+}
+
+function Throw(generator, ...args) {
+  MaybeOptimizeOrDeoptimize(%GeneratorGetFunction(generator));
+  return generator.throw(...args);
+}
+
+
+{ // yield in try-catch
+
+  let g = function*() {
+    try {yield 1} catch (error) {assertEquals("caught", error)}
+  };
+
+  assertThrowsEquals(() => Throw(g(), "not caught"), "not caught");
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Throw(x, "caught"));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x));
+    assertThrowsEquals(() => Throw(x, "not caught"), "not caught");
+  }
+}
+
+
+{ // return that doesn't close
+  let g = function*() { try {return 42} finally {yield 43} };
+
+  {
+    let x = g();
+    assertEquals({value: 43, done: false}, Next(x));
+    assertEquals({value: 42, done: true}, Next(x));
+  }
+}
+
+
+{ // return that doesn't close
+  let x;
+  let g = function*() { try {return 42} finally {Throw(x, 666)} };
+
+  {
+    x = g();
+    assertThrows(() => Next(x), TypeError);  // still executing
+  }
+}
+
+
+{ // yield in try-finally, finally clause performs return
+
+  let g = function*() { try {yield 42} finally {return 13} };
+
+  { // "return" closes at suspendedStart
+    let x = g();
+    assertEquals({value: 666, done: true}, Return(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x, 42));
+    assertThrowsEquals(() => Throw(x, 43), 43);
+    assertEquals({value: 42, done: true}, Return(x, 42));
+  }
+
+  { // "throw" closes at suspendedStart
+    let x = g();
+    assertThrowsEquals(() => Throw(x, 666), 666);
+    assertEquals({value: undefined, done: true}, Next(x, 42));
+    assertEquals({value: 43, done: true}, Return(x, 43));
+    assertThrowsEquals(() => Throw(x, 44), 44);
+  }
+
+  { // "next" closes at suspendedYield
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 13, done: true}, Next(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+    assertThrowsEquals(() => Throw(x, 666), 666);
+  }
+
+  { // "return" closes at suspendedYield
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 13, done: true}, Return(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+    assertEquals({value: 666, done: true}, Return(x, 666));
+  }
+
+  { // "throw" closes at suspendedYield
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 13, done: true}, Throw(x, 666));
+    assertThrowsEquals(() => Throw(x, 666), 666);
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+  }
+}
+
+
+{ // yield in try-finally, finally clause doesn't perform return
+
+  let g = function*() { try {yield 42} finally {13} };
+
+  { // "return" closes at suspendedStart
+    let x = g();
+    assertEquals({value: 666, done: true}, Return(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x, 42));
+    assertThrowsEquals(() => Throw(x, 43), 43);
+    assertEquals({value: 42, done: true}, Return(x, 42));
+  }
+
+  { // "throw" closes at suspendedStart
+    let x = g();
+    assertThrowsEquals(() => Throw(x, 666), 666);
+    assertEquals({value: undefined, done: true}, Next(x, 42));
+    assertEquals({value: 43, done: true}, Return(x, 43));
+    assertThrowsEquals(() => Throw(x, 44), 44);
+  }
+
+  { // "next" closes at suspendedYield
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+    assertThrowsEquals(() => Throw(x, 666), 666);
+    assertEquals({value: 42, done: true}, Return(x, 42));
+  }
+
+  { // "return" closes at suspendedYield
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 666, done: true}, Return(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+    assertThrowsEquals(() => Throw(x, 44), 44);
+    assertEquals({value: 42, done: true}, Return(x, 42));
+  }
+
+  { // "throw" closes at suspendedYield
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertThrowsEquals(() => Throw(x, 666), 666);
+    assertEquals({value: undefined, done: true}, Next(x, 666));
+    assertThrowsEquals(() => Throw(x, 666), 666);
+    assertEquals({value: 42, done: true}, Return(x, 42));
+  }
+}
+
+
+{ // yield in try-finally, finally clause yields and performs return
+
+  let g = function*() { try {yield 42} finally {yield 43; return 13} };
+
+  {
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Return(x, 666));
+    assertEquals({value: 13, done: true}, Next(x));
+    assertEquals({value: 666, done: true}, Return(x, 666));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 666, done: true}, Return(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x));
+    assertEquals({value: 666, done: true}, Return(x, 666));
+  }
+}
+
+
+{ // yield in try-finally, finally clause yields and doesn't perform return
+
+  let g = function*() { try {yield 42} finally {yield 43; 13} };
+
+  {
+    let x = g();
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Return(x, 666));
+    assertEquals({value: 666, done: true}, Next(x));
+    assertEquals({value: 5, done: true}, Return(x, 5));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 666, done: true}, Return(x, 666));
+    assertEquals({value: undefined, done: true}, Next(x));
+    assertEquals({value: 666, done: true}, Return(x, 666));
+  }
+}
+
+
+{ // yield*, finally clause performs return
+
+  let h = function*() { try {yield 42} finally {yield 43; return 13} };
+  let g = function*() { yield 1; yield yield* h(); };
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Next(x, 666));
+    assertEquals({value: 13, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Return(x, 666));
+    assertEquals({value: 13, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Throw(x, 666));
+    assertEquals({value: 13, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x));
+  }
+}
+
+
+{ // yield*, finally clause does not perform return
+
+  let h = function*() { try {yield 42} finally {yield 43; 13} };
+  let g = function*() { yield 1; yield yield* h(); };
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Next(x, 666));
+    assertEquals({value: undefined, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Return(x, 44));
+    assertEquals({value: 44, done: false}, Next(x));
+    assertEquals({value: undefined, done: true}, Next(x));
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 42, done: false}, Next(x));
+    assertEquals({value: 43, done: false}, Throw(x, 666));
+    assertThrowsEquals(() => Next(x), 666);
+  }
+}
+
+
+{ // yield*, .return argument is final result
+
+  function* inner() {
+    yield 2;
+  }
+
+  function* g() {
+    yield 1;
+    return yield* inner();
+  }
+
+  {
+    let x = g();
+    assertEquals({value: 1, done: false}, Next(x));
+    assertEquals({value: 2, done: false}, Next(x));
+    assertEquals({value: 42, done: true}, Return(x, 42));
+  }
+}
+
+
+// More or less random tests from here on.
+
+
+{
+  function* foo() { }
+  let g = foo();
+  assertEquals({value: undefined, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() { return new.target }
+  let g = foo();
+  assertEquals({value: undefined, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() { throw 666; return 42}
+  let g = foo();
+  assertThrowsEquals(() => Next(g), 666);
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo(a) { return a; }
+  let g = foo(42);
+  assertEquals({value: 42, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo(a) { a.iwashere = true; return a; }
+  let x = {};
+  let g = foo(x);
+  assertEquals({value: {iwashere: true}, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  let a = 42;
+  function* foo() { return a; }
+  let g = foo();
+  assertEquals({value: 42, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  let a = 40;
+  function* foo(b) { return a + b; }
+  let g = foo(2);
+  assertEquals({value: 42, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  let a = 40;
+  function* foo(b) { a--; b++; return a + b; }
+  let g = foo(2);
+  assertEquals({value: 42, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  let g;
+  function* foo() { Next(g) }
+  g = foo();
+  assertThrows(() => Next(g), TypeError);
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() { yield 2; yield 3; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+
+{
+  function* foo() { yield 2; if (true) { yield 3 }; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() { yield 2; if (true) { yield 3; yield 4 } }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() { yield 2; if (false) { yield 3 }; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() { yield 2; while (true) { yield 3 }; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+}
+
+{
+  function* foo() { yield 2; (yield 3) + 42; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+}
+
+{
+  function* foo() { yield 2; (do {yield 3}) + 42; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+}
+
+{
+  function* foo() { yield 2; return (yield 3) + 42; yield 4 }
+  g = foo();
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 42, done: true}, Next(g, 0));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  let x = 42;
+  function* foo() {
+    yield x;
+    for (let x in {a: 1, b: 2}) {
+      let i = 2;
+      yield x;
+      yield i;
+      do {
+        yield i;
+      } while (i-- > 0);
+    }
+    yield x;
+    return 5;
+  }
+  g = foo();
+  assertEquals({value: 42, done: false}, Next(g));
+  assertEquals({value: 'a', done: false}, Next(g));
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 1, done: false}, Next(g));
+  assertEquals({value: 0, done: false}, Next(g));
+  assertEquals({value: 'b', done: false}, Next(g));
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 1, done: false}, Next(g));
+  assertEquals({value: 0, done: false}, Next(g));
+  assertEquals({value: 42, done: false}, Next(g));
+  assertEquals({value: 5, done: true}, Next(g));
+}
+
+{
+  let a = 3;
+  function* foo() {
+    let b = 4;
+    yield 1;
+    { let c = 5; yield 2; yield a; yield b; yield c; }
+  }
+  g = foo();
+  assertEquals({value: 1, done: false}, Next(g));
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 3, done: false}, Next(g));
+  assertEquals({value: 4, done: false}, Next(g));
+  assertEquals({value: 5, done: false}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() {
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+    yield 42;
+  }
+  g = foo();
+  for (let i = 0; i < 100; ++i) {
+    assertEquals({value: 42, done: false}, i%25 === 0 ? Next(g) : g.next());
+  }
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  function* foo() {
+    for (let i = 0; i < 3; ++i) {
+      let j = 0
+      yield i;
+      do {
+        yield (i + 10);
+      } while (++j < 2);
+    }
+  }
+  g = foo();
+  assertEquals({value: 0, done: false}, Next(g));
+  assertEquals({value: 10, done: false}, Next(g));
+  assertEquals({value: 10, done: false}, Next(g));
+  assertEquals({value: 1, done: false}, Next(g));
+  assertEquals({value: 11, done: false}, Next(g));
+  assertEquals({value: 11, done: false}, Next(g));
+  assertEquals({value: 2, done: false}, Next(g));
+  assertEquals({value: 12, done: false}, Next(g));
+  assertEquals({value: 12, done: false}, Next(g));
+  assertEquals({value: undefined, done: true}, Next(g));
+}
+
+{
+  let foo = function*() {
+    while (true) {
+      if (true || false) yield 42;
+      continue;
+    }
+  }
+  g = foo();
+  assertEquals({value: 42, done: false}, Next(g));
+  assertEquals({value: 42, done: false}, Next(g));
+  assertEquals({value: 42, done: false}, Next(g));
+}
+
+{
+  let foo = function*() {
+    yield* (function*() { yield 42; }());
+    assertUnreachable();
+  }
+  g = foo();
+  assertEquals({value: 42, done: false}, Next(g));
+  assertEquals({value: 23, done: true}, Return(g, 23));
+}
diff --git a/test/mjsunit/harmony/generators.js b/test/mjsunit/harmony/generators.js
index 895a248..eb4e51e 100644
--- a/test/mjsunit/harmony/generators.js
+++ b/test/mjsunit/harmony/generators.js
@@ -648,15 +648,3 @@
   assertEquals({value: 42, done: false}, Next(g));
   assertEquals({value: 23, done: true}, Return(g, 23));
 }
-
-{
-  let iterable = {
-    [Symbol.iterator]() {
-      return { next() { return {} } };
-    }
-  };
-  let foo = function*() { yield* iterable };
-  g = foo();
-  g.next();
-  assertThrows(() => Throw(g), TypeError);
-}
diff --git a/test/mjsunit/harmony/mirror-async-function-promise.js b/test/mjsunit/harmony/mirror-async-function-promise.js
new file mode 100644
index 0000000..966b0ce
--- /dev/null
+++ b/test/mjsunit/harmony/mirror-async-function-promise.js
@@ -0,0 +1,93 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --harmony-async-await --allow-natives-syntax
+// Test the mirror object for promises.
+
+var AsyncFunction = (async function() {}).constructor;
+
+function MirrorRefCache(json_refs) {
+  var tmp = eval('(' + json_refs + ')');
+  this.refs_ = [];
+  for (var i = 0; i < tmp.length; i++) {
+    this.refs_[tmp[i].handle] = tmp[i];
+  }
+}
+
+MirrorRefCache.prototype.lookup = function(handle) {
+  return this.refs_[handle];
+}
+
+function testPromiseMirror(promise, status, value) {
+  // Create mirror and JSON representation.
+  var mirror = debug.MakeMirror(promise);
+  var serializer = debug.MakeMirrorSerializer();
+  var json = JSON.stringify(serializer.serializeValue(mirror));
+  var refs = new MirrorRefCache(
+      JSON.stringify(serializer.serializeReferencedObjects()));
+
+  // Check the mirror hierachy.
+  assertTrue(mirror instanceof debug.Mirror);
+  assertTrue(mirror instanceof debug.ValueMirror);
+  assertTrue(mirror instanceof debug.ObjectMirror);
+  assertTrue(mirror instanceof debug.PromiseMirror);
+
+  // Check the mirror properties.
+  assertEquals(status, mirror.status());
+  assertTrue(mirror.isPromise());
+  assertEquals('promise', mirror.type());
+  assertFalse(mirror.isPrimitive());
+  assertEquals("Object", mirror.className());
+  assertEquals("#<Promise>", mirror.toText());
+  assertSame(promise, mirror.value());
+  assertTrue(mirror.promiseValue() instanceof debug.Mirror);
+  assertEquals(value, mirror.promiseValue().value());
+
+  // Parse JSON representation and check.
+  var fromJSON = eval('(' + json + ')');
+  assertEquals('promise', fromJSON.type);
+  assertEquals('Object', fromJSON.className);
+  assertEquals('function', refs.lookup(fromJSON.constructorFunction.ref).type);
+  assertEquals('Promise', refs.lookup(fromJSON.constructorFunction.ref).name);
+  assertEquals(status, fromJSON.status);
+  assertEquals(value, refs.lookup(fromJSON.promiseValue.ref).value);
+}
+
+// Test a number of different promises.
+var resolved = (async function() {})();
+var rejected = (async function() { throw undefined; })();
+var pending = (async function() { await 1; })();
+
+testPromiseMirror(resolved, "resolved", undefined);
+testPromiseMirror(rejected, "rejected", undefined);
+testPromiseMirror(pending, "pending", undefined);
+
+var resolvedv = (async function() { return "resolve"; })();
+var rejectedv = (async function() { return Promise.reject("reject"); })();
+var thrownv = (async function() { throw "throw"; })();
+
+testPromiseMirror(resolvedv, "resolved", 'resolve');
+testPromiseMirror(rejectedv, "rejected", 'reject');
+testPromiseMirror(thrownv, "rejected", 'throw');
+
+// Test internal properties of different promises.
+var m1 = debug.MakeMirror((async function() { return 1; })());
+var ip = m1.internalProperties();
+assertEquals(2, ip.length);
+assertEquals("[[PromiseStatus]]", ip[0].name());
+assertEquals("[[PromiseValue]]", ip[1].name());
+assertEquals("resolved", ip[0].value().value());
+assertEquals(1, ip[1].value().value());
+
+var m2 = debug.MakeMirror((async function() { throw 2; })());
+ip = m2.internalProperties();
+assertEquals("rejected", ip[0].value().value());
+assertEquals(2, ip[1].value().value());
+
+var m3 = debug.MakeMirror((async function() { await 1; })());
+ip = m3.internalProperties();
+assertEquals("pending", ip[0].value().value());
+assertEquals("undefined", typeof(ip[1].value().value()));
+
+%RunMicrotasks();
diff --git a/test/mjsunit/harmony/mirror-async-function.js b/test/mjsunit/harmony/mirror-async-function.js
new file mode 100644
index 0000000..b4ba831
--- /dev/null
+++ b/test/mjsunit/harmony/mirror-async-function.js
@@ -0,0 +1,76 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --harmony-async-await --allow-natives-syntax
+// Test the mirror object for functions.
+
+var AsyncFunction = (async function() {}).constructor;
+
+function MirrorRefCache(json_refs) {
+  var tmp = eval('(' + json_refs + ')');
+  this.refs_ = [];
+  for (var i = 0; i < tmp.length; i++) {
+    this.refs_[tmp[i].handle] = tmp[i];
+  }
+}
+
+MirrorRefCache.prototype.lookup = function(handle) {
+  return this.refs_[handle];
+}
+
+function testFunctionMirror(f) {
+  // Create mirror and JSON representation.
+  var mirror = debug.MakeMirror(f);
+  var serializer = debug.MakeMirrorSerializer();
+  var json = JSON.stringify(serializer.serializeValue(mirror));
+  var refs = new MirrorRefCache(
+      JSON.stringify(serializer.serializeReferencedObjects()));
+
+  // Check the mirror hierachy.
+  assertTrue(mirror instanceof debug.Mirror);
+  assertTrue(mirror instanceof debug.ValueMirror);
+  assertTrue(mirror instanceof debug.ObjectMirror);
+  assertTrue(mirror instanceof debug.FunctionMirror);
+
+  // Check the mirror properties.
+  assertTrue(mirror.isFunction());
+  assertEquals('function', mirror.type());
+  assertFalse(mirror.isPrimitive());
+  assertEquals("Function", mirror.className());
+  assertEquals(f.name, mirror.name());
+  assertTrue(mirror.resolved());
+  assertEquals(f.toString(), mirror.source());
+  assertTrue(mirror.constructorFunction() instanceof debug.ObjectMirror);
+  assertTrue(mirror.protoObject() instanceof debug.Mirror);
+  assertTrue(mirror.prototypeObject() instanceof debug.Mirror);
+
+  // Test text representation
+  assertEquals(f.toString(), mirror.toText());
+
+  // Parse JSON representation and check.
+  var fromJSON = eval('(' + json + ')');
+  assertEquals('function', fromJSON.type);
+  assertEquals('Function', fromJSON.className);
+  assertEquals('function', refs.lookup(fromJSON.constructorFunction.ref).type);
+  assertEquals('AsyncFunction',
+               refs.lookup(fromJSON.constructorFunction.ref).name);
+  assertTrue(fromJSON.resolved);
+  assertEquals(f.name, fromJSON.name);
+  assertEquals(f.toString(), fromJSON.source);
+
+  // Check the formatted text (regress 1142074).
+  assertEquals(f.toString(), fromJSON.text);
+}
+
+
+// Test a number of different functions.
+testFunctionMirror(async function(){});
+testFunctionMirror(AsyncFunction());
+testFunctionMirror(new AsyncFunction());
+testFunctionMirror(async() => {});
+testFunctionMirror(async function a(){return 1;});
+testFunctionMirror(({ async foo() {} }).foo);
+testFunctionMirror((async function(){}).bind({}), "Object");
+
+%RunMicrotasks();
diff --git a/test/mjsunit/harmony/regexp-change-exec.js b/test/mjsunit/harmony/regexp-change-exec.js
index 4c9757e..ff84506 100644
--- a/test/mjsunit/harmony/regexp-change-exec.js
+++ b/test/mjsunit/harmony/regexp-change-exec.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-exec
-
 class MyError extends Error { }
 RegExp.prototype.exec = () => { throw new MyError() };
 assertThrows(() => "foo".match(/bar/), MyError);
diff --git a/test/mjsunit/harmony/regexp-named-captures.js b/test/mjsunit/harmony/regexp-named-captures.js
new file mode 100644
index 0000000..ced8e4b
--- /dev/null
+++ b/test/mjsunit/harmony/regexp-named-captures.js
@@ -0,0 +1,76 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-named-captures
+
+// Malformed named captures.
+assertThrows("/(?<>a)/u");  // Empty name.
+assertThrows("/(?<aa)/u");  // Unterminated name.
+assertThrows("/(?<42a>a)/u");  // Name starting with digits.
+assertThrows("/(?<:a>a)/u");  // Name starting with invalid char.
+assertThrows("/(?<a:>a)/u");  // Name containing with invalid char.
+assertThrows("/(?<a>a)(?<a>a)/u");  // Duplicate name.
+assertThrows("/(?<a>a)(?<b>b)(?<a>a)/u");  // Duplicate name.
+assertThrows("/\\k<a>/u");  // Invalid reference.
+assertThrows("/(?<a>a)\\k<ab>/u");  // Invalid reference.
+assertThrows("/(?<ab>a)\\k<a>/u");  // Invalid reference.
+assertThrows("/\\k<a>(?<ab>a)/u");  // Invalid reference.
+
+// Fallback behavior in non-unicode mode.
+assertThrows("/(?<>a)/");
+assertThrows("/(?<aa)/");
+assertThrows("/(?<42a>a)/");
+assertThrows("/(?<:a>a)/");
+assertThrows("/(?<a:>a)/");
+assertThrows("/(?<a>a)(?<a>a)/");
+assertThrows("/(?<a>a)(?<b>b)(?<a>a)/");
+assertThrows("/(?<a>a)\\k<ab>/");
+assertThrows("/(?<ab>a)\\k<a>/");
+
+assertEquals(["k<a>"], "xxxk<a>xxx".match(/\k<a>/));
+assertEquals(["k<a"], "xxxk<a>xxx".match(/\k<a/));
+
+// Basic named groups.
+assertEquals(["a", "a"], "bab".match(/(?<a>a)/u));
+assertEquals(["a", "a"], "bab".match(/(?<a42>a)/u));
+assertEquals(["a", "a"], "bab".match(/(?<_>a)/u));
+assertEquals(["a", "a"], "bab".match(/(?<$>a)/u));
+assertEquals(["bab", "a"], "bab".match(/.(?<$>a)./u));
+assertEquals(["bab", "a", "b"], "bab".match(/.(?<a>a)(.)/u));
+assertEquals(["bab", "a", "b"], "bab".match(/.(?<a>a)(?<b>.)/u));
+assertEquals(["bab", "ab"], "bab".match(/.(?<a>\w\w)/u));
+assertEquals(["bab", "bab"], "bab".match(/(?<a>\w\w\w)/u));
+assertEquals(["bab", "ba", "b"], "bab".match(/(?<a>\w\w)(?<b>\w)/u));
+
+assertEquals("bab".match(/(a)/u), "bab".match(/(?<a>a)/u));
+assertEquals("bab".match(/(a)/u), "bab".match(/(?<a42>a)/u));
+assertEquals("bab".match(/(a)/u), "bab".match(/(?<_>a)/u));
+assertEquals("bab".match(/(a)/u), "bab".match(/(?<$>a)/u));
+assertEquals("bab".match(/.(a)./u), "bab".match(/.(?<$>a)./u));
+assertEquals("bab".match(/.(a)(.)/u), "bab".match(/.(?<a>a)(.)/u));
+assertEquals("bab".match(/.(a)(.)/u), "bab".match(/.(?<a>a)(?<b>.)/u));
+assertEquals("bab".match(/.(\w\w)/u), "bab".match(/.(?<a>\w\w)/u));
+assertEquals("bab".match(/(\w\w\w)/u), "bab".match(/(?<a>\w\w\w)/u));
+assertEquals("bab".match(/(\w\w)(\w)/u), "bab".match(/(?<a>\w\w)(?<b>\w)/u));
+
+assertEquals(["bab", "b"], "bab".match(/(?<b>b).\1/u));
+assertEquals(["baba", "b", "a"], "baba".match(/(.)(?<a>a)\1\2/u));
+assertEquals(["baba", "b", "a", "b", "a"],
+    "baba".match(/(.)(?<a>a)(?<b>\1)(\2)/u));
+assertEquals(["<a", "<"], "<a".match(/(?<lt><)a/u));
+assertEquals([">a", ">"], ">a".match(/(?<gt>>)a/u));
+
+// Named references.
+assertEquals(["bab", "b"], "bab".match(/(?<b>.).\k<b>/u));
+assertNull("baa".match(/(?<b>.).\k<b>/u));
+
+// Nested groups.
+assertEquals(["bab", "bab", "ab", "b"], "bab".match(/(?<a>.(?<b>.(?<c>.)))/u));
+
+// Reference inside group.
+assertEquals(["bab", "b"], "bab".match(/(?<a>\k<a>\w)../u));
+
+// Reference before group.
+assertEquals(["bab", "b"], "bab".match(/\k<a>(?<a>b)\w\k<a>/u));
+assertEquals(["bab", "b", "a"], "bab".match(/(?<b>b)\k<a>(?<a>a)\k<b>/u));
diff --git a/test/mjsunit/harmony/regexp-no-change-exec.js b/test/mjsunit/harmony/regexp-no-change-exec.js
deleted file mode 100644
index 30b5050..0000000
--- a/test/mjsunit/harmony/regexp-no-change-exec.js
+++ /dev/null
@@ -1,9 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --no-harmony-regexp-exec
-
-class MyError extends Error { }
-RegExp.prototype.exec = () => { throw new MyError() };
-assertEquals(null, "foo".match(/bar/));
diff --git a/test/mjsunit/harmony/regexp-property-binary.js b/test/mjsunit/harmony/regexp-property-binary.js
index d0894b7..c0b4426 100644
--- a/test/mjsunit/harmony/regexp-property-binary.js
+++ b/test/mjsunit/harmony/regexp-property-binary.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property --harmony-unicode-regexps
+// Flags: --harmony-regexp-property
 
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
diff --git a/test/mjsunit/harmony/regexp-property-blocks.js b/test/mjsunit/harmony/regexp-property-blocks.js
index f41c06e..de3fd1e 100644
--- a/test/mjsunit/harmony/regexp-property-blocks.js
+++ b/test/mjsunit/harmony/regexp-property-blocks.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property --harmony-unicode-regexps
+// Flags: --harmony-regexp-property
 
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
diff --git a/test/mjsunit/harmony/regexp-property-char-class.js b/test/mjsunit/harmony/regexp-property-char-class.js
index 6162012..c70e826 100644
--- a/test/mjsunit/harmony/regexp-property-char-class.js
+++ b/test/mjsunit/harmony/regexp-property-char-class.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps --harmony-regexp-property
+// Flags: --harmony-regexp-property
 
 assertThrows("/[\\p]/u");
 assertThrows("/[\\p{garbage}]/u");
diff --git a/test/mjsunit/harmony/regexp-property-disabled.js b/test/mjsunit/harmony/regexp-property-disabled.js
index 7a3158c..f471ef4 100644
--- a/test/mjsunit/harmony/regexp-property-disabled.js
+++ b/test/mjsunit/harmony/regexp-property-disabled.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps --no-harmony-regexp-property
+// Flags: --no-harmony-regexp-property
 
 function test(source, message) {
   try {
diff --git a/test/mjsunit/harmony/regexp-property-enumerated.js b/test/mjsunit/harmony/regexp-property-enumerated.js
index e4a81a4..dba8397 100644
--- a/test/mjsunit/harmony/regexp-property-enumerated.js
+++ b/test/mjsunit/harmony/regexp-property-enumerated.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property --harmony-unicode-regexps
+// Flags: --harmony-regexp-property
 
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
diff --git a/test/mjsunit/harmony/regexp-property-exact-match.js b/test/mjsunit/harmony/regexp-property-exact-match.js
index fe233f2..0d1f704 100644
--- a/test/mjsunit/harmony/regexp-property-exact-match.js
+++ b/test/mjsunit/harmony/regexp-property-exact-match.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property --harmony-unicode-regexps
+// Flags: --harmony-regexp-property
 
 assertThrows("/\\p{In CJK}/u");
 assertThrows("/\\p{InCJKUnifiedIdeographs}/u");
@@ -15,7 +15,7 @@
 assertThrows("/\\p{InCyrillicSupplementary}/u");
 assertThrows("/\\p{InCyrillic_supplementary}/u");
 
-assertDoesNotThrow("/\\pC/u");
+assertDoesNotThrow("/\\p{C}/u");
 assertDoesNotThrow("/\\p{Other}/u");
 assertDoesNotThrow("/\\p{Cc}/u");
 assertDoesNotThrow("/\\p{Control}/u");
diff --git a/test/mjsunit/harmony/regexp-property-general-category.js b/test/mjsunit/harmony/regexp-property-general-category.js
index e2015ad..e4fb8b5 100644
--- a/test/mjsunit/harmony/regexp-property-general-category.js
+++ b/test/mjsunit/harmony/regexp-property-general-category.js
@@ -2,16 +2,20 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property --harmony-unicode-regexps
+// Flags: --harmony-regexp-property
 
 assertThrows("/\\p/u");
 assertThrows("/\\p{garbage}/u");
 assertThrows("/\\p{}/u");
 assertThrows("/\\p{/u");
 assertThrows("/\\p}/u");
-assertThrows("/\p{Math}/u");
-assertThrows("/\p{Bidi_M}/u");
-assertThrows("/\p{Hex}/u");
+assertThrows("/\\pL/u");
+assertThrows("/\\P/u");
+assertThrows("/\\P{garbage}/u");
+assertThrows("/\\P{}/u");
+assertThrows("/\\P{/u");
+assertThrows("/\\P}/u");
+assertThrows("/\\PL/u");
 
 assertTrue(/\p{Ll}/u.test("a"));
 assertFalse(/\P{Ll}/u.test("a"));
@@ -26,10 +30,10 @@
 assertTrue(/\p{Ll}/iu.test("\u{118D4}"));
 assertTrue(/\p{Ll}/iu.test("A"));
 assertTrue(/\p{Ll}/iu.test("\u{118B4}"));
-assertFalse(/\P{Ll}/iu.test("a"));
-assertFalse(/\P{Ll}/iu.test("\u{118D4}"));
-assertFalse(/\P{Ll}/iu.test("A"));
-assertFalse(/\P{Ll}/iu.test("\u{118B4}"));
+assertTrue(/\P{Ll}/iu.test("a"));
+assertTrue(/\P{Ll}/iu.test("\u{118D4}"));
+assertTrue(/\P{Ll}/iu.test("A"));
+assertTrue(/\P{Ll}/iu.test("\u{118B4}"));
 
 assertTrue(/\p{Lu}/u.test("A"));
 assertFalse(/\P{Lu}/u.test("A"));
@@ -44,22 +48,16 @@
 assertTrue(/\p{Lu}/iu.test("\u{118D4}"));
 assertTrue(/\p{Lu}/iu.test("A"));
 assertTrue(/\p{Lu}/iu.test("\u{118B4}"));
-assertFalse(/\P{Lu}/iu.test("a"));
-assertFalse(/\P{Lu}/iu.test("\u{118D4}"));
-assertFalse(/\P{Lu}/iu.test("A"));
-assertFalse(/\P{Lu}/iu.test("\u{118B4}"));
+assertTrue(/\P{Lu}/iu.test("a"));
+assertTrue(/\P{Lu}/iu.test("\u{118D4}"));
+assertTrue(/\P{Lu}/iu.test("A"));
+assertTrue(/\P{Lu}/iu.test("\u{118B4}"));
 
 assertTrue(/\p{Sm}/u.test("+"));
 assertFalse(/\P{Sm}/u.test("+"));
 assertTrue(/\p{Sm}/u.test("\u{1D6C1}"));
 assertFalse(/\P{Sm}/u.test("\u{1D6C1}"));
 
-assertTrue(/\pL/u.test("a"));
-assertFalse(/\PL/u.test("a"));
-assertFalse(/\pL/u.test("1"));
-assertTrue(/\PL/u.test("1"));
-assertTrue(/\pL/u.test("\u1FAB"));
-assertFalse(/\PL/u.test("\u1FAB"));
 assertFalse(/\p{L}/u.test("\uA6EE"));
 assertTrue(/\P{L}/u.test("\uA6EE"));
 
diff --git a/test/mjsunit/harmony/regexp-property-lu-ui.js b/test/mjsunit/harmony/regexp-property-lu-ui.js
new file mode 100644
index 0000000..115e064
--- /dev/null
+++ b/test/mjsunit/harmony/regexp-property-lu-ui.js
@@ -0,0 +1,13 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-property
+
+const regexp = /\P{Lu}/ui;
+const regexpu = /[\0-@\[-\xBF\xD7\xDF-\xFF\u0101\u0103\u0105\u0107\u0109\u010B\u010D\u010F\u0111\u0113\u0115\u0117\u0119\u011B\u011D\u011F\u0121\u0123\u0125\u0127\u0129\u012B\u012D\u012F\u0131\u0133\u0135\u0137\u0138\u013A\u013C\u013E\u0140\u0142\u0144\u0146\u0148\u0149\u014B\u014D\u014F\u0151\u0153\u0155\u0157\u0159\u015B\u015D\u015F\u0161\u0163\u0165\u0167\u0169\u016B\u016D\u016F\u0171\u0173\u0175\u0177\u017A\u017C\u017E-\u0180\u0183\u0185\u0188\u018C\u018D\u0192\u0195\u0199-\u019B\u019E\u01A1\u01A3\u01A5\u01A8\u01AA\u01AB\u01AD\u01B0\u01B4\u01B6\u01B9-\u01BB\u01BD-\u01C3\u01C5\u01C6\u01C8\u01C9\u01CB\u01CC\u01CE\u01D0\u01D2\u01D4\u01D6\u01D8\u01DA\u01DC\u01DD\u01DF\u01E1\u01E3\u01E5\u01E7\u01E9\u01EB\u01ED\u01EF\u01F0\u01F2\u01F3\u01F5\u01F9\u01FB\u01FD\u01FF\u0201\u0203\u0205\u0207\u0209\u020B\u020D\u020F\u0211\u0213\u0215\u0217\u0219\u021B\u021D\u021F\u0221\u0223\u0225\u0227\u0229\u022B\u022D\u022F\u0231\u0233-\u0239\u023C\u023F\u0240\u0242\u0247\u0249\u024B\u024D\u024F-\u036F\u0371\u0373-\u0375\u0377-\u037E\u0380-\u0385\u0387\u038B\u038D\u0390\u03A2\u03AC-\u03CE\u03D0\u03D1\u03D5-\u03D7\u03D9\u03DB\u03DD\u03DF\u03E1\u03E3\u03E5\u03E7\u03E9\u03EB\u03ED\u03EF-\u03F3\u03F5\u03F6\u03F8\u03FB\u03FC\u0430-\u045F\u0461\u0463\u0465\u0467\u0469\u046B\u046D\u046F\u0471\u0473\u0475\u0477\u0479\u047B\u047D\u047F\u0481-\u0489\u048B\u048D\u048F\u0491\u0493\u0495\u0497\u0499\u049B\u049D\u049F\u04A1\u04A3\u04A5\u04A7\u04A9\u04AB\u04AD\u04AF\u04B1\u04B3\u04B5\u04B7\u04B9\u04BB\u04BD\u04BF\u04C2\u04C4\u04C6\u04C8\u04CA\u04CC\u04CE\u04CF\u04D1\u04D3\u04D5\u04D7\u04D9\u04DB\u04DD\u04DF\u04E1\u04E3\u04E5\u04E7\u04E9\u04EB\u04ED\u04EF\u04F1\u04F3\u04F5\u04F7\u04F9\u04FB\u04FD\u04FF\u0501\u0503\u0505\u0507\u0509\u050B\u050D\u050F\u0511\u0513\u0515\u0517\u0519\u051B\u051D\u051F\u0521\u0523\u0525\u0527\u0529\u052B\u052D\u052F\u0530\u0557-\u109F\u10C6\u10C8-\u10CC\u10CE-\u139F\u13F6-\u1DFF\u1E01\u1E03\u1E05\u1E07\u1E09\u1E0B\u1E0D\u1E0F\u1E11\u1E13\u1E15\u1E17\u1E19\u1E1B\u1E1D\u1E1F\u1E21\u1E23\u1E25\u1E27\u1E29\u1E2B\u1E2D\u1E2F\u1E31\u1E33\u1E35\u1E37\u1E39\u1E3B\u1E3D\u1E3F\u1E41\u1E43\u1E45\u1E47\u1E49\u1E4B\u1E4D\u1E4F\u1E51\u1E53\u1E55\u1E57\u1E59\u1E5B\u1E5D\u1E5F\u1E61\u1E63\u1E65\u1E67\u1E69\u1E6B\u1E6D\u1E6F\u1E71\u1E73\u1E75\u1E77\u1E79\u1E7B\u1E7D\u1E7F\u1E81\u1E83\u1E85\u1E87\u1E89\u1E8B\u1E8D\u1E8F\u1E91\u1E93\u1E95-\u1E9D\u1E9F\u1EA1\u1EA3\u1EA5\u1EA7\u1EA9\u1EAB\u1EAD\u1EAF\u1EB1\u1EB3\u1EB5\u1EB7\u1EB9\u1EBB\u1EBD\u1EBF\u1EC1\u1EC3\u1EC5\u1EC7\u1EC9\u1ECB\u1ECD\u1ECF\u1ED1\u1ED3\u1ED5\u1ED7\u1ED9\u1EDB\u1EDD\u1EDF\u1EE1\u1EE3\u1EE5\u1EE7\u1EE9\u1EEB\u1EED\u1EEF\u1EF1\u1EF3\u1EF5\u1EF7\u1EF9\u1EFB\u1EFD\u1EFF-\u1F07\u1F10-\u1F17\u1F1E-\u1F27\u1F30-\u1F37\u1F40-\u1F47\u1F4E-\u1F58\u1F5A\u1F5C\u1F5E\u1F60-\u1F67\u1F70-\u1FB7\u1FBC-\u1FC7\u1FCC-\u1FD7\u1FDC-\u1FE7\u1FED-\u1FF7\u1FFC-\u2101\u2103-\u2106\u2108-\u210A\u210E\u210F\u2113\u2114\u2116-\u2118\u211E-\u2123\u2125\u2127\u2129\u212E\u212F\u2134-\u213D\u2140-\u2144\u2146-\u2182\u2184-\u2BFF\u2C2F-\u2C5F\u2C61\u2C65\u2C66\u2C68\u2C6A\u2C6C\u2C71\u2C73\u2C74\u2C76-\u2C7D\u2C81\u2C83\u2C85\u2C87\u2C89\u2C8B\u2C8D\u2C8F\u2C91\u2C93\u2C95\u2C97\u2C99\u2C9B\u2C9D\u2C9F\u2CA1\u2CA3\u2CA5\u2CA7\u2CA9\u2CAB\u2CAD\u2CAF\u2CB1\u2CB3\u2CB5\u2CB7\u2CB9\u2CBB\u2CBD\u2CBF\u2CC1\u2CC3\u2CC5\u2CC7\u2CC9\u2CCB\u2CCD\u2CCF\u2CD1\u2CD3\u2CD5\u2CD7\u2CD9\u2CDB\u2CDD\u2CDF\u2CE1\u2CE3-\u2CEA\u2CEC\u2CEE-\u2CF1\u2CF3-\uA63F\uA641\uA643\uA645\uA647\uA649\uA64B\uA64D\uA64F\uA651\uA653\uA655\uA657\uA659\uA65B\uA65D\uA65F\uA661\uA663\uA665\uA667\uA669\uA66B\uA66D-\uA67F\uA681\uA683\uA685\uA687\uA689\uA68B\uA68D\uA68F\uA691\uA693\uA695\uA697\uA699\uA69B-\uA721\uA723\uA725\uA727\uA729\uA72B\uA72D\uA72F-\uA731\uA733\uA735\uA737\uA739\uA73B\uA73D\uA73F\uA741\uA743\uA745\uA747\uA749\uA74B\uA74D\uA74F\uA751\uA753\uA755\uA757\uA759\uA75B\uA75D\uA75F\uA761\uA763\uA765\uA767\uA769\uA76B\uA76D\uA76F-\uA778\uA77A\uA77C\uA77F\uA781\uA783\uA785\uA787-\uA78A\uA78C\uA78E\uA78F\uA791\uA793-\uA795\uA797\uA799\uA79B\uA79D\uA79F\uA7A1\uA7A3\uA7A5\uA7A7\uA7A9\uA7AE\uA7AF\uA7B5\uA7B7-\uFF20\uFF3B-\u{103FF}\u{10428}-\u{10C7F}\u{10CB3}-\u{1189F}\u{118C0}-\u{1D3FF}\u{1D41A}-\u{1D433}\u{1D44E}-\u{1D467}\u{1D482}-\u{1D49B}\u{1D49D}\u{1D4A0}\u{1D4A1}\u{1D4A3}\u{1D4A4}\u{1D4A7}\u{1D4A8}\u{1D4AD}\u{1D4B6}-\u{1D4CF}\u{1D4EA}-\u{1D503}\u{1D506}\u{1D50B}\u{1D50C}\u{1D515}\u{1D51D}-\u{1D537}\u{1D53A}\u{1D53F}\u{1D545}\u{1D547}-\u{1D549}\u{1D551}-\u{1D56B}\u{1D586}-\u{1D59F}\u{1D5BA}-\u{1D5D3}\u{1D5EE}-\u{1D607}\u{1D622}-\u{1D63B}\u{1D656}-\u{1D66F}\u{1D68A}-\u{1D6A7}\u{1D6C1}-\u{1D6E1}\u{1D6FB}-\u{1D71B}\u{1D735}-\u{1D755}\u{1D76F}-\u{1D78F}\u{1D7A9}-\u{1D7C9}\u{1D7CB}-\u{10FFFF}]/ui;
+
+for (let codePoint = 0; codePoint <= 0x10FFFF; codePoint++) {
+  const string = String.fromCodePoint(codePoint);
+  assertEquals(regexp.test(string), regexpu.test(string));
+}
diff --git a/test/mjsunit/harmony/regexp-property-scripts.js b/test/mjsunit/harmony/regexp-property-scripts.js
index ec2b11d..565a59a 100644
--- a/test/mjsunit/harmony/regexp-property-scripts.js
+++ b/test/mjsunit/harmony/regexp-property-scripts.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-regexp-property --harmony-unicode-regexps
+// Flags: --harmony-regexp-property
 
 function t(re, s) { assertTrue(re.test(s)); }
 function f(re, s) { assertFalse(re.test(s)); }
diff --git a/test/mjsunit/harmony/regexp-property-special.js b/test/mjsunit/harmony/regexp-property-special.js
new file mode 100644
index 0000000..204b77f
--- /dev/null
+++ b/test/mjsunit/harmony/regexp-property-special.js
@@ -0,0 +1,51 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-property
+
+function t(re, s) { assertTrue(re.test(s)); }
+function f(re, s) { assertFalse(re.test(s)); }
+
+t(/\p{ASCII}+/u, "abc123");
+f(/\p{ASCII}+/u, "ⓐⓑⓒ①②③");
+f(/\p{ASCII}+/u, "🄰🄱🄲①②③");
+f(/\P{ASCII}+/u, "abcd123");
+t(/\P{ASCII}+/u, "ⓐⓑⓒ①②③");
+t(/\P{ASCII}+/u, "🄰🄱🄲①②③");
+
+f(/[^\p{ASCII}]+/u, "abc123");
+f(/[\p{ASCII}]+/u, "ⓐⓑⓒ①②③");
+f(/[\p{ASCII}]+/u, "🄰🄱🄲①②③");
+t(/[^\P{ASCII}]+/u, "abcd123");
+t(/[\P{ASCII}]+/u, "ⓐⓑⓒ①②③");
+f(/[^\P{ASCII}]+/u, "🄰🄱🄲①②③");
+
+t(/\p{Any}+/u, "🄰🄱🄲①②③");
+
+assertEquals(["\ud800"], /\p{Any}/u.exec("\ud800\ud801"));
+assertEquals(["\udc00"], /\p{Any}/u.exec("\udc00\udc01"));
+assertEquals(["\ud800\udc01"], /\p{Any}/u.exec("\ud800\udc01"));
+assertEquals(["\udc01"], /\p{Any}/u.exec("\udc01"));
+
+f(/\P{Any}+/u, "123");
+f(/[\P{Any}]+/u, "123");
+t(/[\P{Any}\d]+/u, "123");
+t(/[^\P{Any}]+/u, "123");
+
+t(/\p{Assigned}+/u, "123");
+t(/\p{Assigned}+/u, "🄰🄱🄲");
+f(/\p{Assigned}+/u, "\ufdd0");
+f(/\p{Assigned}+/u, "\u{fffff}");
+
+f(/\P{Assigned}+/u, "123");
+f(/\P{Assigned}+/u, "🄰🄱🄲");
+t(/\P{Assigned}+/u, "\ufdd0");
+t(/\P{Assigned}+/u, "\u{fffff}");
+f(/\P{Assigned}/u, "");
+
+t(/[^\P{Assigned}]+/u, "123");
+f(/[\P{Assigned}]+/u, "🄰🄱🄲");
+f(/[^\P{Assigned}]+/u, "\ufdd0");
+t(/[\P{Assigned}]+/u, "\u{fffff}");
+f(/[\P{Assigned}]/u, "");
diff --git a/test/mjsunit/harmony/regress/regress-618603.js b/test/mjsunit/harmony/regress/regress-618603.js
new file mode 100644
index 0000000..7b23ef4
--- /dev/null
+++ b/test/mjsunit/harmony/regress/regress-618603.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await --ignition-generators
+
+try {
+} catch(e) {; }
+function __f_7(expected, run) {
+  var __v_10 = run();
+};
+__f_7("[1,2,3]", () => (function() {
+      return (async () => {[...await arguments] })();
+      })());
diff --git a/test/mjsunit/harmony/regress/regress-crbug-621111.js b/test/mjsunit/harmony/regress/regress-crbug-621111.js
new file mode 100644
index 0000000..58a0d5c
--- /dev/null
+++ b/test/mjsunit/harmony/regress/regress-crbug-621111.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(y = 1[1, [...[]]]) => 1;   // will core dump, if not fixed
+(y = 1[1, [...[]]]) => {};  // will core dump, if not fixed
diff --git a/test/mjsunit/harmony/regress/regress-crbug-621496.js b/test/mjsunit/harmony/regress/regress-crbug-621496.js
new file mode 100644
index 0000000..4db7a95
--- /dev/null
+++ b/test/mjsunit/harmony/regress/regress-crbug-621496.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testIllegalSpreadAsSingleArrowParameter() {
+  assertThrows("(...[42]) => 42)", SyntaxError)  // will core dump, if not fixed
+})();
diff --git a/test/mjsunit/harmony/simd.js b/test/mjsunit/harmony/simd.js
index 1868050..a3d4615 100644
--- a/test/mjsunit/harmony/simd.js
+++ b/test/mjsunit/harmony/simd.js
@@ -622,7 +622,9 @@
 
 function TestStringify(expected, input) {
   assertEquals(expected, JSON.stringify(input));
-  assertEquals(expected, JSON.stringify(input, null, 0));
+  assertEquals(expected, JSON.stringify(input, (key, value) => value));
+  assertEquals(JSON.stringify(input, null, "="),
+               JSON.stringify(input, (key, value) => value, "="));
 }
 
 TestStringify(undefined, SIMD.Float32x4(1, 2, 3, 4));
diff --git a/test/mjsunit/harmony/sloppy-legacy-duplicate-generators.js b/test/mjsunit/harmony/sloppy-legacy-duplicate-generators.js
new file mode 100644
index 0000000..1fde475
--- /dev/null
+++ b/test/mjsunit/harmony/sloppy-legacy-duplicate-generators.js
@@ -0,0 +1,60 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-harmony-restrictive-generators
+
+// In legacy mode, generators get sloppy-mode block-scoped function hoisting
+
+// Hoisting to the global scope
+
+{
+  function* foo() {}
+  assertEquals('function', typeof foo);
+}
+//assertEquals('function', typeof foo);
+
+// Hoisting within a function scope
+(function() {
+  { function* bar() {} }
+  assertEquals('function', typeof bar);
+})();
+
+// Lexical shadowing allowed; hoisting happens
+(function() {
+  function* x() { yield 1; }
+  { function* x() { yield 2 } }
+  assertEquals(2, x().next().value);
+})();
+
+// Duplicates allowed
+(function() {
+  function* y() { yield 1; }
+  function* y() { yield 2 }
+  assertEquals(2, y().next().value);
+})();
+
+// Functions and generators may duplicate each other
+(function() {
+  function* z() { yield 1; }
+  function z() { return 2 }
+  assertEquals(2, z());
+
+  function a() { return 1; }
+  function* a() { yield 2 }
+  assertEquals(2, a().next().value);
+})();
+
+// In strict mode, none of this happens
+
+(function() {
+  'use strict';
+
+  { function* bar() {} }
+  assertEquals('undefined', typeof bar);
+
+  // Lexical shadowing allowed; hoisting happens
+  function* x() { yield 1; }
+  { function* x() { yield 2 } }
+  assertEquals(1, x().next().value);
+})();
diff --git a/test/mjsunit/harmony/sloppy-no-duplicate-async.js b/test/mjsunit/harmony/sloppy-no-duplicate-async.js
new file mode 100644
index 0000000..97411c0
--- /dev/null
+++ b/test/mjsunit/harmony/sloppy-no-duplicate-async.js
@@ -0,0 +1,30 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-async-await
+
+// Async functions don't get sloppy-mode block-scoped function hoisting
+
+// No hoisting to the global scope
+
+{
+  async function foo() {}
+  assertEquals('function', typeof foo);
+}
+assertEquals('undefined', typeof foo);
+
+// No hoisting within a function scope
+(function() {
+  { async function bar() {} }
+  assertEquals('undefined', typeof bar);
+})();
+
+// Lexical shadowing allowed, no hoisting
+(function() {
+  var y;
+  async function x() { y = 1; }
+  { async function x() { y = 2; } }
+  x();
+  assertEquals(1, y);
+})();
diff --git a/test/mjsunit/harmony/sloppy-no-duplicate-generators.js b/test/mjsunit/harmony/sloppy-no-duplicate-generators.js
new file mode 100644
index 0000000..de2e461
--- /dev/null
+++ b/test/mjsunit/harmony/sloppy-no-duplicate-generators.js
@@ -0,0 +1,28 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-restrictive-generators
+
+// Generators don't get sloppy-mode block-scoped function hoisting
+
+// No hoisting to the global scope
+
+{
+  function* foo() {}
+  assertEquals('function', typeof foo);
+}
+assertEquals('undefined', typeof foo);
+
+// No hoisting within a function scope
+(function() {
+  { function* bar() {} }
+  assertEquals('undefined', typeof bar);
+})();
+
+// Lexical shadowing allowed, no hoisting
+(function() {
+  function* x() { yield 1; }
+  { function* x() { yield 2 } }
+  assertEquals(1, x().next().value);
+})();
diff --git a/test/mjsunit/ignition/elided-instruction-no-ignition.js b/test/mjsunit/ignition/elided-instruction-no-ignition.js
deleted file mode 100644
index 50ad528..0000000
--- a/test/mjsunit/ignition/elided-instruction-no-ignition.js
+++ /dev/null
@@ -1,37 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --no-ignition --expose-debug-as debug
-
-Debug = debug.Debug
-
-var exception = null;
-var break_count = 0;
-
-function listener(event, exec_state, event_data, data) {
-  if (event != Debug.DebugEvent.Break) return;
-  try {
-    print(event_data.sourceLineText());
-    var column = event_data.sourceColumn();
-    assertTrue(event_data.sourceLineText().indexOf(
-        `Break ${break_count++}. ${column}.`) > 0);
-    exec_state.prepareStep(Debug.StepAction.StepIn);
-  } catch (e) {
-    print(e + e.stack);
-    exception = e;
-  }
-};
-
-function f() {
-  var a = 1;                     // Break 2. 10.
-  return a;                      // Break 3. 2.
-}                                // Break 4. 0.
-
-Debug.setListener(listener);
-debugger;                        // Break 0. 0.
-f();                             // Break 1. 0.
-Debug.setListener(null);         // Break 5. 0.
-
-assertNull(exception);
-assertEquals(6, break_count);
diff --git a/test/mjsunit/ignition/elided-instruction.js b/test/mjsunit/ignition/elided-instruction.js
index a047f41..d31150b 100644
--- a/test/mjsunit/ignition/elided-instruction.js
+++ b/test/mjsunit/ignition/elided-instruction.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --ignition --expose-debug-as debug
+// Flags: --expose-debug-as debug
 
 Debug = debug.Debug
 
@@ -25,17 +25,13 @@
 
 function f() {
   var a = 1;                     // Break 2. 10.
-  // This return statement emits no bytecode instruction for the evaluation of
-  // the to-be-returned expression. Therefore we cannot set a break location
-  // before the statement and a second break location immediately before
-  // returning to the caller.
-  return a;
-}                                // Break 3. 0.
+  return a;                      // Break 3. 2.
+}                                // Break 4. 0.
 
 Debug.setListener(listener);
 debugger;                        // Break 0. 0.
 f();                             // Break 1. 0.
-Debug.setListener(null);         // Break 4. 0.
+Debug.setListener(null);         // Break 5. 0.
 
 assertNull(exception);
-assertEquals(5, break_count);
+assertEquals(6, break_count);
diff --git a/test/mjsunit/ignition/regress-612386-smi-to-double-transition.js b/test/mjsunit/ignition/regress-612386-smi-to-double-transition.js
new file mode 100644
index 0000000..275f7d6
--- /dev/null
+++ b/test/mjsunit/ignition/regress-612386-smi-to-double-transition.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --no-inline-new
+
+function keyed_store(obj, key, value) {
+  obj[key] = value;
+}
+
+function foo() {
+  obj = {};
+  obj.smi = 1;
+  obj.dbl = 1.5;
+  obj.obj = {a:1};
+
+  // Transition keyed store IC to polymorphic.
+  keyed_store(obj, "smi", 100);
+  keyed_store(obj, "dbl", 100);
+  keyed_store(obj, "obj", 100);
+
+  // Now call with a FAST_SMI_ELEMENTS object.
+  var smi_array = [5, 1, 1];
+  keyed_store(smi_array, 1, 6);
+  // Transition from FAST_SMI_ELEMENTS to FAST_DOUBLE_ELEMENTS.
+  keyed_store(smi_array, 2, 1.2);
+}
+
+foo();
diff --git a/test/mjsunit/ignition/regress-616064.js b/test/mjsunit/ignition/regress-616064.js
new file mode 100644
index 0000000..06de873
--- /dev/null
+++ b/test/mjsunit/ignition/regress-616064.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition
+
+function foo() {
+  if (this.Worker) {
+    function __f_0() { this.s = a; }
+    function __f_1() {
+      this.l = __f_0;
+    }
+
+    with ( 'source' , Object ) throw function __f_0(__f_0) {
+      return Worker.__f_0(-2147483648, __f_0);
+    };
+
+    var __v_9 = new Worker('');
+    __f_1 = {s: Math.s, __f_1: true};
+  }
+}
+
+try {
+  foo();
+} catch(e) {
+}
diff --git a/test/mjsunit/json-replacer-order.js b/test/mjsunit/json-replacer-order.js
index 8cb6441..19b69bf 100644
--- a/test/mjsunit/json-replacer-order.js
+++ b/test/mjsunit/json-replacer-order.js
@@ -20,7 +20,6 @@
 });
 
 JSON.stringify('', replacer, space);
-
 assertEquals(2, log.length);
 assertEquals('get 0', log[0]);
 assertEquals('toString', log[1]);
diff --git a/test/mjsunit/json-stringify-holder.js b/test/mjsunit/json-stringify-holder.js
new file mode 100644
index 0000000..2f06d77
--- /dev/null
+++ b/test/mjsunit/json-stringify-holder.js
@@ -0,0 +1,104 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testBasic() {
+  var stack = [];
+  var object = {a: false};
+  var replaced = {a: false, replaced: true};
+
+  function replacer(key, value) {
+    stack.push({ holder: this, key, value });
+    if (stack.length === 1) return replaced;
+    if (key === "a") return true;
+    return value;
+  }
+
+  assertEquals(`{"a":true,"replaced":true}`, JSON.stringify(object, replacer));
+
+  assertEquals([
+    {
+      holder: { "": { a: false } },
+      key: "",
+      value: { a: false }
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "a",
+      value: false
+    },
+    {
+      holder: { a: false, replaced: true },
+      key: "replaced",
+      value: true
+    }
+  ], stack);
+
+  assertSame(stack[0].holder[""], object);
+  assertSame(stack[0].value, object);
+  assertSame(stack[1].holder, replaced);
+  assertSame(stack[2].holder, replaced);
+})();
+
+(function testToJSON() {
+  var stack = [];
+  var object = {a: false, toJSON };
+  var nested = { toJSON: nestedToJSON };
+  var replaced = {a: false, replaced: true, nested };
+  var toJSONd = {a: false, toJSONd: true }
+  var nestedToJSONd = { nestedToJSONd: true };
+
+  function toJSON(key, value) {
+    return toJSONd;
+  }
+
+  function nestedToJSON(key, value) {
+    return nestedToJSONd;
+  }
+
+  function replacer(key, value) {
+    stack.push({ holder: this, key, value });
+    if (stack.length === 1) return replaced;
+    if (key === "a") return true;
+    return value;
+  }
+
+  assertEquals(`{"a":true,"replaced":true,"nested":{"nestedToJSONd":true}}`,
+               JSON.stringify(object, replacer));
+
+  assertEquals([
+    {
+      holder: { "": { a: false, toJSON: toJSON } },
+      key: "",
+      value: { a: false, toJSONd: true }
+    },
+    {
+      holder: { a: false, replaced: true, nested: { toJSON: nestedToJSON } },
+      key: "a",
+      value: false
+    },
+    {
+      holder: { a: false, replaced: true, nested: { toJSON: nestedToJSON } },
+      key: "replaced",
+      value: true
+    },
+    {
+      holder: { a: false, replaced: true, nested: { toJSON: nestedToJSON } },
+      key: "nested",
+      value: { nestedToJSONd: true }
+    },
+    {
+      holder: { nestedToJSONd: true },
+      key: "nestedToJSONd",
+      value: true
+    }
+  ], stack);
+
+  assertSame(stack[0].holder[""], object);
+  assertSame(stack[0].value, toJSONd);
+  assertSame(stack[1].holder, replaced);
+  assertSame(stack[2].holder, replaced);
+  assertSame(stack[3].holder, replaced);
+  assertSame(stack[3].value, nestedToJSONd);
+  assertSame(stack[4].holder, nestedToJSONd);
+})();
diff --git a/test/mjsunit/json.js b/test/mjsunit/json.js
index 84f2056..3652feb 100644
--- a/test/mjsunit/json.js
+++ b/test/mjsunit/json.js
@@ -234,7 +234,9 @@
 
 function TestStringify(expected, input) {
   assertEquals(expected, JSON.stringify(input));
-  assertEquals(expected, JSON.stringify(input, null, 0));
+  assertEquals(expected, JSON.stringify(input, (key, value) => value));
+  assertEquals(JSON.stringify(input, null, "="),
+               JSON.stringify(input, (key, value) => value, "="));
 }
 
 TestStringify("true", true);
@@ -451,8 +453,8 @@
 // RegExps are not callable, so they are stringified as objects.
 TestStringify('{}', /regexp/);
 TestStringify('42', counter);
-assertEquals(2, getCount);
-assertEquals(2, callCount);
+assertEquals(4, getCount);
+assertEquals(4, callCount);
 
 var oddball2 = Object(42);
 var oddball3 = Object("foo");
@@ -518,3 +520,6 @@
   return p === "" ? v : 42;
 }
 assertEquals({a: 0, b: 1}, JSON.parse('{"a":0,"b":1}', reviver));
+
+reviver = (k, v) => (v === Infinity) ? "inf" : v;
+assertEquals('{"":"inf"}', JSON.stringify({"":Infinity}, reviver));
diff --git a/test/mjsunit/json2.js b/test/mjsunit/json2.js
index f68c76c..75e25f8 100644
--- a/test/mjsunit/json2.js
+++ b/test/mjsunit/json2.js
@@ -35,7 +35,9 @@
 // Test JSON.stringify of array in dictionary mode.
 function TestStringify(expected, input) {
   assertEquals(expected, JSON.stringify(input));
-  assertEquals(expected, JSON.stringify(input, null, 0));
+  assertEquals(expected, JSON.stringify(input, (key, value) => value));
+  assertEquals(JSON.stringify(input, null, "="),
+               JSON.stringify(input, (key, value) => value, "="));
 }
 
 var array_1 = [];
@@ -76,7 +78,7 @@
                          return 123;
                        } };
 TestStringify('{"getter":123}', getter_obj);
-assertEquals(2, counter);
+assertEquals(4, counter);
 
 // Test toJSON function.
 var tojson_obj = { toJSON: function() {
@@ -85,7 +87,7 @@
                            },
                    a: 1};
 TestStringify('[1,2]', tojson_obj);
-assertEquals(4, counter);
+assertEquals(8, counter);
 
 // Test that we don't recursively look for the toJSON function.
 var tojson_proto_obj = { a: 'fail' };
diff --git a/test/mjsunit/lithium/SeqStringSetChar.js b/test/mjsunit/lithium/SeqStringSetChar.js
deleted file mode 100644
index c5bd145..0000000
--- a/test/mjsunit/lithium/SeqStringSetChar.js
+++ /dev/null
@@ -1,46 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-function MyStringFromCharCode(code, i) {
-  var one_byte = %NewString(3, true);
-  %_OneByteSeqStringSetChar(0, code, one_byte);
-  %_OneByteSeqStringSetChar(1, code, one_byte);
-  %_OneByteSeqStringSetChar(i, code, one_byte);
-  var two_byte = %NewString(3, false);
-  %_TwoByteSeqStringSetChar(0, code, two_byte);
-  %_TwoByteSeqStringSetChar(1, code, two_byte);
-  %_TwoByteSeqStringSetChar(i, code, two_byte);
-  return one_byte + two_byte;
-}
-
-MyStringFromCharCode(65, 2);
-var r1 = MyStringFromCharCode(65, 2);
-%OptimizeFunctionOnNextCall(MyStringFromCharCode);
-var r2 = MyStringFromCharCode(65, 2);
-assertEquals(r1, r2);
diff --git a/test/mjsunit/messages.js b/test/mjsunit/messages.js
index d40994d..30abc19 100644
--- a/test/mjsunit/messages.js
+++ b/test/mjsunit/messages.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --stack-size=100 --harmony
-// Flags: --harmony-simd --harmony-instanceof
+// Flags: --harmony-simd
 
 function test(f, expected, type) {
   try {
diff --git a/test/mjsunit/mirror-regexp.js b/test/mjsunit/mirror-regexp.js
index 7aae1c6..0711ff9 100644
--- a/test/mjsunit/mirror-regexp.js
+++ b/test/mjsunit/mirror-regexp.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --expose-debug-as debug --harmony-unicode-regexps
+// Flags: --expose-debug-as debug
 // Test the mirror object for regular expression values
 
 var dont_enum = debug.PropertyAttribute.DontEnum;
diff --git a/test/mjsunit/mirror-script.js b/test/mjsunit/mirror-script.js
index ed0dd12..7e3891a 100644
--- a/test/mjsunit/mirror-script.js
+++ b/test/mjsunit/mirror-script.js
@@ -83,16 +83,7 @@
 
 
 // Test the script mirror for different functions.
-testScriptMirror(function(){}, 'mirror-script.js', 99, 2, 0);
+testScriptMirror(function(){}, 'mirror-script.js', 90, 2, 0);
 testScriptMirror(Math.abs, 'native math.js', -1, 0, 0);
 testScriptMirror(eval('(function(){})'), null, 1, 2, 1, '(function(){})', 87);
 testScriptMirror(eval('(function(){\n  })'), null, 2, 2, 1, '(function(){\n  })', 88);
-
-// Test taking slices of source.
-var mirror = debug.MakeMirror(eval('(function(){\n  1;\n})')).script();
-assertEquals('(function(){\n', mirror.sourceSlice(0, 1).sourceText());
-assertEquals('  1;\n', mirror.sourceSlice(1, 2).sourceText());
-assertEquals('})', mirror.sourceSlice(2, 3).sourceText());
-assertEquals('(function(){\n  1;\n', mirror.sourceSlice(0, 2).sourceText());
-assertEquals('  1;\n})', mirror.sourceSlice(1, 3).sourceText());
-assertEquals('(function(){\n  1;\n})', mirror.sourceSlice(0, 3).sourceText());
diff --git a/test/mjsunit/mjsunit.isolate b/test/mjsunit/mjsunit.isolate
index 18b73c2..6ebd801 100644
--- a/test/mjsunit/mjsunit.isolate
+++ b/test/mjsunit/mjsunit.isolate
@@ -13,7 +13,8 @@
       '../../tools/profile_view.js',
       '../../tools/profviz/composer.js',
       '../../tools/splaytree.js',
-      '../../tools/tickprocessor.js'
+      '../../tools/tickprocessor.js',
+      '../../tools/dumpcpp.js'
     ],
   },
   'includes': [
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 228832b..017fa4d 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -94,14 +94,12 @@
   'debug-evaluate-locals-optimized': [PASS, NO_VARIANTS],
   'debug-evaluate-locals-optimized-double': [PASS, NO_VARIANTS],
   'debug-evaluate-recursive': [PASS, NO_VARIANTS],  # only in no-snap debug.
-  'debug-ignore-breakpoints': [PASS, NO_VARIANTS],  # only in no-snap debug.
   'debug-setbreakpoint': [PASS, NO_VARIANTS],  # only in no-snap debug.
   'debug-step': [PASS, NO_VARIANTS],  # windows only.
   'debug-step-2': [PASS, NO_VARIANTS],  # flaky in no-snap mode.
   'debug-step-3': [PASS, NO_VARIANTS],  # flaky in no-snap mode.
   'debug-stepframe-clearing': [PASS, NO_VARIANTS],  # only in no-snap debug.
   'debug-stepin-call-function-stub': [PASS, NO_VARIANTS],  # only in no-snap debug.
-  'debug-stepin-positions': [PASS, NO_VARIANTS],  # only due to inlining.
   'regress/regress-3717': [PASS, NO_VARIANTS],  # only in no-snap mode.
   'regress/regress-2451': [PASS, NO_VARIANTS],  # with custom snapshot and gc-stress.
   'debug-multiple-breakpoints': [PASS, NO_VARIANTS],  # with custom snapshot and gc-stress.
@@ -124,7 +122,6 @@
   'mirror-script': [PASS, NO_VARIANTS],  # on ARM64 only.
 
   # TODO(jarin/mstarzinger): Investigate debugger issues with TurboFan.
-  'debug-evaluate-const': [PASS, NO_VARIANTS],
   'debug-evaluate-locals': [PASS, NO_VARIANTS],
   'debug-evaluate-locals-capturing': [PASS, NO_VARIANTS],
   'debug-liveedit-check-stack': [PASS, NO_VARIANTS],  # only in no-snap mode.
@@ -194,11 +191,6 @@
   'regress/regress-crbug-482998': [PASS, NO_VARIANTS, ['arch == arm or arch == arm64 or arch == android_arm or arch == android_arm64 or arch == mipsel or arch == mips64el or arch == mips', SKIP]],
 
   ##############################################################################
-  # This test expects to reach a certain recursion depth, which may not work
-  # for debug mode.
-  'json-recursive': [PASS, ['mode == debug', PASS, FAIL]],
-
-  ##############################################################################
   # Skip long running tests that time out in debug mode.
   'generated-transition-stub': [PASS, ['mode == debug', SKIP]],
   'migrations': [SKIP],
@@ -214,6 +206,7 @@
   # that, it doesn't make sense to run several variants of d8-os anyways.
   'd8-os': [PASS, NO_VARIANTS, ['isolates or arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
   'tools/tickprocessor': [PASS, NO_VARIANTS, ['arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
+  'tools/dumpcpp': [PASS, NO_VARIANTS, ['arch == android_arm or arch == android_arm64 or arch == android_ia32', SKIP]],
 
   ##############################################################################
   # Long running test that reproduces memory leak and should be run manually.
@@ -228,7 +221,6 @@
   # Tests with different versions for release and debug.
   'compiler/alloc-number': [PASS, ['mode == debug', SKIP]],
   'compiler/alloc-number-debug': [PASS, ['mode == release', SKIP]],
-  'regress/regress-634': [PASS, ['mode == debug', SKIP]],
   'regress/regress-634-debug': [PASS, ['mode == release', SKIP]],
 
   # BUG(336820). TODO(bmeurer): Investigate.
@@ -261,7 +253,7 @@
   'readonly': [PASS, SLOW],
   'regress/regress-1200351': [PASS, ['mode == debug', SLOW]],
   'regress/regress-crbug-474297': [PASS, ['mode == debug', SLOW]],
-  'es6/tail-call-megatest*': [PASS, FAST_VARIANTS],
+  'es6/tail-call-megatest*': [PASS, SLOW, FAST_VARIANTS, ['tsan', SKIP]],
 
   # TODO(titzer): ASM->WASM tests on these platforms
   'wasm/asm-wasm': [PASS, ['arch in [arm, arm64, mips, mipsel, mips64, mips64el]', SKIP]],
@@ -276,12 +268,16 @@
   'wasm/embenchen/*': [PASS, ['arch == arm64', SKIP], ['ignition == True', SKIP]],
 
   # case-insensitive unicode regexp relies on case mapping provided by ICU.
-  'harmony/unicode-regexp-ignore-case': [PASS, ['no_i18n == True', FAIL]],
-  'harmony/unicode-regexp-ignore-case-noi18n': [FAIL, ['no_i18n == True', PASS]],
+  'es6/unicode-regexp-ignore-case': [PASS, ['no_i18n == True', FAIL]],
+  'es6/unicode-regexp-ignore-case-noi18n': [FAIL, ['no_i18n == True', PASS]],
   'regress/regress-5036': [PASS, ['no_i18n == True', FAIL]],
   # desugaring regexp property class relies on ICU.
   'harmony/regexp-property-*': [PASS, ['no_i18n == True', FAIL]],
 
+  # TODO(bmeurer): Flaky timeouts (sometimes <1s, sometimes >3m).
+  'unicodelctest': [PASS, NO_VARIANTS],
+  'unicodelctest-no-optimization': [PASS, NO_VARIANTS],
+
   ############################################################################
   # Ignition
 
@@ -296,12 +292,6 @@
   # till it is optimized. So test timeouts.
   'array-literal-transitions': [PASS, NO_IGNITION],
 
-  # TODO(rmcilroy, 4680): Script throws RangeError as expected, but does so during
-  # eager compile of the whole script instead of during lazy compile of the function
-  # f(), so we can't catch the exception in the try/catch. Skip because on some
-  # platforms the stack limit is different and the exception doesn't fire.
-  'regress/regress-crbug-589472': [PASS, NO_IGNITION],
-
   # TODO(4680): Test doesn't know about three tier compiler pipeline.
   'assert-opt-and-deopt': [PASS, NO_IGNITION],
 
@@ -336,6 +326,10 @@
   'smi-mul-const': [PASS, NO_IGNITION],
   'smi-mul': [PASS, NO_IGNITION],
   'unary-minus-deopt': [PASS, NO_IGNITION],
+
+  # TODO(rmcilroy,5038): Crashes in Deoptimizer::PatchCodeForDeoptimization on
+  # nosnap builds when --stress-opt and --turbo-from-bytecode is enabled.
+  'harmony/generators-turbo': [PASS, FAST_VARIANTS],
 }],  # ALWAYS
 
 ['novfp3 == True', {
@@ -382,7 +376,6 @@
   # TODO(mstarzinger): Takes too long with TF.
   'array-sort': [PASS, NO_VARIANTS],
   'regress/regress-91008': [PASS, NO_VARIANTS],
-  'regress/regress-417709a': [PASS, ['arch == arm64', NO_VARIANTS]],
   'regress/regress-transcendental': [PASS, ['arch == arm64', NO_VARIANTS]],
   'compiler/osr-regress-max-locals': [PASS, NO_VARIANTS],
   'math-floor-of-div': [PASS, NO_VARIANTS],
@@ -415,6 +408,9 @@
 
   # BUG(v8:4779): Crashes flakily with stress mode on arm64.
   'array-splice': [PASS, SLOW, ['arch == arm64', FAST_VARIANTS]],
+
+  # BUG(v8:5053).
+  'wasm/embenchen/fasta': [PASS, FAST_VARIANTS],
 }],  # 'gc_stress == True'
 
 ##############################################################################
@@ -431,8 +427,6 @@
   'asm/sqlite3/*': [SKIP],
   # TODO(mips-team): Fix Wasm for big-endian.
   'wasm/*': [SKIP],
-  'regress/regress-599717': [SKIP],
-  'regress/regress-599719': [SKIP],
 }],  # 'byteorder == big'
 
 ##############################################################################
@@ -454,15 +448,12 @@
   'big-object-literal': [SKIP],
   'compiler/regress-arguments': [SKIP],
   'compiler/regress-gvn': [SKIP],
-  'compiler/regress-max-locals-for-osr': [SKIP],
   'compiler/regress-4': [SKIP],
   'compiler/regress-or': [SKIP],
   'compiler/regress-rep-change': [SKIP],
   'regress/regress-1117': [SKIP],
-  'regress/regress-1145': [SKIP],
   'regress/regress-1849': [SKIP],
   'regress/regress-3247124': [SKIP],
-  'regress/regress-634': [SKIP],
   'regress/regress-91008': [SKIP],
   'regress/regress-91010': [SKIP],
   'regress/regress-91013': [SKIP],
@@ -518,11 +509,9 @@
 ['arch == arm64 and mode == debug and simulator_run == True', {
 
   # Pass but take too long with the simulator in debug mode.
-  'array-iterate-backwards': [PASS, TIMEOUT],
   'array-sort': [PASS, TIMEOUT],
   'packed-elements': [SKIP],
   'regexp-global': [SKIP],
-  'compiler/alloc-numbers': [SKIP],
   'math-floor-of-div': [PASS, TIMEOUT],
   'math-floor-of-div-nosudiv': [PASS, TIMEOUT],
   'unicodelctest': [PASS, TIMEOUT],
@@ -532,7 +521,6 @@
 
   # Ignition.
   'es6/templates': [PASS, ['no_snap and mode == debug', NO_IGNITION]],
-  'harmony/generators': [PASS, ['no_snap and mode == debug', NO_IGNITION]],
   'regress/regress-crbug-364374': [PASS, ['no_snap and mode == debug', NO_IGNITION]],
 }],  # 'arch == arm64 and mode == debug and simulator_run == True'
 
@@ -567,6 +555,9 @@
   'try': [PASS, NO_IGNITION],
   # Too slow for interpreter and msan.
   'es6/tail-call-megatest*': [PASS, NO_IGNITION],
+
+  # Too slow.
+  'harmony/regexp-property-lu-ui': [SKIP],
 }],  # 'msan == True'
 
 ##############################################################################
@@ -590,7 +581,6 @@
   'big-object-literal': [SKIP],
   'compiler/alloc-number': [SKIP],
   'regress/regress-490': [SKIP],
-  'regress/regress-634': [SKIP],
   'regress/regress-create-exception': [SKIP],
   'regress/regress-3247124': [SKIP],
 
@@ -639,7 +629,6 @@
   # the buildbot.
   'compiler/alloc-number': [SKIP],
   'regress/regress-490': [SKIP],
-  'regress/regress-634': [SKIP],
   'regress/regress-create-exception': [SKIP],
   'regress/regress-3247124': [SKIP],
 
@@ -702,7 +691,6 @@
   'compiler/regress-3249650': [PASS, SLOW],
   'compiler/simple-deopt': [PASS, SLOW],
   'regress/regress-490': [PASS, SLOW],
-  'regress/regress-634': [PASS, SLOW],
   'regress/regress-create-exception': [PASS, SLOW],
   'regress/regress-3218915': [PASS, SLOW],
   'regress/regress-3247124': [PASS, SLOW],
@@ -722,7 +710,6 @@
   'big-object-literal': [PASS, ['mode == debug', SKIP]],
   'math-floor-of-div': [PASS, ['mode == debug', SKIP]],
   'math-floor-of-div-nosudiv': [PASS, ['mode == debug', SKIP]],
-  'osr-regress-max-locals': [PASS, ['mode == debug', SKIP]],
   'unicodelctest': [PASS, ['mode == debug', SKIP]],
 
   # BUG(v8:3435)
@@ -767,7 +754,6 @@
   'regress/regress-1257': [PASS, NO_VARIANTS],
   'regress/regress-2618': [PASS, NO_VARIANTS],
   'regress/regress-298269': [PASS, NO_VARIANTS],
-  'regress/regress-634': [PASS, NO_VARIANTS],
   'regress/regress-91008': [PASS, NO_VARIANTS],
   'compiler/osr-alignment': [PASS, NO_VARIANTS],
   'compiler/osr-one': [PASS, NO_VARIANTS],
@@ -852,18 +838,23 @@
   # till it is optimized. So test timeouts.
   'array-literal-transitions': [SKIP],
 
-  # TODO(rmcilroy, 4680): Script throws RangeError as expected, but does so during
-  # eager compile of the whole script instead of during lazy compile of the function
-  # f(), so we can't catch the exception in the try/catch. Skip because on some
-  # platforms the stack limit is different and the exception doesn't fire.
-  'regress/regress-crbug-589472': [SKIP],
-
   'wasm/asm-wasm-f32': [PASS, ['arch in [arm64]', SKIP]],
   'wasm/asm-wasm-f64': [PASS, ['arch in [arm64]', SKIP]],
 
   # TODO(rmcilroy,titzer): Times out after
   # https://codereview.chromium.org/1951013002 .
   'regress/regress-599717': [PASS, ['tsan', SKIP]],
+
+  # TODO(rmcilroy,5038): Crashes in Deoptimizer::PatchCodeForDeoptimization on
+  # nosnap builds when --stress-opt and --turbo-from-bytecode is enabled.
+  'harmony/generators-turbo': [PASS, FAST_VARIANTS],
+  'regress/regress-crbug-352058': [SKIP],
+
+  # TODO(jarin): No truncations on CheckFloat64Hole.
+  'getters-on-elements': [SKIP],
+
+  # TODO(rmcilroy): Flaky OOM.
+  'unicodelctest-no-optimization': [SKIP],
 }],  # ignition or ignition_turbofan
 
 ['(ignition or ignition_turbofan) and arch == arm64', {
diff --git a/test/mjsunit/object-literal.js b/test/mjsunit/object-literal.js
index 19860ff..b861d44 100644
--- a/test/mjsunit/object-literal.js
+++ b/test/mjsunit/object-literal.js
@@ -24,8 +24,6 @@
 // THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-//
-// Flags: --harmony-function-name
 
 var obj = {
     a: 7,
diff --git a/test/mjsunit/realm-property-access.js b/test/mjsunit/realm-property-access.js
new file mode 100644
index 0000000..679886d
--- /dev/null
+++ b/test/mjsunit/realm-property-access.js
@@ -0,0 +1,20 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r = Realm.create();
+var f = Realm.eval(r, "function f() { return this }; f()");
+assertEquals(f, Realm.global(r));
+
+// Cross-origin property access throws
+assertThrows(() => f.a, TypeError);
+assertThrows(() => { 'use strict'; f.a = 1 }, TypeError);
+
+var r2 = Realm.createAllowCrossRealmAccess();
+var f2 = Realm.eval(r2, "function f() { return this }; f()");
+assertEquals(f2, Realm.global(r2));
+
+// Same-origin property access doesn't throw
+assertEquals(undefined, f2.a);
+f2.a = 1;
+assertEquals(1, f2.a);
diff --git a/test/mjsunit/regexp-string-methods.js b/test/mjsunit/regexp-string-methods.js
index fa01a33..d5ad9c3 100644
--- a/test/mjsunit/regexp-string-methods.js
+++ b/test/mjsunit/regexp-string-methods.js
@@ -25,8 +25,6 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --no-harmony-regexp-exec
-
 // Regexp shouldn't use String.prototype.slice()
 var s = new String("foo");
 assertEquals("f", s.slice(0,1));
@@ -43,11 +41,3 @@
 var f2 = new RegExp("[g]", "i");
 assertEquals(["G"], f2.exec("G"));
 assertTrue(f2.ignoreCase);
-
-// On the other hand test is defined in a semi-coherent way as a call to exec.
-// 15.10.6.3
-// We match other browsers in using the original value of RegExp.prototype.exec.
-// I.e., RegExp.prototype.test shouldn't use the current value of
-// RegExp.prototype.exec.
-RegExp.prototype.exec = function(string) { return 'x'; };
-assertFalse(/f/.test('x'));
diff --git a/test/mjsunit/regress/regress-449070.js b/test/mjsunit/regress-crbug-619476.js
similarity index 61%
rename from test/mjsunit/regress/regress-449070.js
rename to test/mjsunit/regress-crbug-619476.js
index 7a0f0a8..33204ae 100644
--- a/test/mjsunit/regress/regress-449070.js
+++ b/test/mjsunit/regress-crbug-619476.js
@@ -1,10 +1,7 @@
 // Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --allow-natives-syntax
 
-try {
-  %NormalizeElements(this);
-} catch(e) {
-}
+var x = {};
+// Crashes in debug mode if an erroneous DCHECK in dfb8d333 is not removed.
+eval, x[eval];
diff --git a/test/mjsunit/regress/redeclaration-error-types.js b/test/mjsunit/regress/redeclaration-error-types.js
new file mode 100644
index 0000000..72e097d
--- /dev/null
+++ b/test/mjsunit/regress/redeclaration-error-types.js
@@ -0,0 +1,145 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function doTest(scripts, expectedError) {
+  var realm = Realm.create();
+
+  for (var i = 0; i < scripts.length - 1; i++) {
+    Realm.eval(realm, scripts[i]);
+  }
+  assertThrows(function() {
+    Realm.eval(realm, scripts[scripts.length - 1]);
+  }, Realm.eval(realm, expectedError));
+
+  Realm.dispose(realm);
+}
+
+var tests = [
+  {
+    // ES#sec-globaldeclarationinstantiation 5.a:
+    // If envRec.HasVarDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "var a;",
+      "let a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 6.a:
+    // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "let a;",
+      "var a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.b:
+    // If envRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      "let a;",
+      "let a;",
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+    // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      'let a; eval("var a;");',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.a.i.1:
+    // If varEnvRec.HasLexicalDeclaration(name) is true, throw a SyntaxError
+    // exception.
+    scripts: [
+      'let a; eval("function a() {}");',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+    // Throw a SyntaxError exception.
+    scripts: [
+      '(function() { let a; eval("var a;"); })();',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 5.d.ii.2.a.i:
+    // Throw a SyntaxError exception.
+    scripts: [
+      '(function() { let a; eval("function a() {}"); })();',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.d:
+    // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+    scripts: [
+      'let NaN;',
+    ],
+    expectedError: "SyntaxError",
+  },
+  {
+    // ES#sec-globaldeclarationinstantiation 5.d:
+    // If hasRestrictedGlobal is true, throw a SyntaxError exception.
+    scripts: [
+      'function NaN() {}',
+    ],
+    expectedError: "SyntaxError",
+  },
+
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      'eval("function NaN() {}");',
+    ],
+    expectedError: "TypeError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      `
+        let a;
+        try {
+          eval("function a() {}");
+        } catch (e) {}
+        eval("function NaN() {}");
+      `,
+    ],
+    expectedError: "TypeError",
+  },
+  {
+    // ES#sec-evaldeclarationinstantiation 8.a.iv.1.b:
+    // If fnDefinable is false, throw a TypeError exception.
+    scripts: [
+      `
+        eval("
+          function f() {
+            function b() {
+              (0, eval)('function NaN() {}');
+            }
+            b();
+          }
+          f();
+        ");
+      `.replace(/"/g, '`'),
+    ],
+    expectedError: "TypeError",
+  },
+];
+
+tests.forEach(function(test) {
+  doTest(test.scripts, test.expectedError);
+});
diff --git a/test/mjsunit/regress/regress-1132.js b/test/mjsunit/regress/regress-1132.js
index a5cb0a1..adb56b0 100644
--- a/test/mjsunit/regress/regress-1132.js
+++ b/test/mjsunit/regress/regress-1132.js
@@ -28,7 +28,7 @@
 // Test the case when exception is thrown from the parser when lazy
 // compiling a function.
 
-// Flags: --stack-size=46
+// Flags: --stack-size=100
 // NOTE: stack size constant above has been empirically chosen.
 // If the test starts to fail in Genesis, consider increasing this constant.
 
diff --git a/test/mjsunit/regress/regress-1246.js b/test/mjsunit/regress/regress-1246.js
deleted file mode 100644
index ca425ec..0000000
--- a/test/mjsunit/regress/regress-1246.js
+++ /dev/null
@@ -1,82 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// This regression tests the behaviour of the parseInt function when
-// the given radix is not a SMI.
-
-// Flags: --allow-natives-syntax
-
-var nonSmi10 = Math.log(Math.exp(10));
-var nonSmi16 = Math.log(Math.exp(16));
-
-assertTrue(!%_IsSmi(nonSmi10) && nonSmi10 == 10);
-assertTrue(!%_IsSmi(nonSmi16) && nonSmi16 == 16);
-
-// Giving these values as the radix argument triggers radix detection.
-var radix_detect = [0, -0, NaN, Infinity, -Infinity, undefined, null,
-                    "0", "-0", "a"];
-
-// These values will result in an integer radix outside of the valid range.
-var radix_invalid = [1, 37, -2, "-2", "37"];
-
-// These values will trigger decimal parsing.
-var radix10 = [10, 10.1, "10", "10.1", nonSmi10];
-
-// These values will trigger hexadecimal parsing.
-var radix16 = [16, 16.1, 0x10, "0X10", nonSmi16];
-
-for (var i = 0; i < radix_detect.length; i++) {
-  var radix = radix_detect[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(23, parseInt("23", radix));
-  assertEquals(0xaf, parseInt("0xaf", radix));
-  assertEquals(NaN, parseInt("af", radix));
-}
-
-for (var i = 0; i < radix_invalid.length; i++) {
-  var radix = radix_invalid[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(NaN, parseInt("23", radix));
-  assertEquals(NaN, parseInt("0xaf", radix));
-  assertEquals(NaN, parseInt("af", radix));
-}
-
-for (var i = 0; i < radix10.length; i++) {
-  var radix = radix10[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(23, parseInt("23", radix));
-  assertEquals(0, parseInt("0xaf", radix));
-  assertEquals(NaN, parseInt("af", radix));
-}
-
-for (var i = 0; i < radix16.length; i++) {
-  var radix = radix16[i];
-  assertEquals(NaN, parseInt("", radix));
-  assertEquals(0x23, parseInt("23", radix));
-  assertEquals(0xaf, parseInt("0xaf", radix));
-  assertEquals(0xaf, parseInt("af", radix));
-}
diff --git a/test/mjsunit/regress/regress-403292.js b/test/mjsunit/regress/regress-403292.js
deleted file mode 100644
index 2e24d48..0000000
--- a/test/mjsunit/regress/regress-403292.js
+++ /dev/null
@@ -1,55 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --expose-natives-as=builtins --expose-gc
-
-var SetIterator = builtins.ImportNow("SetIterator");
-var MapIterator = builtins.ImportNow("MapIterator");
-var __v_7 = [];
-var __v_8 = {};
-var __v_10 = {};
-var __v_11 = this;
-var __v_12 = {};
-var __v_13 = {};
-var __v_14 = "";
-var __v_15 = {};
-try {
-__v_1 = {x:0};
-%OptimizeFunctionOnNextCall(__f_1);
-assertEquals("good", __f_1());
-delete __v_1.x;
-assertEquals("good", __f_1());
-} catch(e) { print("Caught: " + e); }
-try {
-__v_3 = new Set();
-__v_5 = new SetIterator(__v_3, -12);
-__v_4 = new Map();
-__v_6 = new MapIterator(__v_4, 2);
-__f_3(Array);
-} catch(e) { print("Caught: " + e); }
-function __f_4(__v_8, filter) {
-  function __f_6(v) {
-    for (var __v_4 in v) {
-      for (var __v_4 in v) {}
-    }
-    %OptimizeFunctionOnNextCall(filter);
-    return filter(v);
-  }
-  var __v_7 = eval(__v_8);
-  gc();
-  return __f_6(__v_7);
-}
-function __f_5(__v_6) {
-  var __v_5 = new Array(__v_6);
-  for (var __v_4 = 0; __v_4 < __v_6; __v_4++) __v_5.push('{}');
-  return __v_5;
-}
-try {
-try {
-  __v_8.test("\x80");
-  assertUnreachable();
-} catch (e) {
-}
-gc();
-} catch(e) { print("Caught: " + e); }
diff --git a/test/mjsunit/regress/regress-4659.js b/test/mjsunit/regress/regress-4659.js
index ff436be..8992bb8 100644
--- a/test/mjsunit/regress/regress-4659.js
+++ b/test/mjsunit/regress/regress-4659.js
@@ -1,8 +1,6 @@
 // Copyright 2016 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --harmony-function-name
 
 var obj = {
   get longerName(){
diff --git a/test/mjsunit/regress/regress-4665-2.js b/test/mjsunit/regress/regress-4665-2.js
deleted file mode 100644
index b94301e..0000000
--- a/test/mjsunit/regress/regress-4665-2.js
+++ /dev/null
@@ -1,33 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --harmony-species
-
-// First test case
-
-function FirstBuffer () {}
-FirstBuffer.prototype.__proto__ = Uint8Array.prototype
-FirstBuffer.__proto__ = Uint8Array
-
-var buf = new Uint8Array(10)
-buf.__proto__ = FirstBuffer.prototype
-
-var buf2 = buf.subarray(2)
-assertEquals(8, buf2.length);
-
-// Second test case
-
-function SecondBuffer (arg) {
-  var arr = new Uint8Array(arg)
-  arr.__proto__ = SecondBuffer.prototype
-  return arr
-}
-SecondBuffer.prototype.__proto__ = Uint8Array.prototype
-SecondBuffer.__proto__ = Uint8Array
-
-var buf3 = new SecondBuffer(10)
-
-var buf4 = buf3.subarray(2)
-
-assertEquals(8, buf4.length);
diff --git a/test/mjsunit/regress/regress-4665.js b/test/mjsunit/regress/regress-4665.js
index 9d7307a..a75d68f 100644
--- a/test/mjsunit/regress/regress-4665.js
+++ b/test/mjsunit/regress/regress-4665.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --noharmony-species
-
 // First test case
 
 function FirstBuffer () {}
diff --git a/test/mjsunit/regress/regress-4703.js b/test/mjsunit/regress/regress-4703.js
new file mode 100644
index 0000000..dad8a97
--- /dev/null
+++ b/test/mjsunit/regress/regress-4703.js
@@ -0,0 +1,30 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    var all_scopes = exec_state.frame().allScopes();
+    assertEquals([ debug.ScopeType.Block,
+                   debug.ScopeType.Local,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global ],
+                 all_scopes.map(scope => scope.scopeType()));
+  } catch (e) {
+    exception = e;
+  }
+}
+
+debug.Debug.setListener(listener);
+
+(function(arg, ...rest) {
+  var one = 1;
+  function inner() {
+    one;
+    arg;
+  }
+  debugger;
+})();
diff --git a/test/mjsunit/regress/regress-4815.js b/test/mjsunit/regress/regress-4815.js
new file mode 100644
index 0000000..00e61cb
--- /dev/null
+++ b/test/mjsunit/regress/regress-4815.js
@@ -0,0 +1,38 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var thrower = { [Symbol.toPrimitive]: () => FAIL };
+
+// Tests that a native conversion function is included in the
+// stack trace.
+function testTraceNativeConversion(nativeFunc) {
+  var nativeFuncName = nativeFunc.name;
+  try {
+    nativeFunc(thrower);
+    assertUnreachable(nativeFuncName);
+  } catch (e) {
+    assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
+  }
+}
+
+testTraceNativeConversion(Math.max);
+testTraceNativeConversion(Math.min);
+
+function testBuiltinInStackTrace(script, nativeFuncName) {
+  try {
+    eval(script);
+    assertUnreachable(nativeFuncName);
+  } catch (e) {
+    assertTrue(e.stack.indexOf(nativeFuncName) >= 0, nativeFuncName);
+  }
+}
+
+// Use the full name ('String.getDate') in order to avoid false pass
+// results when the method name is mentioned in the error message itself.
+// This occurs, e.g., for Date.prototype.getYear, which uses a different code
+// path and never hits the Generate_DatePrototype_GetField builtin.
+testBuiltinInStackTrace("Date.prototype.getDate.call('')", "String.getDate");
+testBuiltinInStackTrace("Date.prototype.getUTCDate.call('')",
+                        "String.getUTCDate");
+testBuiltinInStackTrace("Date.prototype.getTime.call('')", "String.getTime");
diff --git a/test/mjsunit/regress/regress-5004.js b/test/mjsunit/regress/regress-5004.js
new file mode 100644
index 0000000..234f5d4
--- /dev/null
+++ b/test/mjsunit/regress/regress-5004.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertAsync(b, s) {
+  if (!b) {
+    %AbortJS(" FAILED!")
+  }
+}
+
+class P extends Promise {
+  constructor() {
+    super(...arguments)
+    return new Proxy(this, {
+      get: (_, key) => {
+        return key == 'then' ?
+            this.then.bind(this) :
+            this.constructor.resolve(20)
+      }
+    })
+  }
+}
+
+let p = P.resolve(10)
+p.key.then(v => assertAsync(v === 20));
diff --git a/test/mjsunit/regress/regress-5018.js b/test/mjsunit/regress/regress-5018.js
new file mode 100644
index 0000000..22025dc
--- /dev/null
+++ b/test/mjsunit/regress/regress-5018.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var dv = new DataView(new ArrayBuffer(4), 2);
+
+function getByteLength(a) {
+  return a.byteLength;
+}
+
+assertEquals(2, getByteLength(dv));
+assertEquals(2, getByteLength(dv));
+
+Object.defineProperty(dv.__proto__, 'byteLength', {value: 42});
+
+assertEquals(42, dv.byteLength);
+assertEquals(42, getByteLength(dv));
+
+function getByteOffset(a) {
+  return a.byteOffset;
+}
+
+assertEquals(2, getByteOffset(dv));
+assertEquals(2, getByteOffset(dv));
+
+Object.defineProperty(dv.__proto__, 'byteOffset', {value: 42});
+
+assertEquals(42, dv.byteOffset);
+assertEquals(42, getByteOffset(dv));
diff --git a/test/mjsunit/regress/regress-5036.js b/test/mjsunit/regress/regress-5036.js
index 036edd9..77bd242 100644
--- a/test/mjsunit/regress/regress-5036.js
+++ b/test/mjsunit/regress/regress-5036.js
@@ -2,6 +2,4 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 assertEquals(["1\u212a"], /\d\w/ui.exec("1\u212a"));
diff --git a/test/mjsunit/regress/regress-5071.js b/test/mjsunit/regress/regress-5071.js
new file mode 100644
index 0000000..41c1250
--- /dev/null
+++ b/test/mjsunit/regress/regress-5071.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+  assertEquals(2, exec_state.frameCount());
+  assertEquals("a", exec_state.frame(0).localName(0));
+  assertEquals("1", exec_state.frame(0).localValue(0).value());
+  assertEquals(1, exec_state.frame(0).localCount());
+}
+
+Debug.setListener(listener);
+
+function f() {
+  var a = 1;
+  {
+    let b = 2;
+    debugger;
+  }
+}
+
+f();
diff --git a/test/mjsunit/regress/regress-5085.js b/test/mjsunit/regress/regress-5085.js
new file mode 100644
index 0000000..0ed034d
--- /dev/null
+++ b/test/mjsunit/regress/regress-5085.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+  return x instanceof Proxy;
+}
+
+assertFalse(foo({}));
+assertFalse(foo({}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({}));
diff --git a/test/mjsunit/regress/regress-5106.js b/test/mjsunit/regress/regress-5106.js
new file mode 100644
index 0000000..52d550a
--- /dev/null
+++ b/test/mjsunit/regress/regress-5106.js
@@ -0,0 +1,29 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function* g1() {
+  try {
+    throw {};
+  } catch ({a = class extends (yield) {}}) {
+  }
+}
+g1().next();  // crashes without fix
+
+function* g2() {
+  let x = function(){};
+  try {
+    throw {};
+  } catch ({b = class extends x {}}) {
+  }
+}
+g2().next();  // crashes without fix
+
+function* g3() {
+  let x = 42;
+  try {
+    throw {};
+  } catch ({c = (function() { return x })()}) {
+  }
+}
+g3().next();  // throws a ReferenceError without fix
diff --git a/test/mjsunit/regress/regress-5174.js b/test/mjsunit/regress/regress-5174.js
new file mode 100644
index 0000000..390d24e
--- /dev/null
+++ b/test/mjsunit/regress/regress-5174.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// // Use of this source code is governed by a BSD-style license that can be
+// // found in the LICENSE file.
+
+assertEquals([], Object.keys(new Proxy([], {})));
+assertEquals([], Object.keys(new Proxy(/regex/, {})));
diff --git a/test/mjsunit/regress/regress-544991.js b/test/mjsunit/regress/regress-544991.js
index 911d8ac..a9fd809 100644
--- a/test/mjsunit/regress/regress-544991.js
+++ b/test/mjsunit/regress/regress-544991.js
@@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-species
-
 'use strict';
 
 var typedArray = new Int8Array(1);
diff --git a/test/mjsunit/regress/regress-612146.js b/test/mjsunit/regress/regress-612146.js
new file mode 100644
index 0000000..1bd3f0b
--- /dev/null
+++ b/test/mjsunit/regress/regress-612146.js
@@ -0,0 +1,33 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+  var arguments_ = arguments;
+  if (undefined) {
+    while (true) {
+      arguments_[0];
+    }
+  } else {
+    %DeoptimizeNow();
+    return arguments_[0];
+  }
+};
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(1));
+
+function g() {
+    var a = arguments;
+    %DeoptimizeNow();
+    return a.length;
+}
+
+g(1);
+g(1);
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g(1));
diff --git a/test/mjsunit/regress/regress-612412.js b/test/mjsunit/regress/regress-612412.js
new file mode 100644
index 0000000..3debe66
--- /dev/null
+++ b/test/mjsunit/regress/regress-612412.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function counter() { return {x: 0} || this }
+
+var f = (function() {
+  "use asm";
+  return function g(c1, c2) {
+    for (var x = 0 ; x < 10; ++x) {
+      if (x == 5) %OptimizeOsr();
+      c1();
+    }
+  }
+})();
+
+g = (function() { f((Array), counter()); });
+g();
diff --git a/test/mjsunit/regress/regress-615776.js b/test/mjsunit/regress/regress-615776.js
new file mode 100644
index 0000000..7e89b56
--- /dev/null
+++ b/test/mjsunit/regress/regress-615776.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(Int32Array.prototype.__proto__, 'length', {
+  get: function() { throw new Error('Custom length property'); }
+});
+
+var a = Math.random();
+
+// This tests MathRandomRaw.
+var v0 = new Set();
+var v1 = new Object();
+v0.add(v1);
diff --git a/test/mjsunit/regress/regress-617525.js b/test/mjsunit/regress/regress-617525.js
new file mode 100644
index 0000000..bb77e06
--- /dev/null
+++ b/test/mjsunit/regress/regress-617525.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_14() {
+  "use asm";
+  function __f_15() { return 0; }
+  function __f_15() { return 137; }  // redeclared function
+  return {};
+}
+assertThrows(function() { Wasm.instantiateModuleFromAsm(__f_14.toString()) });
diff --git a/test/mjsunit/regress/regress-617529.js b/test/mjsunit/regress/regress-617529.js
new file mode 100644
index 0000000..415e6c7
--- /dev/null
+++ b/test/mjsunit/regress/regress-617529.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function __f_71(stdlib, buffer) {
+  "use asm";
+  var __v_22 = new stdlib.Float64Array(buffer);
+  function __f_26() {
+    __v_22 = __v_22;
+  }
+  return {__f_26: __f_26};
+}
+
+assertThrows(function() { Wasm.instantiateModuleFromAsm( __f_71.toString()); });
diff --git a/test/mjsunit/regress/regress-618657.js b/test/mjsunit/regress/regress-618657.js
new file mode 100644
index 0000000..2882cff
--- /dev/null
+++ b/test/mjsunit/regress/regress-618657.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --ignition --ignition-generators --ignition-filter=-foo
+
+function* foo() { yield 42 }
+function* goo() { yield 42 }
+var f = foo();
+var g = goo();
+assertEquals(42, f.next().value);
+assertEquals(42, g.next().value);
+assertEquals(true, f.next().done);
+assertEquals(true, g.next().done);
diff --git a/test/mjsunit/regress/regress-620750.js b/test/mjsunit/regress/regress-620750.js
new file mode 100644
index 0000000..ab8fbd9
--- /dev/null
+++ b/test/mjsunit/regress/regress-620750.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --es-staging
+
+function push_a_lot(arr) {
+  for (var i = 0; i < 2e4; i++) {
+    arr.push(i);
+  }
+  return arr;
+}
+
+__v_13 = push_a_lot([]);
diff --git a/test/mjsunit/regress/regress-622663.js b/test/mjsunit/regress/regress-622663.js
new file mode 100644
index 0000000..9606bd8
--- /dev/null
+++ b/test/mjsunit/regress/regress-622663.js
@@ -0,0 +1,14 @@
++// Copyright 2016 the V8 project authors. All rights reserved.
++// Use of this source code is governed by a BSD-style license that can be
++// found in the LICENSE file.
++
++// Flags: --no-lazy
+
+(function() {
+  try { (y = [...[]]) => {} } catch(_) {}  // will core dump, if not fixed
+})();
+
+(function() {
+  try { ((y = [...[]]) => {})(); } catch(_) {}  // will core dump, if not fixed,
+                                                // even without --no-lazy
+})();
diff --git a/test/mjsunit/regress/regress-crbug-320922.js b/test/mjsunit/regress/regress-crbug-320922.js
deleted file mode 100644
index f199628..0000000
--- a/test/mjsunit/regress/regress-crbug-320922.js
+++ /dev/null
@@ -1,50 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-var string = "internalized dummy";
-var expected = "internalized dummy";
-string = "hello world";
-expected = "Hello " + "world";
-function Capitalize() {
-  %_OneByteSeqStringSetChar(0, 0x48, string);
-}
-Capitalize();
-assertEquals(expected, string);
-Capitalize();
-assertEquals(expected, string);
-
-var twobyte = "\u20ACello world";
-
-function TwoByteCapitalize() {
-  %_TwoByteSeqStringSetChar(0, 0x48, twobyte);
-}
-TwoByteCapitalize();
-assertEquals(expected, twobyte);
-TwoByteCapitalize();
-assertEquals(expected, twobyte);
diff --git a/test/mjsunit/regress/regress-crbug-495493.js b/test/mjsunit/regress/regress-crbug-495493.js
new file mode 100644
index 0000000..3dba236
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-495493.js
@@ -0,0 +1,12 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --nofold-constants --enable-slow-asserts --debug-code
+
+function foo(p) {
+  for (var i = 0; i < 100000; ++i) {
+    p = Math.min(-1, 0);
+  }
+}
+foo(0);
diff --git a/test/mjsunit/regress/regress-crbug-498142.js b/test/mjsunit/regress/regress-crbug-498142.js
deleted file mode 100644
index fcec5d1..0000000
--- a/test/mjsunit/regress/regress-crbug-498142.js
+++ /dev/null
@@ -1,8 +0,0 @@
-// Copyright 2015 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --harmony-sharedarraybuffer
-
-var sab = new SharedArrayBuffer(16);
-assertThrows(function() { %ArrayBufferNeuter(sab); });
diff --git a/test/mjsunit/regress/regress-crbug-600995.js b/test/mjsunit/regress/regress-crbug-600995.js
deleted file mode 100644
index c532608..0000000
--- a/test/mjsunit/regress/regress-crbug-600995.js
+++ /dev/null
@@ -1,10 +0,0 @@
-// Copyright 2016 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --noharmony-iterator-close
-
-// The {Set} function will produce a different type feedback vector layout
-// depending on whether Harmony iterator finalization is enabled or not.
-
-new Set();
diff --git a/test/mjsunit/regress/regress-crbug-605862.js b/test/mjsunit/regress/regress-crbug-605862.js
index 3124c06..82a5d45 100644
--- a/test/mjsunit/regress/regress-crbug-605862.js
+++ b/test/mjsunit/regress/regress-crbug-605862.js
@@ -2,7 +2,5 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-unicode-regexps
-
 /[]*1/u.exec("\u1234");
 /[^\u0000-\u{10ffff}]*1/u.exec("\u1234");
diff --git a/test/mjsunit/regress/regress-crbug-612109.js b/test/mjsunit/regress/regress-crbug-612109.js
new file mode 100644
index 0000000..202bd96
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-612109.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+s = "string for triggering osr in __f_0";
+for (var i = 0; i < 16; i++) s = s + s;
+decodeURI(encodeURI(s));
diff --git a/test/mjsunit/regress/regress-crbug-613494.js b/test/mjsunit/regress/regress-crbug-613494.js
new file mode 100644
index 0000000..6fcc1e9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-613494.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape --noanalyze-environment-liveness
+
+function f() {
+  var bound = 0;
+  function g() { return bound }
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-613570.js b/test/mjsunit/regress/regress-crbug-613570.js
new file mode 100644
index 0000000..3cd9857
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-613570.js
@@ -0,0 +1,6 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("[\n\u26031,\n\u26032\n]",
+             JSON.stringify([1, 2], null, "\u2603"));
diff --git a/test/mjsunit/regress/regress-crbug-613905.js b/test/mjsunit/regress/regress-crbug-613905.js
new file mode 100644
index 0000000..8bb38c9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-613905.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
+
+try {
+  (new CallSiteConstructor(3, 6)).toString();
+} catch (e) {
+}
diff --git a/test/mjsunit/regress/regress-crbug-613919.js b/test/mjsunit/regress/regress-crbug-613919.js
new file mode 100644
index 0000000..cbd3e43
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-613919.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo-escape
+
+function g(a) {
+  if (a) return arguments;
+  %DeoptimizeNow();
+  return 23;
+}
+function f() {
+  return g(false);
+}
+assertEquals(23, f());
+assertEquals(23, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(23, f());
diff --git a/test/mjsunit/regress/regress-crbug-614292.js b/test/mjsunit/regress/regress-crbug-614292.js
new file mode 100644
index 0000000..3a67c17
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-614292.js
@@ -0,0 +1,14 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+  return [] | 0 && values[0] || false;
+}
+
+%OptimizeFunctionOnNextCall(foo);
+try {
+  foo();
+} catch (e) {}
diff --git a/test/mjsunit/regress/regress-crbug-614727.js b/test/mjsunit/regress/regress-crbug-614727.js
new file mode 100644
index 0000000..0845afc
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-614727.js
@@ -0,0 +1,23 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+
+function f(a, b, c) { return arguments }
+function g(...args) { return args }
+
+// On 64-bit machine this produces a 768K array which is sufficiently small to
+// not cause a stack overflow, but big enough to move the allocated arguments
+// object into large object space (kMaxRegularHeapObjectSize == 600K).
+var length = Math.pow(2, 15) * 3;
+var args = new Array(length);
+assertEquals(length, f.apply(null, args).length);
+assertEquals(length, g.apply(null, args).length);
+
+// On 32-bit machines this produces an equally sized array, however it might in
+// turn trigger a stack overflow on 64-bit machines, which we need to catch.
+var length = Math.pow(2, 16) * 3;
+var args = new Array(length);
+try { f.apply(null, args) } catch(e) {}
+try { g.apply(null, args) } catch(e) {}
diff --git a/test/mjsunit/regress/regress-crbug-615774.js b/test/mjsunit/regress/regress-crbug-615774.js
new file mode 100644
index 0000000..ea5e675
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-615774.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Error.prepareStackTrace = (e,s) => s;
+var CallSiteConstructor = Error().stack[0].constructor;
+
+try {
+  (new CallSiteConstructor(CallSiteConstructor, 6)).toString();
+} catch (e) {
+}
diff --git a/test/mjsunit/regress/regress-crbug-617527.js b/test/mjsunit/regress/regress-crbug-617527.js
new file mode 100644
index 0000000..cf46628
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-617527.js
@@ -0,0 +1,8 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --enable-slow-asserts
+
+Object.defineProperty(Array.prototype, "1", { get: toLocaleString });
+assertThrows(_ => new RegExp(0, 0));
diff --git a/test/mjsunit/regress/regress-crbug-617567.js b/test/mjsunit/regress/regress-crbug-617567.js
new file mode 100644
index 0000000..f0c696e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-617567.js
@@ -0,0 +1,24 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --turbo-filter=* --allow-natives-syntax
+
+var v1 = {};
+function g() {
+  v1 = [];
+  for (var i = 0; i < 1; i++) {
+    v1[i]();
+  }
+}
+
+var v2 = {};
+var v3 = {};
+function f() {
+  v3 = v2;
+  g();
+}
+
+assertThrows(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(f);
diff --git a/test/mjsunit/regress/regress-crbug-618788.js b/test/mjsunit/regress/regress-crbug-618788.js
new file mode 100644
index 0000000..a104d8d
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-618788.js
@@ -0,0 +1,21 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Slice and splice both try to set the length property of their return
+// value. Add a bogus setter to allow that.
+Object.defineProperty(Int32Array.prototype, 'length', { set(v) { } });
+
+(function testSlice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.slice() instanceof Int32Array);
+})();
+
+(function testSplice() {
+  var a = new Array();
+  a.constructor = Int32Array;
+  a.length = 1000; // Make the length >= 1000 so UseSparseVariant returns true.
+  assertTrue(a.splice(1) instanceof Int32Array);
+})();
diff --git a/test/mjsunit/regress/regress-crbug-618845.js b/test/mjsunit/regress/regress-crbug-618845.js
new file mode 100644
index 0000000..ea3baba
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-618845.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Foo() {}
+Object.defineProperty(Foo.prototype, "name",
+                      {get: function() { return "FooName"; }});
+
+function ic(f) {
+  return f.prototype.name;
+}
+
+assertEquals("FooName", ic(Foo));
+assertEquals("FooName", ic(Foo));  // Don't crash, don't time out.
diff --git a/test/mjsunit/regress/regress-crbug-620253.js b/test/mjsunit/regress/regress-crbug-620253.js
new file mode 100644
index 0000000..811a4e7
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-620253.js
@@ -0,0 +1,7 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --throws
+
+load("test/mjsunit/regress/regress-crbug-620253.js");
diff --git a/test/mjsunit/regress/regress-crbug-620650.js b/test/mjsunit/regress/regress-crbug-620650.js
new file mode 100644
index 0000000..25a92ca
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-620650.js
@@ -0,0 +1,16 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function() {
+  function f(src, dst, i) {
+    dst[i] = src[i];
+  }
+  var buf = new ArrayBuffer(16);
+  var view_int32 = new Int32Array(buf);
+  view_int32[1] = 0xFFF7FFFF;
+  var view_f64 = new Float64Array(buf);
+  var arr = [,0.1];
+  f(view_f64, arr, -1);
+  f(view_f64, arr, 0);
+})();
diff --git a/test/mjsunit/regress/regress-crbug-621361.js b/test/mjsunit/regress/regress-crbug-621361.js
new file mode 100644
index 0000000..f9496ae
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-621361.js
@@ -0,0 +1,40 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+var Debug = debug.Debug;
+var steps = 0;
+var exception = null;
+
+function listener(event, execState, eventData, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    assertEquals([ debug.ScopeType.Local,
+                   debug.ScopeType.Script,
+                   debug.ScopeType.Global],
+                 execState.frame().allScopes().map(s => s.scopeType()));
+    var x_value = execState.frame().evaluate("x").value();
+    if (steps < 2) {
+      assertEquals(undefined, x_value);
+      execState.prepareStep(Debug.StepAction.StepIn);
+    } else {
+      assertEquals("l => l", x_value.toString());
+    }
+    steps++;
+  } catch (e) {
+    exception = e;
+  }
+}
+
+Debug.setListener(listener);
+
+(function() {
+  debugger;
+  var x = l => l;
+})();
+
+Debug.setListener(null);
+assertNull(exception);
+assertEquals(3, steps);
diff --git a/test/mjsunit/regress/regress-crbug-621611.js b/test/mjsunit/regress/regress-crbug-621611.js
new file mode 100644
index 0000000..bf9a460
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-621611.js
@@ -0,0 +1,11 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals(Math.E, Math.exp(1));
+assertEquals(Math.LN10, Math.log(10));
+assertEquals(Math.LN2, Math.log(2));
+assertEquals(Math.LOG10E, Math.log10(Math.E));
+assertEquals(Math.LOG2E, Math.log2(Math.E));
+assertEquals(Math.SQRT1_2, Math.sqrt(0.5));
+assertEquals(Math.SQRT2, Math.sqrt(2));
diff --git a/test/mjsunit/regress/regress-crbug-621816.js b/test/mjsunit/regress/regress-crbug-621816.js
new file mode 100644
index 0000000..ca7f5ac
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-621816.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --turbo
+
+function f() {
+  var o = {};
+  o.a = 1;
+}
+function g() {
+  var o = { ['a']: function(){} };
+  f();
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/test/mjsunit/regress/regress-crbug-633585.js b/test/mjsunit/regress/regress-crbug-633585.js
new file mode 100644
index 0000000..c483e47
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-633585.js
@@ -0,0 +1,18 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --turbo --always-opt
+
+function f() { this.x = this.x.x; }
+gc();
+f.prototype.x = { x:1 }
+new f();
+new f();
+
+function g() {
+  function h() {};
+  h.prototype = { set x(value) { } };
+  new f();
+}
+g();
diff --git a/test/mjsunit/regress/regress-crbug-642056.js b/test/mjsunit/regress/regress-crbug-642056.js
new file mode 100644
index 0000000..ca9fc78
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-642056.js
@@ -0,0 +1,17 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+  return o.x instanceof Array;
+}
+
+var o = { x : 1.5 };
+o.x = 0;
+
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+f(o);
diff --git a/test/mjsunit/regress/regress-put-prototype-transition.js b/test/mjsunit/regress/regress-put-prototype-transition.js
index 70f0074..c5b4c5a 100644
--- a/test/mjsunit/regress/regress-put-prototype-transition.js
+++ b/test/mjsunit/regress/regress-put-prototype-transition.js
@@ -30,7 +30,7 @@
     __f_4(__v_1);
     assertFalse(%HasFastProperties(__v_1));
     __f_0(__v_1, __v_6);
-    assertTrue(%HasFastProperties(__v_1));
+    assertFalse(%HasFastProperties(__v_1));
   } else {
     __f_0(__v_1, __v_6);
     assertTrue(%HasFastProperties(__v_1));
diff --git a/test/mjsunit/regress/regress-seqstrsetchar-ex1.js b/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
deleted file mode 100644
index 444fe4b..0000000
--- a/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
+++ /dev/null
@@ -1,59 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-// stubbed version of ToNumber
-function ToNumber(x) {
-  return 311;
-}
-
-// Reduced version of String.fromCharCode;
-// does not actually do the same calculation but exhibits untagging bug.
-function StringFromCharCode(code) {
-  var n = arguments.length;
-  var one_byte = %NewString(n, true);
-  var i;
-  for (i = 0; i < n; i++) {
-    var code = arguments[i];
-    if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
-    if (code > 0xff) break;
-  }
-
-  var two_byte = %NewString(n - i, false);
-  for (var j = 0; i < n; i++, j++) {
-    var code = arguments[i];
-    %_TwoByteSeqStringSetChar(j, code, two_byte);
-  }
-  return one_byte + two_byte;
-}
-
-StringFromCharCode(0xFFF, 0xFFF);
-StringFromCharCode(0x7C, 0x7C);
-%OptimizeFunctionOnNextCall(StringFromCharCode);
-StringFromCharCode(0x7C, 0x7C);
-StringFromCharCode(0xFFF, 0xFFF);
diff --git a/test/mjsunit/regress/regress-seqstrsetchar-ex3.js b/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
deleted file mode 100644
index 0a6b211..0000000
--- a/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
+++ /dev/null
@@ -1,44 +0,0 @@
-// Copyright 2013 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-function test() {
-  var string = %NewString(10, true);
-  for (var i = 0; i < 10; i++) {
-    %_OneByteSeqStringSetChar(i, 65, string);
-    %_OneByteSeqStringSetChar(i, 66, string);
-  }
-  for (var i = 0; i < 10; i++) {
-    assertEquals("B", string[i]);
-  }
-}
-
-test();
-test();
-%OptimizeFunctionOnNextCall(test);
-test();
diff --git a/test/mjsunit/regress/regress-string-from-char-code-tonumber.js b/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
new file mode 100644
index 0000000..a02a277
--- /dev/null
+++ b/test/mjsunit/regress/regress-string-from-char-code-tonumber.js
@@ -0,0 +1,26 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var thrower = { [Symbol.toPrimitive]: function() { FAIL } };
+
+function testTrace(func) {
+  try {
+    func(thrower);
+    assertUnreachable();
+  } catch (e) {
+    assertTrue(e.stack.indexOf("fromCharCode") >= 0);
+  }
+}
+
+testTrace(String.fromCharCode);
+
+function foo(x) { return String.fromCharCode(x); }
+
+foo(1);
+foo(2);
+testTrace(foo);
+%OptimizeFunctionOnNextCall(foo);
+testTrace(foo);
diff --git a/test/mjsunit/regress/regress-typedarray-length.js b/test/mjsunit/regress/regress-typedarray-length.js
index a0b9998..0dde61f 100644
--- a/test/mjsunit/regress/regress-typedarray-length.js
+++ b/test/mjsunit/regress/regress-typedarray-length.js
@@ -108,13 +108,13 @@
   assertEquals("blah", get(a));
 })();
 
-// Ensure we cannot delete length, byteOffset, byteLength.
+// Ensure we can delete length, byteOffset, byteLength.
 assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("length"));
 assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteOffset"));
 assertTrue(Int32Array.prototype.__proto__.hasOwnProperty("byteLength"));
-assertFalse(delete Int32Array.prototype.__proto__.length);
-assertFalse(delete Int32Array.prototype.__proto__.byteOffset);
-assertFalse(delete Int32Array.prototype.__proto__.byteLength);
+assertTrue(delete Int32Array.prototype.__proto__.length);
+assertTrue(delete Int32Array.prototype.__proto__.byteOffset);
+assertTrue(delete Int32Array.prototype.__proto__.byteLength);
 
 a = new Int32Array(100);
 
@@ -122,28 +122,28 @@
   return a.length;
 }
 
-assertEquals(100, get(a));
-assertEquals(100, get(a));
-assertEquals(100, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
 %OptimizeFunctionOnNextCall(get);
-assertEquals(100, get(a));
+assertEquals(undefined, get(a));
 
 get = function(a) {
   return a.byteLength;
 }
 
-assertEquals(400, get(a));
-assertEquals(400, get(a));
-assertEquals(400, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
 %OptimizeFunctionOnNextCall(get);
-assertEquals(400, get(a));
+assertEquals(undefined, get(a));
 
 get = function(a) {
   return a.byteOffset;
 }
 
-assertEquals(0, get(a));
-assertEquals(0, get(a));
-assertEquals(0, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
+assertEquals(undefined, get(a));
 %OptimizeFunctionOnNextCall(get);
-assertEquals(0, get(a));
+assertEquals(undefined, get(a));
diff --git a/test/mjsunit/regress/string-set-char-deopt.js b/test/mjsunit/regress/string-set-char-deopt.js
deleted file mode 100644
index 8956e28..0000000
--- a/test/mjsunit/regress/string-set-char-deopt.js
+++ /dev/null
@@ -1,85 +0,0 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-(function OneByteSeqStringSetCharDeoptOsr() {
-  function deopt() {
-    %DeoptimizeFunction(f);
-  }
-
-  function f(string, osr) {
-    var world = " world";
-    %_OneByteSeqStringSetChar(0, (deopt(), 0x48), string);
-
-    for (var i = 0; osr && i < 2; i++) %OptimizeOsr();
-
-    return string + world;
-  }
-
-  assertEquals("Hello " + "world", f("hello", false));
-  %OptimizeFunctionOnNextCall(f);
-  assertEquals("Hello " + "world", f("hello", true));
-})();
-
-
-(function OneByteSeqStringSetCharDeopt() {
-  function deopt() {
-    %DeoptimizeFunction(f);
-  }
-
-  function g(x) {
-  }
-
-  function f(string) {
-    g(%_OneByteSeqStringSetChar(0, (deopt(), 0x48), string));
-    return string;
-  }
-
-  assertEquals("Hell" + "o", f("hello"));
-  %OptimizeFunctionOnNextCall(f);
-  assertEquals("Hell" + "o", f("hello"));
-})();
-
-
-(function TwoByteSeqStringSetCharDeopt() {
-  function deopt() {
-    %DeoptimizeFunction(f);
-  }
-
-  function g(x) {
-  }
-
-  function f(string) {
-    g(%_TwoByteSeqStringSetChar(0, (deopt(), 0x48), string));
-    return string;
-  }
-
-  assertEquals("Hell" + "o", f("\u20ACello"));
-  %OptimizeFunctionOnNextCall(f);
-  assertEquals("Hell" + "o", f("\u20ACello"));
-})();
diff --git a/test/mjsunit/string-natives.js b/test/mjsunit/string-natives.js
deleted file mode 100644
index 40fe9c6..0000000
--- a/test/mjsunit/string-natives.js
+++ /dev/null
@@ -1,79 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-//     * Redistributions of source code must retain the above copyright
-//       notice, this list of conditions and the following disclaimer.
-//     * Redistributions in binary form must reproduce the above
-//       copyright notice, this list of conditions and the following
-//       disclaimer in the documentation and/or other materials provided
-//       with the distribution.
-//     * Neither the name of Google Inc. nor the names of its
-//       contributors may be used to endorse or promote products derived
-//       from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --expose-gc --allow-natives-syntax
-
-function test() {
-  var s1 = %NewString(26, true);
-  for (i = 0; i < 26; i++) %_OneByteSeqStringSetChar(i, 65, s1);
-  assertEquals("AAAAAAAAAAAAAAAAAAAAAAAAAA", s1);
-  %_OneByteSeqStringSetChar(25, 66, s1);
-  assertEquals("AAAAAAAAAAAAAAAAAAAAAAAAAB", s1);
-  for (i = 0; i < 26; i++) %_OneByteSeqStringSetChar(i, i+65, s1);
-  assertEquals("ABCDEFGHIJKLMNOPQRSTUVWXYZ", s1);
-  s1 = %TruncateString(s1, 13);
-  assertEquals("ABCDEFGHIJKLM", s1);
-
-  var s2 = %NewString(26, false);
-  for (i = 0; i < 26; i++) %_TwoByteSeqStringSetChar(i, 65, s2);
-  assertEquals("AAAAAAAAAAAAAAAAAAAAAAAAAA", s2);
-  %_TwoByteSeqStringSetChar(25, 66, s2);
-  assertEquals("AAAAAAAAAAAAAAAAAAAAAAAAAB", s2);
-  for (i = 0; i < 26; i++) %_TwoByteSeqStringSetChar(i, i+65, s2);
-  assertEquals("ABCDEFGHIJKLMNOPQRSTUVWXYZ", s2);
-  s2 = %TruncateString(s2, 13);
-  assertEquals("ABCDEFGHIJKLM", s2);
-
-  var s3 = %NewString(26, false);
-  for (i = 0; i < 26; i++) %_TwoByteSeqStringSetChar(i, i+1000, s3);
-  for (i = 0; i < 26; i++) assertEquals(s3[i], String.fromCharCode(i+1000));
-
-  var a = [];
-  for (var i = 0; i < 1000; i++) {
-    var s = %NewString(10000, i % 2 == 1);
-    a.push(s);
-  }
-
-  gc();
-
-  for (var i = 0; i < 1000; i++) {
-    assertEquals(10000, a[i].length);
-    a[i] = %TruncateString(a[i], 5000);
-  }
-
-  gc();
-
-  for (var i = 0; i < 1000; i++) {
-    assertEquals(5000, a[i].length);
-  }
-}
-
-
-test();
-test();
-%OptimizeFunctionOnNextCall(test);
-test();
diff --git a/test/mjsunit/tools/dumpcpp.js b/test/mjsunit/tools/dumpcpp.js
new file mode 100644
index 0000000..49b4675
--- /dev/null
+++ b/test/mjsunit/tools/dumpcpp.js
@@ -0,0 +1,53 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Load implementations from <project root>/tools.
+// Files: tools/splaytree.js tools/codemap.js tools/csvparser.js
+// Files: tools/consarray.js tools/profile.js tools/profile_view.js
+// Files: tools/logreader.js tools/tickprocessor.js
+// Files: tools/dumpcpp.js
+// Env: TEST_FILE_NAME
+
+(function testProcessSharedLibrary() {
+  var oldLoadSymbols = UnixCppEntriesProvider.prototype.loadSymbols;
+
+  UnixCppEntriesProvider.prototype.loadSymbols = function(libName) {
+    this.symbols = [[
+      '00000100 00000001 t v8::internal::Runtime_StringReplaceRegExpWithString(v8::internal::Arguments)',
+      '00000110 00000001 T v8::internal::Runtime::GetElementOrCharAt(v8::internal::Handle<v8::internal::Object>, unsigned int)',
+      '00000120 00000001 t v8::internal::Runtime_DebugGetPropertyDetails(v8::internal::Arguments)',
+      '00000130 00000001 W v8::internal::RegExpMacroAssembler::CheckPosition(int, v8::internal::Label*)'
+    ].join('\n'), ''];
+  };
+
+  var testCppProcessor = new CppProcessor(new UnixCppEntriesProvider(),
+                                          false, false);
+  testCppProcessor.processSharedLibrary(
+    '/usr/local/google/home/lpy/v8/out/native/d8',
+    0x00000100, 0x00000400, 0);
+
+  var staticEntries = testCppProcessor.codeMap_.getAllStaticEntriesWithAddresses();
+  var total = staticEntries.length;
+  assertEquals(total, 3);
+  assertEquals(staticEntries[0],
+               [288,{size:1,
+                     name:'v8::internal::Runtime_DebugGetPropertyDetails(v8::internal::Arguments)',
+                     type:'CPP',
+                     nameUpdated_:false}
+               ]);
+  assertEquals(staticEntries[1],
+               [272,{size:1,
+                     name:'v8::internal::Runtime::GetElementOrCharAt(v8::internal::Handle<v8::internal::Object>, unsigned int)',
+                     type:'CPP',
+                     nameUpdated_:false}
+               ]);
+  assertEquals(staticEntries[2],
+              [256,{size:1,
+                    name:'v8::internal::Runtime_StringReplaceRegExpWithString(v8::internal::Arguments)',
+                    type:'CPP',
+                    nameUpdated_:false}
+              ]);
+
+  UnixCppEntriesProvider.prototype.loadSymbols = oldLoadSymbols;
+})();
diff --git a/test/mjsunit/wasm/adapter-frame.js b/test/mjsunit/wasm/adapter-frame.js
index 39164c7..e595c3f 100644
--- a/test/mjsunit/wasm/adapter-frame.js
+++ b/test/mjsunit/wasm/adapter-frame.js
@@ -26,12 +26,9 @@
   }
 
   var builder = new WasmModuleBuilder();
-  var sig = new Array();
-  sig.push(args);
-  for (var i = 0; i < args; i++) sig.push(type);
-  sig.push(1);
-  sig.push(type);
-  builder.addFunction("select", sig)
+  var params = [];
+  for (var i = 0; i < args; i++) params.push(type);
+  builder.addFunction("select", makeSig(params, [type]))
     .addBody([kExprGetLocal, which])
     .exportFunc();
 
diff --git a/test/mjsunit/wasm/asm-wasm.js b/test/mjsunit/wasm/asm-wasm.js
index 54d7d7a..4c28b61 100644
--- a/test/mjsunit/wasm/asm-wasm.js
+++ b/test/mjsunit/wasm/asm-wasm.js
@@ -682,6 +682,7 @@
 
 assertWasm(28, TestModDoubleNegative);
 
+
 (function () {
 function TestNamedFunctions() {
   "use asm";
@@ -707,6 +708,7 @@
 assertEquals(77.5, module.add());
 })();
 
+
 (function () {
 function TestGlobalsWithInit() {
   "use asm";
@@ -1358,6 +1360,38 @@
 })();
 
 
+(function TestBadAssignDoubleFromIntish() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    function func() {
+      var a = 1;
+      var b = 3.0;
+      b = a;
+    }
+    return {func: func};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(Module.toString());
+  });
+})();
+
+
+(function TestBadAssignIntFromDouble() {
+  function Module(stdlib, foreign, heap) {
+    "use asm";
+    function func() {
+      var a = 1;
+      var b = 3.0;
+      a = b;
+    }
+    return {func: func};
+  }
+  assertThrows(function() {
+    Wasm.instantiateModuleFromAsm(Module.toString());
+  });
+})();
+
+
 (function TestBadMultiplyIntish() {
   function Module(stdlib, foreign, heap) {
     "use asm";
diff --git a/test/mjsunit/wasm/default-func-call.js b/test/mjsunit/wasm/default-func-call.js
new file mode 100644
index 0000000..14567d3
--- /dev/null
+++ b/test/mjsunit/wasm/default-func-call.js
@@ -0,0 +1,56 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+//
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+// Flags: --wasm-jit-prototype
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var module = (function () {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(kSig_i_ii);
+  builder.addPadFunctionTable(512);
+  builder.addImport("add", sig_index);
+  builder.addFunction("add", sig_index)
+    .addBody([
+      kExprGetLocal, 0, kExprGetLocal, 1, kExprCallImport, kArity2, 0
+    ]);
+  builder.addFunction("sub", sig_index)
+    .addBody([
+      kExprGetLocal, 0,             // --
+      kExprGetLocal, 1,             // --
+      kExprI32Sub,                  // --
+    ]);
+  builder.addFunction("main", kSig_i_iii)
+    .addBody([
+      kExprGetLocal, 0,
+      kExprGetLocal, 1,
+      kExprGetLocal, 2,
+      kExprCallIndirect, kArity2, sig_index
+    ])
+    .exportFunc()
+  builder.appendToTable([0, 1, 2]);
+
+  return builder.instantiate({add: function(a, b) { return a + b | 0; }});
+})();
+
+// Check the module exists.
+assertFalse(module === undefined);
+assertFalse(module === null);
+assertFalse(module === 0);
+assertEquals("object", typeof module.exports);
+assertEquals("function", typeof module.exports.main);
+
+assertEquals(5, module.exports.main(1, 12, 7));
+assertEquals(19, module.exports.main(0, 12, 7));
+
+assertTraps(kTrapFuncSigMismatch, "module.exports.main(2, 12, 33)");
+assertTraps(kTrapFuncSigMismatch, "module.exports.main(4, 12, 33)");
+assertTraps(kTrapFuncSigMismatch, "module.exports.main(511, 12, 33)");
+assertTraps(kTrapFuncInvalid, "module.exports.main(512, 12, 33)");
+assertTraps(kTrapFuncInvalid, "module.exports.main(1025, 12, 33)");
+assertTraps(kTrapFuncInvalid, "module.exports.main(-1, 12, 33)");
diff --git a/test/mjsunit/wasm/export-table.js b/test/mjsunit/wasm/export-table.js
index a41d85d..2084ddf 100644
--- a/test/mjsunit/wasm/export-table.js
+++ b/test/mjsunit/wasm/export-table.js
@@ -72,3 +72,18 @@
 
   assertEquals(kReturnValue, module.exports["0"]());
 })();
+
+(function testExportNameClash() {
+  var builder = new WasmModuleBuilder();
+
+  builder.addFunction("one",   kSig_v_v).addBody([kExprNop]).exportAs("main");
+  builder.addFunction("two",   kSig_v_v).addBody([kExprNop]).exportAs("other");
+  builder.addFunction("three", kSig_v_v).addBody([kExprNop]).exportAs("main");
+
+  try {
+    builder.instantiate();
+    assertUnreachable("should have thrown an exception");
+  } catch (e) {
+    assertContains("Duplicate export", e.toString());
+  }
+})();
diff --git a/test/mjsunit/wasm/ffi.js b/test/mjsunit/wasm/ffi.js
index 87dfe3b..9db8ea6 100644
--- a/test/mjsunit/wasm/ffi.js
+++ b/test/mjsunit/wasm/ffi.js
@@ -10,7 +10,7 @@
 function testCallFFI(func, check) {
   var builder = new WasmModuleBuilder();
 
-  var sig_index = builder.addSignature(kSig_i_dd);
+  var sig_index = builder.addType(kSig_i_dd);
   builder.addImport("func", sig_index);
   builder.addFunction("main", sig_index)
     .addBody([
diff --git a/test/mjsunit/wasm/function-names.js b/test/mjsunit/wasm/function-names.js
new file mode 100644
index 0000000..15771d8
--- /dev/null
+++ b/test/mjsunit/wasm/function-names.js
@@ -0,0 +1,69 @@
+// Copyright 2016 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-wasm
+
+load("test/mjsunit/wasm/wasm-constants.js");
+load("test/mjsunit/wasm/wasm-module-builder.js");
+
+var builder = new WasmModuleBuilder();
+
+var last_func_index = builder.addFunction("exec_unreachable", kSig_v_v)
+  .addBody([kExprUnreachable])
+
+var illegal_func_name = [0xff];
+var func_names = [ "☠", illegal_func_name, "some math: (½)² = ¼", "" ];
+var expected_names = ["exec_unreachable", "☠", null,
+                      "some math: (½)² = ¼", "", "main"];
+
+for (var func_name of func_names) {
+  last_func_index = builder.addFunction(func_name, kSig_v_v)
+    .addBody([kExprCallFunction, kArity0, last_func_index]).index;
+}
+
+builder.addFunction("main", kSig_v_v)
+  .addBody([kExprCallFunction, kArity0, last_func_index])
+  .exportFunc();
+
+var module = builder.instantiate();
+
+(function testFunctionNamesAsString() {
+  var names = expected_names.concat(["testFunctionNamesAsString", null]);
+  try {
+    module.exports.main();
+    assertFalse("should throw");
+  } catch (e) {
+    var lines = e.stack.split(/\r?\n/);
+    lines.shift();
+    assertEquals(names.length, lines.length);
+    for (var i = 0; i < names.length; ++i) {
+      var line = lines[i].trim();
+      if (names[i] === null) continue;
+      var printed_name = names[i] === undefined ? "<WASM UNNAMED>" : names[i]
+      var expected_start = "at " + printed_name + " (";
+      assertTrue(line.startsWith(expected_start),
+          "should start with '" + expected_start + "': '" + line + "'");
+    }
+  }
+})();
+
+// For the remaining tests, collect the Callsite objects instead of just a
+// string:
+Error.prepareStackTrace = function(error, frames) {
+  return frames;
+};
+
+
+(function testFunctionNamesAsCallSites() {
+  var names = expected_names.concat(["testFunctionNamesAsCallSites", null]);
+  try {
+    module.exports.main();
+    assertFalse("should throw");
+  } catch (e) {
+    assertEquals(names.length, e.stack.length);
+    for (var i = 0; i < names.length; ++i) {
+      assertEquals(names[i], e.stack[i].getFunctionName());
+    }
+  }
+})();
diff --git a/test/mjsunit/wasm/gc-frame.js b/test/mjsunit/wasm/gc-frame.js
index 5fa9b05..9c37fe4 100644
--- a/test/mjsunit/wasm/gc-frame.js
+++ b/test/mjsunit/wasm/gc-frame.js
@@ -10,7 +10,7 @@
 function makeFFI(func, t) {
   var builder = new WasmModuleBuilder();
 
-  var sig_index = builder.addSignature([10,t,t,t,t,t,t,t,t,t,t,1,t]);
+  var sig_index = builder.addType(makeSig([t,t,t,t,t,t,t,t,t,t], [t]));
   builder.addImport("func", sig_index);
   // Try to create a frame with lots of spilled values and parameters
   // on the stack to try to catch GC bugs in the reference maps for
@@ -66,9 +66,32 @@
   }
 })();
 
-(function I32Test() {
+(function F64Test() {
   var main = makeFFI(print10, kAstF64);
   for (var i = 1; i < 2e+80; i *= -1137) {
     main(i - 1, i, i + 2, i + 3, i + 4, i + 5, i + 6, i + 7, i + 8);
   }
 })();
+
+(function GCInJSToWasmTest() {
+  var builder = new WasmModuleBuilder();
+
+  var sig_index = builder.addType(kSig_i_i);
+  builder.addFunction("main", sig_index)
+    .addBody([
+      kExprGetLocal, 0,         // --
+    ])                          // --
+    .exportFunc();
+
+  var main = builder.instantiate({}).exports.main;
+
+  var gc_object = {
+      valueOf: function() {
+        // Call the GC in valueOf, which is called within the JSToWasm wrapper.
+        gc();
+        return {};
+      }
+  };
+
+  main(gc_object);
+})();
diff --git a/test/mjsunit/wasm/import-table.js b/test/mjsunit/wasm/import-table.js
index c3f8cb9..ebba040 100644
--- a/test/mjsunit/wasm/import-table.js
+++ b/test/mjsunit/wasm/import-table.js
@@ -10,7 +10,7 @@
 function testCallImport(func, check) {
   var builder = new WasmModuleBuilder();
 
-  var sig_index = builder.addSignature(kSig_i_dd);
+  var sig_index = builder.addType(kSig_i_dd);
   builder.addImport("func", sig_index);
   builder.addFunction("main", sig_index)
     .addBody([
diff --git a/test/mjsunit/wasm/indirect-calls.js b/test/mjsunit/wasm/indirect-calls.js
index 80bee41..1e87c6f 100644
--- a/test/mjsunit/wasm/indirect-calls.js
+++ b/test/mjsunit/wasm/indirect-calls.js
@@ -10,7 +10,7 @@
 var module = (function () {
   var builder = new WasmModuleBuilder();
 
-  var sig_index = builder.addSignature(kSig_i_ii);
+  var sig_index = builder.addType(kSig_i_ii);
   builder.addImport("add", sig_index);
   builder.addFunction("add", sig_index)
     .addBody([
@@ -30,7 +30,7 @@
       kExprCallIndirect, kArity2, sig_index
     ])
     .exportFunc()
-  builder.appendToFunctionTable([0, 1, 2]);
+  builder.appendToTable([0, 1, 2]);
 
   return builder.instantiate({add: function(a, b) { return a + b | 0; }});
 })();
diff --git a/test/mjsunit/wasm/instantiate-module-basic.js b/test/mjsunit/wasm/instantiate-module-basic.js
index 800dcc1..72a3425 100644
--- a/test/mjsunit/wasm/instantiate-module-basic.js
+++ b/test/mjsunit/wasm/instantiate-module-basic.js
@@ -7,44 +7,54 @@
 load("test/mjsunit/wasm/wasm-constants.js");
 load("test/mjsunit/wasm/wasm-module-builder.js");
 
-var kReturnValue = 117;
+let kReturnValue = 117;
 
-var module = (function Build() {
-  var builder = new WasmModuleBuilder();
-
+let buffer = (() => {
+  let builder = new WasmModuleBuilder();
   builder.addMemory(1, 1, true);
   builder.addFunction("main", kSig_i)
     .addBody([kExprI8Const, kReturnValue])
     .exportFunc();
 
-  return builder.instantiate();
-})();
+  return builder.toBuffer();
+})()
 
-// Check the module exists.
-assertFalse(module === undefined);
-assertFalse(module === null);
-assertFalse(module === 0);
-assertEquals("object", typeof module);
+function CheckInstance(instance) {
+  assertFalse(instance === undefined);
+  assertFalse(instance === null);
+  assertFalse(instance === 0);
+  assertEquals("object", typeof instance);
 
-// Check the memory is an ArrayBuffer.
-var mem = module.exports.memory;
-assertFalse(mem === undefined);
-assertFalse(mem === null);
-assertFalse(mem === 0);
-assertEquals("object", typeof mem);
-assertTrue(mem instanceof ArrayBuffer);
-for (var i = 0; i < 4; i++) {
-  module.exports.memory = 0;  // should be ignored
-  assertEquals(mem, module.exports.memory);
+  // Check the memory is an ArrayBuffer.
+  var mem = instance.exports.memory;
+  assertFalse(mem === undefined);
+  assertFalse(mem === null);
+  assertFalse(mem === 0);
+  assertEquals("object", typeof mem);
+  assertTrue(mem instanceof ArrayBuffer);
+  for (let i = 0; i < 4; i++) {
+    instance.exports.memory = 0;  // should be ignored
+    assertSame(mem, instance.exports.memory);
+  }
+
+  assertEquals(65536, instance.exports.memory.byteLength);
+
+  // Check the properties of the main function.
+  let main = instance.exports.main;
+  assertFalse(main === undefined);
+  assertFalse(main === null);
+  assertFalse(main === 0);
+  assertEquals("function", typeof main);
+
+  assertEquals(kReturnValue, main());
 }
 
-assertEquals(65536, module.exports.memory.byteLength);
+// Deprecated experimental API.
+CheckInstance(Wasm.instantiateModule(buffer));
 
-// Check the properties of the main function.
-var main = module.exports.main;
-assertFalse(main === undefined);
-assertFalse(main === null);
-assertFalse(main === 0);
-assertEquals("function", typeof main);
+// Official API
+let module = new WebAssembly.Module(buffer);
+CheckInstance(new WebAssembly.Instance(module));
 
-assertEquals(kReturnValue, main());
+let promise = WebAssembly.compile(buffer);
+promise.then(module => CheckInstance(new WebAssembly.Instance(module)));
diff --git a/test/mjsunit/wasm/params.js b/test/mjsunit/wasm/params.js
index 180ab1c..fe1b7d4 100644
--- a/test/mjsunit/wasm/params.js
+++ b/test/mjsunit/wasm/params.js
@@ -79,7 +79,7 @@
     print("type = " + t + ", which = " + which);
 
     var builder = new WasmModuleBuilder();
-    builder.addFunction("select", [10,t,t,t,t,t,t,t,t,t,t,1,t])
+    builder.addFunction("select", makeSig([t,t,t,t,t,t,t,t,t,t], [t]))
       .addBody([kExprGetLocal, which])
       .exportFunc();
 
diff --git a/test/mjsunit/wasm/stack.js b/test/mjsunit/wasm/stack.js
index a45db94..4ff0d1d 100644
--- a/test/mjsunit/wasm/stack.js
+++ b/test/mjsunit/wasm/stack.js
@@ -16,10 +16,8 @@
 function verifyStack(frames, expected) {
   assertEquals(expected.length, frames.length, "number of frames mismatch");
   expected.forEach(function(exp, i) {
-    if (exp[1] != "?") {
-      assertEquals(exp[1], frames[i].getFunctionName(),
-          "["+i+"].getFunctionName()");
-    }
+    assertEquals(exp[1], frames[i].getFunctionName(),
+        "["+i+"].getFunctionName()");
     assertEquals(exp[2], frames[i].getLineNumber(), "["+i+"].getLineNumber()");
     if (exp[0])
       assertEquals(exp[3], frames[i].getPosition(),
@@ -27,8 +25,7 @@
     assertContains(exp[4], frames[i].getFileName(), "["+i+"].getFileName()");
     var toString;
     if (exp[0]) {
-      var funName = exp[1] == "?" ? "" : exp[1];
-      toString = funName + " (<WASM>:" + exp[2] + ":" + exp[3] + ")";
+      toString = exp[1] + " (<WASM>[" + exp[2] + "]+" + exp[3] + ")";
     } else {
       toString = exp[4] + ":" + exp[2] + ":";
     }
@@ -71,10 +68,10 @@
 (function testSimpleStack() {
   var expected_string = "Error\n" +
     // The line numbers below will change as this test gains / loses lines..
-    "    at STACK (stack.js:42:11)\n" +           // --
-    "    at main (<WASM>:0:1)\n" +                // --
-    "    at testSimpleStack (stack.js:79:18)\n" + // --
-    "    at stack.js:81:3";                       // --
+    "    at STACK (stack.js:39:11)\n" +           // --
+    "    at main (<WASM>[0]+1)\n" +               // --
+    "    at testSimpleStack (stack.js:76:18)\n" + // --
+    "    at stack.js:78:3";                       // --
 
   module.exports.main();
   assertEquals(expected_string, stripPath(stack));
@@ -91,10 +88,10 @@
 
   verifyStack(stack, [
       // isWasm           function   line  pos        file
-      [   false,           "STACK",    42,   0, "stack.js"],
+      [   false,           "STACK",    39,   0, "stack.js"],
       [    true,            "main",     0,   1,       null],
-      [   false, "testStackFrames",    90,   0, "stack.js"],
-      [   false,              null,    99,   0, "stack.js"]
+      [   false, "testStackFrames",    87,   0, "stack.js"],
+      [   false,              null,    96,   0, "stack.js"]
   ]);
 })();
 
@@ -107,8 +104,8 @@
     verifyStack(e.stack, [
         // isWasm               function   line  pos        file
         [    true,    "exec_unreachable",    1,    1,       null],
-        [   false, "testWasmUnreachable",  103,    0, "stack.js"],
-        [   false,                  null,  114,    0, "stack.js"]
+        [   false, "testWasmUnreachable",  100,    0, "stack.js"],
+        [   false,                  null,  111,    0, "stack.js"]
     ]);
   }
 })();
@@ -121,10 +118,10 @@
     assertContains("out of bounds", e.message);
     verifyStack(e.stack, [
         // isWasm                  function   line  pos        file
-        [    true,                      "?",     2,   3,       null],
+        [    true,                       "",     2,   3,       null],
         [    true, "call_mem_out_of_bounds",     3,   1,       null],
-        [   false, "testWasmMemOutOfBounds",   118,   0, "stack.js"],
-        [   false,                     null,   130,   0, "stack.js"]
+        [   false, "testWasmMemOutOfBounds",   115,   0, "stack.js"],
+        [   false,                     null,   127,   0, "stack.js"]
     ]);
   }
 })();
diff --git a/test/mjsunit/wasm/stackwalk.js b/test/mjsunit/wasm/stackwalk.js
index 5e5a1ef..913269f 100644
--- a/test/mjsunit/wasm/stackwalk.js
+++ b/test/mjsunit/wasm/stackwalk.js
@@ -10,7 +10,7 @@
 function makeFFI(func) {
   var builder = new WasmModuleBuilder();
 
-  var sig_index = builder.addSignature(kSig_i_dd);
+  var sig_index = builder.addType(kSig_i_dd);
   builder.addImport("func", sig_index);
   builder.addFunction("main", sig_index)
     .addBody([
diff --git a/test/mjsunit/wasm/start-function.js b/test/mjsunit/wasm/start-function.js
index 3c5707a..c4d299e 100644
--- a/test/mjsunit/wasm/start-function.js
+++ b/test/mjsunit/wasm/start-function.js
@@ -65,8 +65,8 @@
   var func = builder.addFunction("", kSig_v_v)
     .addBody([kExprNop]);
 
-  builder.addExplicitSection([kDeclStartFunction, 0]);
-  builder.addExplicitSection([kDeclStartFunction, 0]);
+  builder.addExplicitSection([kDeclStart, 0]);
+  builder.addExplicitSection([kDeclStart, 0]);
 
   assertThrows(builder.instantiate);
 })();
@@ -98,7 +98,7 @@
   }};
 
   var builder = new WasmModuleBuilder();
-  var sig_index = builder.addSignature(kSig_v_v);
+  var sig_index = builder.addType(kSig_v_v);
 
   builder.addImport("foo", sig_index);
   var func = builder.addFunction("", sig_index)
diff --git a/test/mjsunit/wasm/test-wasm-module-builder.js b/test/mjsunit/wasm/test-wasm-module-builder.js
index 969b550..72d5a7a 100644
--- a/test/mjsunit/wasm/test-wasm-module-builder.js
+++ b/test/mjsunit/wasm/test-wasm-module-builder.js
@@ -91,7 +91,7 @@
         .addBody([kExprGetLocal,
                   0, kExprGetLocal, 1, kExprGetLocal, 2, kExprCallIndirect, kArity2, 0])
         .exportAs("main");
-    module.appendToFunctionTable([0]);
+    module.appendToTable([0]);
 
     var instance = module.instantiate();
     assertEquals(44, instance.exports.main(0, 11, 33));
diff --git a/test/mjsunit/wasm/trap-location.js b/test/mjsunit/wasm/trap-location.js
index 5e3661d..0440af9 100644
--- a/test/mjsunit/wasm/trap-location.js
+++ b/test/mjsunit/wasm/trap-location.js
@@ -14,7 +14,7 @@
 
 var builder = new WasmModuleBuilder();
 
-var sig_index = builder.addSignature(kSig_i_v)
+var sig_index = builder.addType(kSig_i_v)
 
 // Build a function to resemble this code:
 //   if (idx < 2) {
diff --git a/test/mjsunit/wasm/wasm-constants.js b/test/mjsunit/wasm/wasm-constants.js
index 389383e..319cadc 100644
--- a/test/mjsunit/wasm/wasm-constants.js
+++ b/test/mjsunit/wasm/wasm-constants.js
@@ -52,18 +52,19 @@
 
 // Section declaration constants
 var kDeclMemory = 0x00;
-var kDeclSignatures = 0x01;
+var kDeclTypes = 0x01;
 var kDeclFunctions = 0x02;
 var kDeclGlobals = 0x03;
-var kDeclDataSegments = 0x04;
-var kDeclFunctionTable = 0x05;
+var kDeclData = 0x04;
+var kDeclTable = 0x05;
 var kDeclEnd = 0x06;
-var kDeclStartFunction = 0x07;
-var kDeclImportTable = 0x08;
-var kDeclExportTable = 0x09;
-var kDeclFunctionSignatures = 0x0a;
-var kDeclFunctionBodies = 0x0b;
+var kDeclStart = 0x07;
+var kDeclImports = 0x08;
+var kDeclExports = 0x09;
+var kDeclFunctions = 0x0a;
+var kDeclCode = 0x0b;
 var kDeclNames = 0x0c;
+var kDeclFunctionTablePad = 0x0d;
 
 var kArity0 = 0;
 var kArity1 = 1;
@@ -74,7 +75,7 @@
 var section_names = [
   "memory", "type", "old_function", "global", "data",
   "table", "end", "start", "import", "export",
-  "function", "code", "name"];
+  "function", "code", "name", "table_pad"];
 
 // Function declaration flags
 var kDeclFunctionName   = 0x01;
@@ -90,31 +91,39 @@
 var kAstF64 = 4;
 
 // Useful signatures
-var kSig_i = [0, 1, kAstI32];
-var kSig_d = [0, 1, kAstF64];
-var kSig_i_i = [1, kAstI32, 1, kAstI32];
-var kSig_i_ii = [2, kAstI32, kAstI32, 1, kAstI32];
-var kSig_i_iii = [3, kAstI32, kAstI32, kAstI32, 1, kAstI32];
-var kSig_d_dd = [2, kAstF64, kAstF64, 1, kAstF64];
-var kSig_l_ll = [2, kAstI64, kAstI64, 1, kAstI64];
-var kSig_i_dd = [2, kAstF64, kAstF64, 1, kAstI32];
-var kSig_v_v = [0, 0];
-var kSig_i_v = [0, 1, kAstI32];
+var kSig_i = makeSig([], [kAstI32]);
+var kSig_d = makeSig([], [kAstF64]);
+var kSig_i_i = makeSig([kAstI32], [kAstI32]);
+var kSig_i_ii = makeSig([kAstI32, kAstI32], [kAstI32]);
+var kSig_i_iii = makeSig([kAstI32, kAstI32, kAstI32], [kAstI32]);
+var kSig_d_dd = makeSig([kAstF64, kAstF64], [kAstF64]);
+var kSig_l_ll = makeSig([kAstI64, kAstI64], [kAstI64]);
+var kSig_i_dd = makeSig([kAstF64, kAstF64], [kAstI32]);
+var kSig_v_v = makeSig([], []);
+var kSig_i_v = makeSig([], [kAstI32]);
 
-function makeSig_v_xx(x) {
-  return [2, x, x, 0];
+function makeSig(params, results) {
+  return {params: params, results: results};
 }
 
 function makeSig_v_x(x) {
-  return [1, x, 0];
+  return makeSig([x], []);
 }
 
-function makeSig_r_xx(r, x) {
-  return [2, x, x, 1, r];
+function makeSig_v_xx(x) {
+  return makeSig([x, x], []);
+}
+
+function makeSig_r_v(r) {
+  return makeSig([], [r]);
 }
 
 function makeSig_r_x(r, x) {
-  return [1, x, 1, r];
+  return makeSig([x], [r]);
+}
+
+function makeSig_r_xx(r, x) {
+  return makeSig([x, x], [r]);
 }
 
 // Opcodes
diff --git a/test/mjsunit/wasm/wasm-module-builder.js b/test/mjsunit/wasm/wasm-module-builder.js
index bfc4460..5c5df79 100644
--- a/test/mjsunit/wasm/wasm-module-builder.js
+++ b/test/mjsunit/wasm/wasm-module-builder.js
@@ -2,351 +2,373 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-function WasmFunctionBuilder(name, sig_index) {
-    this.name = name;
-    this.sig_index = sig_index;
-    this.exports = [];
-}
+class Binary extends Array {
+  emit_u8(val) {
+    this.push(val);
+  }
 
-WasmFunctionBuilder.prototype.exportAs = function(name) {
-    this.exports.push(name);
-    return this;
-}
+  emit_u16(val) {
+    this.push(val & 0xff);
+    this.push((val >> 8) & 0xff);
+  }
 
-WasmFunctionBuilder.prototype.exportFunc = function() {
-  this.exports.push(this.name);
-  return this;
-}
+  emit_u32(val) {
+    this.push(val & 0xff);
+    this.push((val >> 8) & 0xff);
+    this.push((val >> 16) & 0xff);
+    this.push((val >> 24) & 0xff);
+  }
 
-WasmFunctionBuilder.prototype.addBody = function(body) {
-    this.body = body;
-    return this;
-}
+  emit_varint(val) {
+    while (true) {
+      let v = val & 0xff;
+      val = val >>> 7;
+      if (val == 0) {
+        this.push(v);
+        break;
+      }
+      this.push(v | 0x80);
+    }
+  }
 
-WasmFunctionBuilder.prototype.addLocals = function(locals) {
-    this.locals = locals;
-    return this;
-}
+  emit_bytes(data) {
+    for (let i = 0; i < data.length; i++) {
+      this.push(data[i] & 0xff);
+    }
+  }
 
-function WasmModuleBuilder() {
-    this.signatures = [];
-    this.imports = [];
-    this.functions = [];
-    this.exports = [];
-    this.function_table = [];
-    this.data_segments = [];
-    this.explicit = [];
-    return this;
-}
-
-WasmModuleBuilder.prototype.addStart = function(start_index) {
-    this.start_index = start_index;
-}
-
-WasmModuleBuilder.prototype.addMemory = function(min, max, exp) {
-    this.memory = {min: min, max: max, exp: exp};
-    return this;
-}
-
-WasmModuleBuilder.prototype.addExplicitSection = function(bytes) {
-  this.explicit.push(bytes);
-  return this;
-}
-
-// Add a signature; format is [param_count, param0, param1, ..., retcount, ret0]
-WasmModuleBuilder.prototype.addSignature = function(sig) {
-    // TODO: canonicalize signatures?
-    this.signatures.push(sig);
-    return this.signatures.length - 1;
-}
-
-WasmModuleBuilder.prototype.addFunction = function(name, sig) {
-    var sig_index = (typeof sig) == "number" ? sig : this.addSignature(sig);
-    var func = new WasmFunctionBuilder(name, sig_index);
-    func.index = this.functions.length;
-    this.functions.push(func);
-    return func;
-}
-
-WasmModuleBuilder.prototype.addImportWithModule = function(module, name, sig) {
-  var sig_index = (typeof sig) == "number" ? sig : this.addSignature(sig);
-  this.imports.push({module: module, name: name, sig_index: sig_index});
-  return this.imports.length - 1;
-}
-
-WasmModuleBuilder.prototype.addImport = function(name, sig) {
-  this.addImportWithModule(name, undefined, sig);
-}
-
-WasmModuleBuilder.prototype.addDataSegment = function(addr, data, init) {
-    this.data_segments.push({addr: addr, data: data, init: init});
-    return this.data_segments.length - 1;
-}
-
-WasmModuleBuilder.prototype.appendToFunctionTable = function(array) {
-    this.function_table = this.function_table.concat(array);
-    return this;
-}
-
-function emit_u8(bytes, val) {
-    bytes.push(val & 0xff);
-}
-
-function emit_u16(bytes, val) {
-    bytes.push(val & 0xff);
-    bytes.push((val >> 8) & 0xff);
-}
-
-function emit_u32(bytes, val) {
-    bytes.push(val & 0xff);
-    bytes.push((val >> 8) & 0xff);
-    bytes.push((val >> 16) & 0xff);
-    bytes.push((val >> 24) & 0xff);
-}
-
-function emit_string(bytes, string) {
+  emit_string(string) {
     // When testing illegal names, we pass a byte array directly.
     if (string instanceof Array) {
-      emit_varint(bytes, string.length);
-      emit_bytes(bytes, string);
+      this.emit_varint(string.length);
+      this.emit_bytes(string);
       return;
     }
 
-    // This is the hacky way to convert a JavaScript scring to a UTF8 encoded
+    // This is the hacky way to convert a JavaScript string to a UTF8 encoded
     // string only containing single-byte characters.
-    var string_utf8 = unescape(encodeURIComponent(string));
-    emit_varint(bytes, string_utf8.length);
-    for (var i = 0; i < string_utf8.length; i++) {
-      emit_u8(bytes, string_utf8.charCodeAt(i));
+    let string_utf8 = unescape(encodeURIComponent(string));
+    this.emit_varint(string_utf8.length);
+    for (let i = 0; i < string_utf8.length; i++) {
+      this.emit_u8(string_utf8.charCodeAt(i));
     }
-}
+  }
 
-function emit_varint(bytes, val) {
-    while (true) {
-        var v = val & 0xff;
-        val = val >>> 7;
-        if (val == 0) {
-            bytes.push(v);
-            break;
-        }
-        bytes.push(v | 0x80);
-    }
-}
+  emit_header() {
+    this.push(kWasmH0, kWasmH1, kWasmH2, kWasmH3,
+              kWasmV0, kWasmV1, kWasmV2, kWasmV3);
+  }
 
-function emit_bytes(bytes, data) {
-  for (var i = 0; i < data.length; i++) {
-    bytes.push(data[i] & 0xff);
+  emit_section(section_code, content_generator) {
+    // Emit section name.
+    this.emit_string(section_names[section_code]);
+    // Emit the section to a temporary buffer: its full length isn't know yet.
+    let section = new Binary;
+    content_generator(section);
+    // Emit section length.
+    this.emit_varint(section.length);
+    // Copy the temporary buffer.
+    this.push(...section);
   }
 }
 
-function emit_section(bytes, section_code, content_generator) {
-    // Emit section name.
-    emit_string(bytes, section_names[section_code]);
-    // Emit the section to a temporary buffer: its full length isn't know yet.
-    var tmp_bytes = [];
-    content_generator(tmp_bytes);
-    // Emit section length.
-    emit_varint(bytes, tmp_bytes.length);
-    // Copy the temporary buffer.
-    Array.prototype.push.apply(bytes, tmp_bytes);
+class WasmFunctionBuilder {
+  constructor(name, type_index) {
+    this.name = name;
+    this.type_index = type_index;
+    this.exports = [];
+  }
+
+  exportAs(name) {
+    this.exports.push(name);
+    return this;
+  }
+
+  exportFunc() {
+    this.exports.push(this.name);
+    return this;
+  }
+
+  addBody(body) {
+    this.body = body;
+    return this;
+  }
+
+  addLocals(locals) {
+    this.locals = locals;
+    return this;
+  }
 }
 
-WasmModuleBuilder.prototype.toArray = function(debug) {
-    // Add header bytes
-    var bytes = [];
-    bytes = bytes.concat([kWasmH0, kWasmH1, kWasmH2, kWasmH3,
-                          kWasmV0, kWasmV1, kWasmV2, kWasmV3]);
+class WasmModuleBuilder {
+  constructor() {
+    this.types = [];
+    this.imports = [];
+    this.functions = [];
+    this.exports = [];
+    this.table = [];
+    this.segments = [];
+    this.explicit = [];
+    this.pad = null;
+    return this;
+  }
 
-    var wasm = this;
+  addStart(start_index) {
+    this.start_index = start_index;
+  }
 
-    // Add signatures section
-    if (wasm.signatures.length > 0) {
-        if (debug) print("emitting signatures @ " + bytes.length);
-        emit_section(bytes, kDeclSignatures, function(bytes) {
-            emit_varint(bytes, wasm.signatures.length);
-            for (sig of wasm.signatures) {
-                emit_u8(bytes, kWasmFunctionTypeForm);
-                for (var j = 0; j < sig.length; j++) {
-                    emit_u8(bytes, sig[j]);
-                }
-            }
-        });
+  addMemory(min, max, exp) {
+    this.memory = {min: min, max: max, exp: exp};
+    return this;
+  }
+
+  addPadFunctionTable(size) {
+    this.pad = size;
+    return this;
+  }
+
+  addExplicitSection(bytes) {
+    this.explicit.push(bytes);
+    return this;
+  }
+
+  addType(type) {
+    // TODO: canonicalize types?
+    this.types.push(type);
+    return this.types.length - 1;
+  }
+
+  addFunction(name, type) {
+    let type_index = (typeof type) == "number" ? type : this.addType(type);
+    let func = new WasmFunctionBuilder(name, type_index);
+    func.index = this.functions.length;
+    this.functions.push(func);
+    return func;
+  }
+
+  addImportWithModule(module, name, type) {
+    let type_index = (typeof type) == "number" ? type : this.addType(type);
+    this.imports.push({module: module, name: name, type: type_index});
+    return this.imports.length - 1;
+  }
+
+  addImport(name, type) {
+    return this.addImportWithModule(name, undefined, type);
+  }
+
+  addDataSegment(addr, data, init) {
+    this.segments.push({addr: addr, data: data, init: init});
+    return this.segments.length - 1;
+  }
+
+  appendToTable(array) {
+    this.table.push(...array);
+    return this;
+  }
+
+  toArray(debug) {
+    let binary = new Binary;
+    let wasm = this;
+
+    // Add header
+    binary.emit_header();
+
+    // Add type section
+    if (wasm.types.length > 0) {
+      if (debug) print("emitting types @ " + binary.length);
+      binary.emit_section(kDeclTypes, section => {
+        section.emit_varint(wasm.types.length);
+        for (let type of wasm.types) {
+          section.emit_u8(kWasmFunctionTypeForm);
+          section.emit_varint(type.params.length);
+          for (let param of type.params) {
+            section.emit_u8(param);
+          }
+          section.emit_varint(type.results.length);
+          for (let result of type.results) {
+            section.emit_u8(result);
+          }
+        }
+      });
     }
 
     // Add imports section
     if (wasm.imports.length > 0) {
-        if (debug) print("emitting imports @ " + bytes.length);
-        emit_section(bytes, kDeclImportTable, function(bytes) {
-            emit_varint(bytes, wasm.imports.length);
-            for (imp of wasm.imports) {
-                emit_varint(bytes, imp.sig_index);
-                emit_string(bytes, imp.module);
-                emit_string(bytes, imp.name || '');
-            }
-        });
+      if (debug) print("emitting imports @ " + binary.length);
+      binary.emit_section(kDeclImports, section => {
+        section.emit_varint(wasm.imports.length);
+        for (let imp of wasm.imports) {
+          section.emit_varint(imp.type);
+          section.emit_string(imp.module);
+          section.emit_string(imp.name || '');
+        }
+      });
     }
 
     // Add functions declarations
-    var names = false;
-    var exports = 0;
+    let has_names = false;
+    let names = false;
+    let exports = 0;
     if (wasm.functions.length > 0) {
-        var has_names = false;
-
-        // emit function signatures
-        if (debug) print("emitting function sigs @ " + bytes.length);
-        emit_section(bytes, kDeclFunctionSignatures, function(bytes) {
-            emit_varint(bytes, wasm.functions.length);
-            for (func of wasm.functions) {
-              has_names = has_names || (func.name != undefined &&
-                                        func.name.length > 0);
-              exports += func.exports.length;
-
-              emit_varint(bytes, func.sig_index);
-            }
-        });
-
+      if (debug) print("emitting function decls @ " + binary.length);
+      binary.emit_section(kDeclFunctions, section => {
+        section.emit_varint(wasm.functions.length);
+        for (let func of wasm.functions) {
+          has_names = has_names || (func.name != undefined &&
+                                   func.name.length > 0);
+          exports += func.exports.length;
+          section.emit_varint(func.type_index);
+        }
+      });
     }
 
-    // Add function table.
-    if (wasm.function_table.length > 0) {
-        if (debug) print("emitting function table @ " + bytes.length);
-        emit_section(bytes, kDeclFunctionTable, function(bytes) {
-            emit_varint(bytes, wasm.function_table.length);
-            for (index of wasm.function_table) {
-                emit_varint(bytes, index);
-            }
-        });
+    // Add table.
+    if (wasm.table.length > 0) {
+      if (debug) print("emitting table @ " + binary.length);
+      binary.emit_section(kDeclTable, section => {
+        section.emit_varint(wasm.table.length);
+        for (let index of wasm.table) {
+          section.emit_varint(index);
+        }
+      });
     }
 
     // Add memory section
     if (wasm.memory != undefined) {
-        if (debug) print("emitting memory @ " + bytes.length);
-        emit_section(bytes, kDeclMemory, function(bytes) {
-            emit_varint(bytes, wasm.memory.min);
-            emit_varint(bytes, wasm.memory.max);
-            emit_u8(bytes, wasm.memory.exp ? 1 : 0);
-        });
+      if (debug) print("emitting memory @ " + binary.length);
+      binary.emit_section(kDeclMemory, section => {
+        section.emit_varint(wasm.memory.min);
+        section.emit_varint(wasm.memory.max);
+        section.emit_u8(wasm.memory.exp ? 1 : 0);
+      });
     }
 
 
     // Add export table.
     if (exports > 0) {
-        if (debug) print("emitting exports @ " + bytes.length);
-        emit_section(bytes, kDeclExportTable, function(bytes) {
-            emit_varint(bytes, exports);
-            for (func of wasm.functions) {
-                for (exp of func.exports) {
-                    emit_varint(bytes, func.index);
-                    emit_string(bytes, exp);
-                }
-            }
-        });
+      if (debug) print("emitting exports @ " + binary.length);
+      binary.emit_section(kDeclExports, section => {
+        section.emit_varint(exports);
+        for (let func of wasm.functions) {
+          for (let exp of func.exports) {
+            section.emit_varint(func.index);
+            section.emit_string(exp);
+          }
+        }
+      });
     }
 
     // Add start function section.
     if (wasm.start_index != undefined) {
-        if (debug) print("emitting start function @ " + bytes.length);
-        emit_section(bytes, kDeclStartFunction, function(bytes) {
-            emit_varint(bytes, wasm.start_index);
-        });
+      if (debug) print("emitting start function @ " + binary.length);
+      binary.emit_section(kDeclStart, section => {
+        section.emit_varint(wasm.start_index);
+      });
     }
 
     // Add function bodies.
     if (wasm.functions.length > 0) {
-        // emit function bodies
-        if (debug) print("emitting function bodies @ " + bytes.length);
-        emit_section(bytes, kDeclFunctionBodies, function(bytes) {
-            emit_varint(bytes, wasm.functions.length);
-            for (func of wasm.functions) {
-                // Function body length will be patched later.
-                var local_decls = [];
-                var l = func.locals;
-                if (l != undefined) {
-                  var local_decls_count = 0;
-                  if (l.i32_count > 0) {
-                    local_decls.push({count: l.i32_count, type: kAstI32});
-                  }
-                  if (l.i64_count > 0) {
-                    local_decls.push({count: l.i64_count, type: kAstI64});
-                  }
-                  if (l.f32_count > 0) {
-                    local_decls.push({count: l.f32_count, type: kAstF32});
-                  }
-                  if (l.f64_count > 0) {
-                    local_decls.push({count: l.f64_count, type: kAstF64});
-                  }
-                }
-                var header = new Array();
-
-                emit_varint(header, local_decls.length);
-                for (decl of local_decls) {
-                  emit_varint(header, decl.count);
-                  emit_u8(header, decl.type);
-                }
-
-                emit_varint(bytes, header.length + func.body.length);
-                emit_bytes(bytes, header);
-                emit_bytes(bytes, func.body);
+      // emit function bodies
+      if (debug) print("emitting code @ " + binary.length);
+      binary.emit_section(kDeclCode, section => {
+        section.emit_varint(wasm.functions.length);
+        for (let func of wasm.functions) {
+          // Function body length will be patched later.
+          let local_decls = [];
+          let l = func.locals;
+          if (l != undefined) {
+            let local_decls_count = 0;
+            if (l.i32_count > 0) {
+              local_decls.push({count: l.i32_count, type: kAstI32});
             }
-        });
+            if (l.i64_count > 0) {
+              local_decls.push({count: l.i64_count, type: kAstI64});
+            }
+            if (l.f32_count > 0) {
+              local_decls.push({count: l.f32_count, type: kAstF32});
+            }
+            if (l.f64_count > 0) {
+              local_decls.push({count: l.f64_count, type: kAstF64});
+            }
+          }
+
+          let header = new Binary;
+          header.emit_varint(local_decls.length);
+          for (let decl of local_decls) {
+            header.emit_varint(decl.count);
+            header.emit_u8(decl.type);
+          }
+
+          section.emit_varint(header.length + func.body.length);
+          section.emit_bytes(header);
+          section.emit_bytes(func.body);
+        }
+      });
     }
 
     // Add data segments.
-    if (wasm.data_segments.length > 0) {
-        if (debug) print("emitting data segments @ " + bytes.length);
-        emit_section(bytes, kDeclDataSegments, function(bytes) {
-            emit_varint(bytes, wasm.data_segments.length);
-            for (seg of wasm.data_segments) {
-                emit_varint(bytes, seg.addr);
-                emit_varint(bytes, seg.data.length);
-                emit_bytes(bytes, seg.data);
-            }
-        });
+    if (wasm.segments.length > 0) {
+      if (debug) print("emitting data segments @ " + binary.length);
+      binary.emit_section(kDeclData, section => {
+        section.emit_varint(wasm.segments.length);
+        for (let seg of wasm.segments) {
+          section.emit_varint(seg.addr);
+          section.emit_varint(seg.data.length);
+          section.emit_bytes(seg.data);
+        }
+      });
     }
 
     // Add any explicitly added sections
-    for (exp of wasm.explicit) {
-        if (debug) print("emitting explicit @ " + bytes.length);
-        emit_bytes(bytes, exp);
+    for (let exp of wasm.explicit) {
+      if (debug) print("emitting explicit @ " + binary.length);
+      binary.emit_bytes(exp);
     }
 
     // Add function names.
     if (has_names) {
-        if (debug) print("emitting names @ " + bytes.length);
-        emit_section(bytes, kDeclNames, function(bytes) {
-            emit_varint(bytes, wasm.functions.length);
-            for (func of wasm.functions) {
-                var name = func.name == undefined ? "" : func.name;
-                emit_string(bytes, name);
-                emit_u8(bytes, 0);  // local names count == 0
-            }
-        });
+      if (debug) print("emitting names @ " + binary.length);
+      binary.emit_section(kDeclNames, section => {
+        section.emit_varint(wasm.functions.length);
+        for (let func of wasm.functions) {
+          var name = func.name == undefined ? "" : func.name;
+          section.emit_string(name);
+          section.emit_u8(0);  // local names count == 0
+        }
+      });
+    }
+
+    // Add an indirect function table pad section.
+    if (wasm.pad !== null) {
+      if (debug)
+        print("emitting indirect function table pad @ " + binary.length);
+      binary.emit_section(kDeclFunctionTablePad, section => {
+        section.emit_varint(wasm.pad);
+      });
     }
 
     // End the module.
-    if (debug) print("emitting end @ " + bytes.length);
-    emit_section(bytes, kDeclEnd, function(bytes) {});
+    if (debug) print("emitting end @ " + binary.length);
+    binary.emit_section(kDeclEnd, section => {});
 
-    return bytes;
-}
+    return binary;
+  }
 
-WasmModuleBuilder.prototype.toBuffer = function(debug) {
-    var bytes = this.toArray(debug);
-    var buffer = new ArrayBuffer(bytes.length);
-    var view = new Uint8Array(buffer);
-    for (var i = 0; i < bytes.length; i++) {
-        var val = bytes[i];
-        if ((typeof val) == "string") val = val.charCodeAt(0);
-        view[i] = val | 0;
+  toBuffer(debug) {
+    let bytes = this.toArray(debug);
+    let buffer = new ArrayBuffer(bytes.length);
+    let view = new Uint8Array(buffer);
+    for (let i = 0; i < bytes.length; i++) {
+      let val = bytes[i];
+      if ((typeof val) == "string") val = val.charCodeAt(0);
+      view[i] = val | 0;
     }
     return buffer;
-}
+  }
 
-WasmModuleBuilder.prototype.instantiate = function(ffi, memory) {
-    var buffer = this.toBuffer();
-    if (memory != undefined) {
-      return Wasm.instantiateModule(buffer, ffi, memory);
-    } else {
-      return Wasm.instantiateModule(buffer, ffi);
-    }
+  instantiate(...args) {
+    let module = new WebAssembly.Module(this.toBuffer());
+    let instance = new WebAssembly.Instance(module, ...args);
+    return instance;
+  }
 }
diff --git a/test/mjsunit/wasm/wasm-object-api.js b/test/mjsunit/wasm/wasm-object-api.js
index 96088b8..510b571 100644
--- a/test/mjsunit/wasm/wasm-object-api.js
+++ b/test/mjsunit/wasm/wasm-object-api.js
@@ -11,3 +11,8 @@
 assertEquals("function", typeof Wasm.instantiateModule);
 assertEquals("function", typeof Wasm.instantiateModuleFromAsm);
 assertFalse(undefined == Wasm.experimentalVersion);
+
+assertEquals('object', typeof WebAssembly);
+assertEquals('function', typeof WebAssembly.Module);
+assertEquals('function', typeof WebAssembly.Instance);
+assertEquals('function', typeof WebAssembly.compile);