Merge pull request #1 from tc39/master

test
2025-04-08 19:35:28 +02:00 · 2018-10-05 18:30:09 -07:00 · 2018-10-05 18:30:09 -07:00 · 5072e841be
commit 5072e841be
parent a81cc4213b 161ebcb76b
529 changed files with 12056 additions and 1257 deletions
--- a/features.txt
+++ b/features.txt
@ -30,6 +30,10 @@ class-static-methods-private
 # https://github.com/tc39/proposal-private-methods
 class-methods-private

+# Dynamic Import
+# https://github.com/tc39/proposal-dynamic-import
+dynamic-import
+
 # Promise.prototype.finally
 # https://github.com/tc39/proposal-promise-finally
 Promise.prototype.finally
@ -99,6 +103,10 @@ Symbol.prototype.description
 # https://github.com/tc39/proposal-json-superset
 json-superset

+# Well-formed JSON.stringify
+# https://github.com/tc39/proposal-well-formed-stringify
+well-formed-json-stringify
+
 # Intl.ListFormat
 # https://github.com/tc39/proposal-intl-list-format
 Intl.ListFormat
--- a/implementation-contributed/curation_logs/javascriptcore.json
+++ b/implementation-contributed/curation_logs/javascriptcore.json
@ -1,6 +1,6 @@
 {
-  "sourceRevisionAtLastExport": "f2e2ad6325",
-  "targetRevisionAtLastExport": "f4f5a415f",
+  "sourceRevisionAtLastExport": "3a8f232444",
+  "targetRevisionAtLastExport": "0e9545be99",
  "curatedFiles": {
    "/stress/Number-isNaN-basics.js": "DELETED_IN_TARGET",
    "/stress/Object_static_methods_Object.getOwnPropertyDescriptors-proxy.js": "DELETED_IN_TARGET",
--- a/implementation-contributed/curation_logs/v8.json
+++ b/implementation-contributed/curation_logs/v8.json
@ -1,5 +1,5 @@
 {
-  "sourceRevisionAtLastExport": "d2e0166d",
-  "targetRevisionAtLastExport": "67c244b69",
+  "sourceRevisionAtLastExport": "466306e9",
+  "targetRevisionAtLastExport": "4bc81c1dc2",
  "curatedFiles": {}
 }
--- a/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-general.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-general.js
@ -0,0 +1,97 @@
+//@ runBigIntEnabled
+
+// Copyright (C) 2017 Josh Wolfe. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+
+function assert(a) {
+    if (!a)
+        throw new Error("Bad assertion");
+}
+
+assert.sameValue = function (input, expected, message) {
+    if (input !== expected)
+        throw new Error(message);
+}
+
+assert.sameValue(0b00n & 0b00n, 0b00n, "0b00n & 0b00n === 0b00n");
+assert.sameValue(0b00n & 0b01n, 0b00n, "0b00n & 0b01n === 0b00n");
+assert.sameValue(0b01n & 0b00n, 0b00n, "0b01n & 0b00n === 0b00n");
+assert.sameValue(0b00n & 0b10n, 0b00n, "0b00n & 0b10n === 0b00n");
+assert.sameValue(0b10n & 0b00n, 0b00n, "0b10n & 0b00n === 0b00n");
+assert.sameValue(0b00n & 0b11n, 0b00n, "0b00n & 0b11n === 0b00n");
+assert.sameValue(0b11n & 0b00n, 0b00n, "0b11n & 0b00n === 0b00n");
+assert.sameValue(0b01n & 0b01n, 0b01n, "0b01n & 0b01n === 0b01n");
+assert.sameValue(0b01n & 0b10n, 0b00n, "0b01n & 0b10n === 0b00n");
+assert.sameValue(0b10n & 0b01n, 0b00n, "0b10n & 0b01n === 0b00n");
+assert.sameValue(0b01n & 0b11n, 0b01n, "0b01n & 0b11n === 0b01n");
+assert.sameValue(0b11n & 0b01n, 0b01n, "0b11n & 0b01n === 0b01n");
+assert.sameValue(0b10n & 0b10n, 0b10n, "0b10n & 0b10n === 0b10n");
+assert.sameValue(0b10n & 0b11n, 0b10n, "0b10n & 0b11n === 0b10n");
+assert.sameValue(0b11n & 0b10n, 0b10n, "0b11n & 0b10n === 0b10n");
+assert.sameValue(0xffffffffn & 0n, 0n, "0xffffffffn & 0n === 0n");
+assert.sameValue(0n & 0xffffffffn, 0n, "0n & 0xffffffffn === 0n");
+assert.sameValue(0xffffffffn & 0xffffffffn, 0xffffffffn, "0xffffffffn & 0xffffffffn === 0xffffffffn");
+assert.sameValue(0xffffffffffffffffn & 0n, 0n, "0xffffffffffffffffn & 0n === 0n");
+assert.sameValue(0n & 0xffffffffffffffffn, 0n, "0n & 0xffffffffffffffffn === 0n");
+assert.sameValue(0xffffffffffffffffn & 0xffffffffn, 0xffffffffn, "0xffffffffffffffffn & 0xffffffffn === 0xffffffffn");
+assert.sameValue(0xffffffffn & 0xffffffffffffffffn, 0xffffffffn, "0xffffffffn & 0xffffffffffffffffn === 0xffffffffn");
+assert.sameValue(
+  0xffffffffffffffffn & 0xffffffffffffffffn, 0xffffffffffffffffn,
+  "0xffffffffffffffffn & 0xffffffffffffffffn === 0xffffffffffffffffn");
+assert.sameValue(
+  0xbf2ed51ff75d380fd3be813ec6185780n & 0x4aabef2324cedff5387f1f65n, 0x42092803008e813400181700n,
+  "0xbf2ed51ff75d380fd3be813ec6185780n & 0x4aabef2324cedff5387f1f65n === 0x42092803008e813400181700n");
+assert.sameValue(
+  0x4aabef2324cedff5387f1f65n & 0xbf2ed51ff75d380fd3be813ec6185780n, 0x42092803008e813400181700n,
+  "0x4aabef2324cedff5387f1f65n & 0xbf2ed51ff75d380fd3be813ec6185780n === 0x42092803008e813400181700n");
+assert.sameValue(0n & -1n, 0n, "0n & -1n === 0n");
+assert.sameValue(-1n & 0n, 0n, "-1n & 0n === 0n");
+assert.sameValue(0n & -2n, 0n, "0n & -2n === 0n");
+assert.sameValue(-2n & 0n, 0n, "-2n & 0n === 0n");
+assert.sameValue(1n & -2n, 0n, "1n & -2n === 0n");
+assert.sameValue(-2n & 1n, 0n, "-2n & 1n === 0n");
+assert.sameValue(2n & -2n, 2n, "2n & -2n === 2n");
+assert.sameValue(-2n & 2n, 2n, "-2n & 2n === 2n");
+assert.sameValue(2n & -3n, 0n, "2n & -3n === 0n");
+assert.sameValue(-3n & 2n, 0n, "-3n & 2n === 0n");
+assert.sameValue(-1n & -2n, -2n, "-1n & -2n === -2n");
+assert.sameValue(-2n & -1n, -2n, "-2n & -1n === -2n");
+assert.sameValue(-2n & -2n, -2n, "-2n & -2n === -2n");
+assert.sameValue(-2n & -3n, -4n, "-2n & -3n === -4n");
+assert.sameValue(-3n & -2n, -4n, "-3n & -2n === -4n");
+assert.sameValue(0xffffffffn & -1n, 0xffffffffn, "0xffffffffn & -1n === 0xffffffffn");
+assert.sameValue(-1n & 0xffffffffn, 0xffffffffn, "-1n & 0xffffffffn === 0xffffffffn");
+assert.sameValue(0xffffffffffffffffn & -1n, 0xffffffffffffffffn, "0xffffffffffffffffn & -1n === 0xffffffffffffffffn");
+assert.sameValue(-1n & 0xffffffffffffffffn, 0xffffffffffffffffn, "-1n & 0xffffffffffffffffn === 0xffffffffffffffffn");
+assert.sameValue(
+  0xbf2ed51ff75d380fd3be813ec6185780n & -0x4aabef2324cedff5387f1f65n, 0xbf2ed51fb554100cd330000ac6004080n,
+  "0xbf2ed51ff75d380fd3be813ec6185780n & -0x4aabef2324cedff5387f1f65n === 0xbf2ed51fb554100cd330000ac6004080n");
+assert.sameValue(
+  -0x4aabef2324cedff5387f1f65n & 0xbf2ed51ff75d380fd3be813ec6185780n, 0xbf2ed51fb554100cd330000ac6004080n,
+  "-0x4aabef2324cedff5387f1f65n & 0xbf2ed51ff75d380fd3be813ec6185780n === 0xbf2ed51fb554100cd330000ac6004080n");
+assert.sameValue(
+  -0xbf2ed51ff75d380fd3be813ec6185780n & 0x4aabef2324cedff5387f1f65n, 0x8a2c72024405ec138670800n,
+  "-0xbf2ed51ff75d380fd3be813ec6185780n & 0x4aabef2324cedff5387f1f65n === 0x8a2c72024405ec138670800n");
+assert.sameValue(
+  0x4aabef2324cedff5387f1f65n & -0xbf2ed51ff75d380fd3be813ec6185780n, 0x8a2c72024405ec138670800n,
+  "0x4aabef2324cedff5387f1f65n & -0xbf2ed51ff75d380fd3be813ec6185780n === 0x8a2c72024405ec138670800n");
+assert.sameValue(
+  -0xbf2ed51ff75d380fd3be813ec6185780n & -0x4aabef2324cedff5387f1f65n, -0xbf2ed51fffffff2ff7fedffffe7f5f80n,
+  "-0xbf2ed51ff75d380fd3be813ec6185780n & -0x4aabef2324cedff5387f1f65n === -0xbf2ed51fffffff2ff7fedffffe7f5f80n");
+assert.sameValue(
+  -0x4aabef2324cedff5387f1f65n & -0xbf2ed51ff75d380fd3be813ec6185780n, -0xbf2ed51fffffff2ff7fedffffe7f5f80n,
+  "-0x4aabef2324cedff5387f1f65n & -0xbf2ed51ff75d380fd3be813ec6185780n === -0xbf2ed51fffffff2ff7fedffffe7f5f80n");
+assert.sameValue(-0xffffffffn & 0n, 0n, "-0xffffffffn & 0n === 0n");
+assert.sameValue(0n & -0xffffffffn, 0n, "0n & -0xffffffffn === 0n");
+assert.sameValue(
+  -0xffffffffffffffffn & 0x10000000000000000n, 0x10000000000000000n,
+  "-0xffffffffffffffffn & 0x10000000000000000n === 0x10000000000000000n");
+assert.sameValue(
+  0x10000000000000000n & -0xffffffffffffffffn, 0x10000000000000000n,
+  "0x10000000000000000n & -0xffffffffffffffffn === 0x10000000000000000n");
+assert.sameValue(
+  -0xffffffffffffffffffffffffn & 0x10000000000000000n, 0n,
+  "-0xffffffffffffffffffffffffn & 0x10000000000000000n === 0n");
+assert.sameValue(
+  0x10000000000000000n & -0xffffffffffffffffffffffffn, 0n,
+  "0x10000000000000000n & -0xffffffffffffffffffffffffn === 0n");
--- a/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-jit.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-jit.js
@ -0,0 +1,20 @@
+//@ runBigIntEnabled
+
+let assert = {
+    sameValue: function(i, e, m) {
+        if (i !== e)
+            throw new Error(m);
+    }
+}
+
+function bigIntBitAnd(a, b) {
+    return (a & b) & (a & 0b11n);
+
+}
+noInline(bigIntBitAnd);
+
+for (let i = 0; i < 10000; i++) {
+    let r = bigIntBitAnd(0b11n, 0b1010n);
+    assert.sameValue(r, 0b10n, 0b11n + " & " + 0b1010n + " = " + r);
+}
+
--- a/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-memory-stress.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-memory-stress.js
@ -0,0 +1,14 @@
+//@ runBigIntEnabled
+
+function assert(a) {
+    if (!a)
+        throw new Error("Bad assertion");
+}
+
+let a = 0b11n;
+for (let i = 0; i < 1000000; i++) {
+    a &= 0b01n;
+}
+
+assert(a === 0b01n);
+
--- a/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-to-primitive-precedence.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-to-primitive-precedence.js
@ -0,0 +1,29 @@
+//@ runBigIntEnabled
+
+assert = {
+    sameValue: function (input, expected, message) {
+        if (input !== expected)
+            throw new Error(message);
+    }
+};
+
+let o = {
+    [Symbol.toPrimitive]: function() {
+        throw new Error("Bad");
+    }
+};
+
+try{
+    o & Symbol("2");
+    assert.sameValue(true, false, "Exception expected to be throwed, but executed without error");
+} catch (e) {
+    assert.sameValue(e.message, "Bad", "Expected to throw Error('Bad'), but got: " + e);
+}
+
+try{
+    Symbol("2") & o;
+    assert.sameValue(true, false, "Exception expected to be throwed, but executed without error");
+} catch (e) {
+    assert.sameValue(e instanceof TypeError, true, "Expected to throw TypeError, but got: " + e)
+}
+
--- a/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-type-error.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-type-error.js
@ -0,0 +1,106 @@
+//@ runBigIntEnabled
+
+function assert(a, message) {
+    if (!a)
+        throw new Error(message);
+}
+
+function assertThrowTypeError(a, b, message) {
+    try {
+        let n = a & b;
+        assert(false, message + ": Should throw TypeError, but executed without exception");
+    } catch (e) {
+        assert(e instanceof TypeError, message + ": expected TypeError, got: " + e);
+    }
+}
+
+assertThrowTypeError(30n, "foo", "BigInt & String");
+assertThrowTypeError("bar", 18757382984821n, "String & BigInt");
+assertThrowTypeError(30n, Symbol("foo"), "BigInt & Symbol");
+assertThrowTypeError(Symbol("bar"), 18757382984821n, "Symbol & BigInt");
+assertThrowTypeError(30n, 3320, "BigInt & Int32");
+assertThrowTypeError(33256, 18757382984821n, "Int32 & BigInt");
+assertThrowTypeError(30n, 0.543, "BigInt & Double");
+assertThrowTypeError(230.19293, 18757382984821n, "Double & BigInt");
+assertThrowTypeError(30n, NaN, "BigInt & NaN");
+assertThrowTypeError(NaN, 18757382984821n, "NaN & BigInt");
+assertThrowTypeError(30n, NaN, "BigInt & NaN");
+assertThrowTypeError(NaN, 18757382984821n, "NaN & BigInt");
+assertThrowTypeError(30n, +Infinity, "BigInt & NaN");
+assertThrowTypeError(+Infinity, 18757382984821n, "NaN & BigInt");
+assertThrowTypeError(30n, -Infinity, "BigInt & -Infinity");
+assertThrowTypeError(-Infinity, 18757382984821n, "-Infinity & BigInt");
+assertThrowTypeError(30n, null, "BigInt & null");
+assertThrowTypeError(null, 18757382984821n, "null & BigInt");
+assertThrowTypeError(30n, undefined, "BigInt & undefined");
+assertThrowTypeError(undefined, 18757382984821n, "undefined & BigInt");
+assertThrowTypeError(30n, true, "BigInt & true");
+assertThrowTypeError(true, 18757382984821n, "true & BigInt");
+assertThrowTypeError(30n, false, "BigInt & false");
+assertThrowTypeError(false, 18757382984821n, "false & BigInt");
+
+// Error when returning from object
+
+let o = {
+    valueOf: function () { return Symbol("Foo"); }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.valueOf returning Symbol");
+assertThrowTypeError(o, 18757382984821n, "Object.valueOf returning Symbol & BigInt");
+
+o = {
+    valueOf: function () { return 33256; }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.valueOf returning Int32");
+assertThrowTypeError(o, 18757382984821n, "Object.valueOf returning Int32 & BigInt");
+
+o = {
+    valueOf: function () { return 0.453; }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.valueOf returning Double");
+assertThrowTypeError(o, 18757382984821n, "Object.valueOf returning Double & BigInt");
+
+o = {
+    toString: function () { return Symbol("Foo"); }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.toString returning Symbol");
+assertThrowTypeError(o, 18757382984821n, "Object.toString returning Symbol & BigInt");
+
+o = {
+    toString: function () { return 33256; }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.toString returning Int32");
+assertThrowTypeError(o, 18757382984821n, "Object.toString returning Int32 & BigInt");
+
+o = {
+    toString: function () { return 0.453; }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.toString returning Double");
+assertThrowTypeError(o, 18757382984821n, "Object.toString returning Double & BigInt");
+
+o = {
+    [Symbol.toPrimitive]: function () { return Symbol("Foo"); }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.@@toPrimitive returning Symbol");
+assertThrowTypeError(o, 18757382984821n, "Object.@@toPrimitive returning Symbol & BigInt");
+
+o = {
+    [Symbol.toPrimitive]: function () { return 33256; }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.@@toPrimitive returning Int32");
+assertThrowTypeError(o, 18757382984821n, "Object.@@toPrimitive returning Int32 & BigInt");
+
+o = {
+    [Symbol.toPrimitive]: function () { return 0.453; }
+};
+
+assertThrowTypeError(30n, o, "BigInt & Object.@@toPrimitive returning Double");
+assertThrowTypeError(o, 18757382984821n, "Object.@@toPrimitive returning Double & BigInt");
+
--- a/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-wrapped-value.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-bitwise-and-wrapped-value.js
@ -0,0 +1,37 @@
+//@ runBigIntEnabled
+
+assert = {
+    sameValue: function (input, expected, message) {
+        if (input !== expected)
+            throw new Error(message);
+    }
+};
+
+function testBitAnd(x, y, z, message) {
+    assert.sameValue(x & y, z, message);
+    assert.sameValue(y & x, z, message);
+}
+
+testBitAnd(Object(0b10n), 0b01n, 0b00n, "ToPrimitive: unbox object with internal slot");
+
+let o = {
+    [Symbol.toPrimitive]: function() {
+        return 0b10n;
+    }
+};
+testBitAnd(o, 0b01n, 0b00n, "ToPrimitive: @@toPrimitive");
+
+o = {
+    valueOf: function() {
+        return 0b10n;
+    }
+};
+testBitAnd(o, 0b01n, 0b00n, "ToPrimitive: valueOf");
+
+o = {
+    toString: function() {
+        return 0b10n;
+    }
+}
+testBitAnd(o, 0b01n, 0b00n, "ToPrimitive: toString");
+
--- a/implementation-contributed/javascriptcore/stress/big-int-to-string.js
+++ b/implementation-contributed/javascriptcore/stress/big-int-to-string.js
@ -0,0 +1,57 @@
+//@ runBigIntEnabled
+
+function assert(a) {
+    if (!a)
+        throw new Error("Bad assertion");
+}
+
+let v = 10n;
+assert(v.toString() === "10");
+assert(v.toString(2) === "1010");
+assert(v.toString(3) === "101");
+assert(v.toString(8) === "12");
+assert(v.toString(16) === "a");
+assert(v.toString(32) === "a");
+
+v = 191561942608236107294793378393788647952342390272950271n;
+assert(v.toString() === "191561942608236107294793378393788647952342390272950271");
+assert(v.toString(2) === "111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111");
+assert(v.toString(3) === "2002122121011101220102010210020102000210011100122221002112102021022221102202020101221000021200201121121100121121");
+assert(v.toString(8) === "77777777777777777777777777777777777777777777777777777777777");
+assert(v.toString(16) === "1ffffffffffffffffffffffffffffffffffffffffffff");
+assert(v.toString(32) === "3vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv");
+
+v = -10n;
+assert(v.toString() === "-10");
+assert(v.toString(2) === "-1010");
+assert(v.toString(3) === "-101");
+assert(v.toString(8) === "-12");
+assert(v.toString(16) === "-a");
+assert(v.toString(32) === "-a");
+
+v = -191561942608236107294793378393788647952342390272950271n;
+assert(v.toString() === "-191561942608236107294793378393788647952342390272950271");
+assert(v.toString(2) === "-111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111111");
+assert(v.toString(3) === "-2002122121011101220102010210020102000210011100122221002112102021022221102202020101221000021200201121121100121121");
+assert(v.toString(8) === "-77777777777777777777777777777777777777777777777777777777777");
+assert(v.toString(16) === "-1ffffffffffffffffffffffffffffffffffffffffffff");
+assert(v.toString(32) === "-3vvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvvv");
+
+// Invaid radix
+
+function testInvalidRadix(radix) {
+    try {
+        v.toString(radix);
+        assert(false);
+    } catch(e) {
+        assert(e instanceof RangeError);
+    }
+}
+
+testInvalidRadix(-10);
+testInvalidRadix(-1);
+testInvalidRadix(0);
+testInvalidRadix(1);
+testInvalidRadix(37);
+testInvalidRadix(4294967312);
+
--- a/implementation-contributed/javascriptcore/stress/dataview-jit-set-nan.js
+++ b/implementation-contributed/javascriptcore/stress/dataview-jit-set-nan.js
@ -0,0 +1,52 @@
+//@ skip if $architecture == "mips"
+
+"use strict";
+
+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+
+function test() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setFloat32(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setFloat32(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setFloat32(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(4);
+    let arr = new Float32Array(buffer);
+    let bits = new Uint32Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, 1.5);
+        assert(arr[0] === 1.5);
+
+        storeLittleEndian(dv, 0, 12912.124123215122);
+        assert(arr[0] === 12912.1240234375);
+        assert(bits[0] === 0x4649c07f);
+
+        storeLittleEndian(dv, 0, NaN);
+        assert(isNaN(arr[0]));
+        assert(bits[0] === 0x7FC00000);
+
+        storeLittleEndian(dv, 0, 2.3879393e-38);
+        assert(arr[0] === 2.387939260590663e-38);
+        assert(bits[0] === 0x01020304);
+
+        storeBigEndian(dv, 0, 2.3879393e-38);
+        assert(arr[0] === 1.539989614439558e-36);
+        assert(bits[0] === 0x04030201);
+    }
+}
+test();
--- a/implementation-contributed/javascriptcore/stress/dataview-jit-set.js
+++ b/implementation-contributed/javascriptcore/stress/dataview-jit-set.js
@ -0,0 +1,439 @@
+"use strict";
+
+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+
+function readHex(dv, bytes) {
+    function isLittleEndian() { 
+        let b = new ArrayBuffer(4);
+        let dv = new DataView(b);
+        dv.setInt32(0, 0x00112233, true);
+        return dv.getUint8(0) === 0x33;
+    }
+    let str = "";
+    function readByte(i) {
+        let b = dv.getUint8(i).toString(16);
+        if (b.length === 1)
+            b = "0" + b;
+        else
+            assert(b.length === 2)
+        return b;
+    }
+    if (isLittleEndian()) {
+        for (let i = bytes; i--;)
+            str = str + readByte(i);
+    } else {
+        for (let i = 0; i < bytes; ++i)
+            str = str + readByte(i);
+    }
+
+    return "0x" + str;
+}
+
+{
+    let b = new ArrayBuffer(4);
+    let dv = new DataView(b);
+    dv.setInt32(0, 0x00112233, true);
+    assert(readHex(dv, 4) === "0x00112233");
+}
+
+function test() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setInt16(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setInt16(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setInt16(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(2);
+    let arr = new Uint16Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, 0xfaba);
+        assert(arr[0] === 0xfaba);
+
+        store(dv, 0, 0xabcd, true);
+        assert(arr[0] === 0xabcd);
+
+        store(dv, 0, 0xbadbeef, true);
+        assert(arr[0] === 0xbeef);
+
+        storeLittleEndian(dv, 0, 0xbb4db33f, true);
+        assert(arr[0] === 0xb33f);
+
+        storeBigEndian(dv, 0, 0xfada);
+        assert(arr[0] === 0xdafa);
+
+        storeBigEndian(dv, 0, 0x12ab);
+        assert(arr[0] === 0xab12);
+
+        store(dv, 0, 0x1234, false);
+        assert(arr[0] === 0x3412);
+
+        store(dv, 0, 0x0102, false);
+        assert(arr[0] === 0x0201);
+
+        store(dv, 0, -1, false);
+        assert(arr[0] === 0xffff);
+
+        store(dv, 0, -2, false);
+        assert(arr[0] === 0xfeff);
+
+        storeBigEndian(dv, 0, -1);
+        assert(arr[0] === 0xffff);
+
+        storeBigEndian(dv, 0, -2);
+        assert(arr[0] === 0xfeff);
+
+        storeBigEndian(dv, 0, -2147483648); 
+        assert(arr[0] === 0x0000);
+
+        storeLittleEndian(dv, 0, -2147483648); 
+        assert(arr[0] === 0x0000);
+
+        storeLittleEndian(dv, 0, -2147478988); 
+        assert(arr[0] === 0x1234);
+
+        storeBigEndian(dv, 0, -2147478988); 
+        assert(arr[0] === 0x3412);
+    }
+}
+test();
+
+function test2() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setUint16(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setUint16(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setUint16(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(2);
+    let arr = new Uint16Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, 0xfaba);
+        assert(arr[0] === 0xfaba);
+
+        store(dv, 0, 0xabcd, true);
+        assert(arr[0] === 0xabcd);
+
+        store(dv, 0, 0xbadbeef, true);
+        assert(arr[0] === 0xbeef);
+
+        storeLittleEndian(dv, 0, 0xbb4db33f, true);
+        assert(arr[0] === 0xb33f);
+
+        storeBigEndian(dv, 0, 0xfada);
+        assert(arr[0] === 0xdafa);
+
+        storeBigEndian(dv, 0, 0x12ab);
+        assert(arr[0] === 0xab12);
+
+        store(dv, 0, 0x1234, false);
+        assert(arr[0] === 0x3412);
+
+        store(dv, 0, 0x0102, false);
+        assert(arr[0] === 0x0201);
+
+        store(dv, 0, -1, false);
+        assert(arr[0] === 0xffff);
+
+        store(dv, 0, -2, false);
+        assert(arr[0] === 0xfeff);
+
+        storeBigEndian(dv, 0, -1);
+        assert(arr[0] === 0xffff);
+
+        storeBigEndian(dv, 0, -2);
+        assert(arr[0] === 0xfeff);
+
+        storeBigEndian(dv, 0, -2147483648); 
+        assert(arr[0] === 0x0000);
+
+        storeLittleEndian(dv, 0, -2147483648); 
+        assert(arr[0] === 0x0000);
+
+        storeLittleEndian(dv, 0, -2147478988); 
+        assert(arr[0] === 0x1234);
+
+        storeBigEndian(dv, 0, -2147478988); 
+        assert(arr[0] === 0x3412);
+    }
+}
+test2();
+
+function test3() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setUint32(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setUint32(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setUint32(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(4);
+    let arr = new Uint32Array(buffer);
+    let arr2 = new Int32Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, 0xffffffff);
+        assert(arr[0] === 0xffffffff);
+        assert(arr2[0] === -1);
+
+        storeLittleEndian(dv, 0, 0xffaabbcc);
+        assert(arr[0] === 0xffaabbcc);
+
+        storeBigEndian(dv, 0, 0x12345678);
+        assert(arr[0] === 0x78563412);
+
+        storeBigEndian(dv, 0, 0xffaabbcc);
+        assert(arr[0] === 0xccbbaaff);
+
+        store(dv, 0, 0xfaeadaca, false);
+        assert(arr[0] === 0xcadaeafa);
+
+        store(dv, 0, 0xcadaeafa, false);
+        assert(arr2[0] === -85271862);
+
+        store(dv, 0, 0x12345678, false);
+        assert(arr[0] === 0x78563412);
+
+        storeBigEndian(dv, 0, 0xbeeffeeb);
+        assert(arr2[0] === -335614018);
+    }
+}
+test3();
+
+function test4() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setInt32(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setInt32(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setInt32(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(4);
+    let arr = new Uint32Array(buffer);
+    let arr2 = new Int32Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, 0xffffffff);
+        assert(arr[0] === 0xffffffff);
+        assert(arr2[0] === -1);
+
+        storeLittleEndian(dv, 0, 0xffaabbcc);
+        assert(arr[0] === 0xffaabbcc);
+
+        storeBigEndian(dv, 0, 0x12345678);
+        assert(arr[0] === 0x78563412);
+
+        storeBigEndian(dv, 0, 0xffaabbcc);
+        assert(arr[0] === 0xccbbaaff);
+
+        store(dv, 0, 0xfaeadaca, false);
+        assert(arr[0] === 0xcadaeafa);
+
+        store(dv, 0, 0xcadaeafa, false);
+        assert(arr2[0] === -85271862);
+
+        store(dv, 0, 0x12345678, false);
+        assert(arr[0] === 0x78563412);
+
+        storeBigEndian(dv, 0, 0xbeeffeeb);
+        assert(arr2[0] === -335614018);
+    }
+}
+test4();
+
+function test5() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setFloat32(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setFloat32(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setFloat32(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(4);
+    let arr = new Float32Array(buffer);
+    let bits = new Uint32Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, 1.5);
+        assert(arr[0] === 1.5);
+
+        storeLittleEndian(dv, 0, 12912.124123215122);
+        assert(arr[0] === 12912.1240234375);
+        assert(bits[0] === 0x4649c07f);
+
+        storeLittleEndian(dv, 0, NaN);
+        assert(isNaN(arr[0]));
+
+        storeLittleEndian(dv, 0, 2.3879393e-38);
+        assert(arr[0] === 2.387939260590663e-38);
+        assert(bits[0] === 0x01020304);
+
+        storeBigEndian(dv, 0, 2.3879393e-38);
+        assert(arr[0] === 1.539989614439558e-36);
+        assert(bits[0] === 0x04030201);
+    }
+}
+test5();
+
+function test6() {
+    function storeLittleEndian(dv, index, value) {
+        dv.setFloat64(index, value, true);
+    }
+    noInline(storeLittleEndian);
+
+    function storeBigEndian(dv, index, value) {
+        dv.setFloat64(index, value, false);
+    }
+    noInline(storeBigEndian);
+
+    function store(dv, index, value, littleEndian) {
+        dv.setFloat64(index, value, littleEndian);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(8);
+    let arr = new Float64Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        storeLittleEndian(dv, 0, NaN);
+        assert(isNaN(arr[0]));
+
+        storeLittleEndian(dv, 0, -2.5075187084135162e+284);
+        assert(arr[0] === -2.5075187084135162e+284);
+        assert(readHex(dv, 8) === "0xfafafafafafafafa");
+
+        store(dv, 0, 124.553, true);
+        assert(readHex(dv, 8) === "0x405f23645a1cac08");
+
+        store(dv, 0, Infinity, true);
+        assert(readHex(dv, 8) === "0x7ff0000000000000");
+
+        store(dv, 0, Infinity, false);
+        assert(readHex(dv, 8) === "0x000000000000f07f");
+
+        store(dv, 0, -Infinity, true);
+        assert(readHex(dv, 8) === "0xfff0000000000000");
+
+        storeBigEndian(dv, 0, -2.5075187084135162e+284);
+        assert(arr[0] === -2.5075187084135162e+284);
+        assert(readHex(dv, 8) === "0xfafafafafafafafa");
+
+        storeBigEndian(dv, 0, 124.553);
+        assert(readHex(dv, 8) === "0x08ac1c5a64235f40");
+    }
+}
+test6();
+
+function test7() {
+    function store(dv, index, value) {
+        dv.setInt8(index, value);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(1);
+    let arr = new Uint8Array(buffer);
+    let arr2 = new Int8Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        store(dv, 0, 0xff);
+        assert(arr[0] === 0xff);
+        assert(arr2[0] === -1);
+
+        store(dv, 0, 0xff00);
+        assert(arr[0] === 0);
+        assert(arr2[0] === 0);
+
+        store(dv, 0, -1);
+        assert(arr[0] === 0xff);
+        assert(arr2[0] === -1);
+
+        store(dv, 0, 0x0badbeef);
+        assert(arr[0] === 0xef);
+        assert(arr2[0] === -17);
+    }
+}
+test7();
+
+function test8() {
+    function store(dv, index, value) {
+        dv.setInt8(index, value);
+    }
+    noInline(store);
+
+    let buffer = new ArrayBuffer(1);
+    let arr = new Uint8Array(buffer);
+    let arr2 = new Int8Array(buffer);
+    let dv = new DataView(buffer);
+
+    for (let i = 0; i < 10000; ++i) {
+        store(dv, 0, 0xff);
+        assert(arr[0] === 0xff);
+        assert(arr2[0] === -1);
+
+        store(dv, 0, 0xff00);
+        assert(arr[0] === 0);
+        assert(arr2[0] === 0);
+
+        store(dv, 0, -1);
+        assert(arr[0] === 0xff);
+        assert(arr2[0] === -1);
+
+        store(dv, 0, 0x0badbeef);
+        assert(arr[0] === 0xef);
+        assert(arr2[0] === -17);
+    }
+}
+test8();
--- a/implementation-contributed/javascriptcore/stress/ftl-should-always-filter-for-low-type-check-functions.js
+++ b/implementation-contributed/javascriptcore/stress/ftl-should-always-filter-for-low-type-check-functions.js
@ -0,0 +1,31 @@
+//@ runDefault("--useConcurrentJIT=0", "--jitPolicyScale=0", "--maximumInliningDepth=2")
+
+function foo(x, y) {
+    var w = 0;
+    for (var i = 0; i < x.length; ++i) {
+        for (var j = 0; j < x.length; ++j)
+            w += foo(j, i);
+        y[i] = w;
+    }
+}
+
+function test(x, a3) {
+      a1 = [];
+      a2 = [];
+
+    for (i = 0; i < x; ++i)
+        a1[i] = 0;
+
+    for (i = 0; i < 10; ++i) {
+        foo(a3, a2);
+        foo(a3, a1);
+    }
+}
+noDFG(test);
+
+a3 = [];
+for (var i = 0; i < 3; ++i)
+    a3[i] = 0;
+
+for (var i = 3; i <= 12; i *= 2)
+    test(i, a3);
--- a/implementation-contributed/javascriptcore/stress/jsc-read.js
+++ b/implementation-contributed/javascriptcore/stress/jsc-read.js
@ -0,0 +1,38 @@
+(function test() {
+    // Read this test file using jsc shell's builtins, and check that its content is as expected.
+    const in_file = 'jsc-read.js';
+
+    const check = content_read => {
+        let testContent = test.toString();
+        let lineEnding = testContent.match(/\r?\n/)[0];
+        let expect = `(${testContent})();${lineEnding}`;
+        if (content_read !== expect)
+            throw Error('Expected to read this file as-is, instead read:\n==========\n' + content_read + '\n==========');
+    };
+
+    const test_arraybuffer = read_function => {
+        let file = read_function(in_file, 'binary');
+        if (typeof file.buffer !== 'object' || file.byteLength === undefined || file.length === undefined || file.BYTES_PER_ELEMENT !== 1 || file.byteOffset !== 0)
+            throw Error('Expected a Uint8Array');
+        let str = '';
+        for (var i = 0; i != file.length; ++i)
+            str += String.fromCharCode(file[i]);  // Assume ASCII.
+        check(str);
+    };
+
+    const test_string = read_function => {
+        let str = read_function(in_file);
+        if (typeof str !== 'string')
+            throw Error('Expected a string');
+        check(str);
+    };
+
+    // jsc's original file reading function is `readFile`, whereas SpiderMonkey
+    // shell's file reading function is `read`. The latter is used by
+    // emscripten's shell.js (d8 calls it `readbuffer`, which shell.js
+    // polyfills).
+    test_arraybuffer(readFile);
+    test_arraybuffer(read);
+    test_string(readFile);
+    test_string(read);
+})();
--- a/implementation-contributed/javascriptcore/stress/regress-169445.js
+++ b/implementation-contributed/javascriptcore/stress/regress-169445.js
@ -0,0 +1,46 @@
+//@ defaultNoNoLLIntRun if $architecture == "arm"
+
+let args = new Array(0x10000);
+args.fill();
+args = args.map((_, i) => 'a' + i).join(', ');
+
+let gun = eval(`(function () {
+    class A {
+
+    }
+
+    class B extends A {
+        constructor(${args}) {
+            () => {
+                ${args};
+                super();
+            };
+
+            class C {
+                constructor() {
+                }
+
+                trigger() {
+                    (() => {
+                        super.x;
+                    })();
+                }
+
+                triggerWithRestParameters(...args) {
+                    (() => {
+                        super.x;
+                    })();
+                }
+            }
+
+            return new C();
+        }
+    }
+
+    return new B();
+})()`);
+
+for (let i = 0; i < 0x10000; i++) {
+    gun.trigger();
+    gun.triggerWithRestParameters(1, 2, 3);
+}
--- a/implementation-contributed/javascriptcore/stress/regress-189132.js
+++ b/implementation-contributed/javascriptcore/stress/regress-189132.js
@ -0,0 +1,14 @@
+//@ skip if $memoryLimited
+
+try {
+    var a0 = '\ud801';
+    var a1 = [];
+    a2 = a0.padEnd(2147483644,'x');
+    a1[a2];
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "Error: Out of memory")
+    throw "FAILED";
+
--- a/implementation-contributed/javascriptcore/stress/regress-190186.js
+++ b/implementation-contributed/javascriptcore/stress/regress-190186.js
@ -0,0 +1,95 @@
+//@ runDefault("--useConcurrentJIT=false", "--sweepSynchronously=true")
+
+// This test passes if it does not crash with an ASAN build.
+
+(function() {
+    var bar = {};
+
+    for (var i = 0; i < 68; ++i)
+        String.raw`boo`;
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+    eval(String.raw`bar += 0;`);
+
+    eval(String.raw`foo = class { };`);
+    foo += 0;
+
+    gc();
+    try {
+        eval(foo.toString());
+    } catch (e) {
+        exception = e;
+    }
+
+    if (exception != "SyntaxError: Class statements must have a name.")
+        throw "FAIL";
+})();
--- a/implementation-contributed/javascriptcore/stress/regress-190187.js
+++ b/implementation-contributed/javascriptcore/stress/regress-190187.js
@ -0,0 +1,18 @@
+//@ skip if $memoryLimited or $buildType == "debug"
+//@ runDefault
+//@ slow!
+
+try {
+    var v1 = "AAAAAAAAAAA";
+    for(var i = 0; i < 27; i++)
+      v1 = v1 + v1;
+    var v2;
+    var v3 = RegExp.prototype.toString.call({source:v1,flags:v1});
+    v3 += v1;
+    v2 += v3.localeCompare(v1);
+} catch (e) {
+    exception = e;
+}
+
+if (exception != "Error: Out of memory")
+    throw "FAILED";
--- a/implementation-contributed/v8/intl/general/getCanonicalLocales.js
+++ b/implementation-contributed/v8/intl/general/getCanonicalLocales.js
@ -7,9 +7,10 @@ assertDoesNotThrow(() => Intl.getCanonicalLocales("foobar-foobar"));

 // Ignore duplicate subtags in different namespaces; eg, 'a' vs 'u'.
 assertDoesNotThrow(() => Intl.getCanonicalLocales("en-a-ca-Chinese-u-ca-Chinese"));
+// Ignore duplicate subtags in U-extension as well. Only the first count.
+// See RFC 6067 for details.
+assertDoesNotThrow(() => Intl.getCanonicalLocales("en-u-ca-gregory-ca-chinese"));
+assertEquals("en-u-ca-gregory", Intl.getCanonicalLocales("en-u-ca-gregory-ca-chinese")[0]);

 // Check duplicate subtags (after the first tag) are detected.
 assertThrows(() => Intl.getCanonicalLocales("en-foobar-foobar"), RangeError);
-
-// Duplicate subtags are valid as per the ECMA262 spec.
-assertDoesNotThrow(() => Intl.getCanonicalLocales("en-u-ca-gregory-ca-chinese"));
--- a/implementation-contributed/v8/intl/general/grandfathered_tags_without_preferred_value.js
+++ b/implementation-contributed/v8/intl/general/grandfathered_tags_without_preferred_value.js
@ -23,5 +23,5 @@
 ].forEach(([inputLocale, expectedLocale]) => {
  const canonicalLocales = Intl.getCanonicalLocales(inputLocale);
  assertEquals(canonicalLocales.length, 1);
-  assertEquals(canonicalLocales[0], expectedLocale);
+  assertEquals(expectedLocale, canonicalLocales[0]);
 })
--- a/implementation-contributed/v8/intl/general/language_tags_with_preferred_values.js
+++ b/implementation-contributed/v8/intl/general/language_tags_with_preferred_values.js
@ -29,6 +29,6 @@
  ["aam-u-ca-gregory", "aas-u-ca-gregory"],
 ].forEach(([inputLocale, expectedLocale]) => {
  const canonicalLocales = Intl.getCanonicalLocales(inputLocale);
-  assertEquals(canonicalLocales.length, 1);
-  assertEquals(canonicalLocales[0], expectedLocale);
+  assertEquals(1, canonicalLocales.length);
+  assertEquals(expectedLocale, canonicalLocales[0]);
 })
--- a/implementation-contributed/v8/intl/segmenter/constructor.js
+++ b/implementation-contributed/v8/intl/segmenter/constructor.js
@ -0,0 +1,216 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-lineBreakStyle license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-segmenter
+
+// Segmenter constructor can't be called as function.
+assertThrows(() => Intl.Segmenter(["sr"]), TypeError);
+
+// Invalid locale string.
+assertThrows(() => new Intl.Segmenter(["abcdefghi"]), RangeError);
+
+assertDoesNotThrow(() => new Intl.Segmenter(["sr"], {}), TypeError);
+
+assertDoesNotThrow(() => new Intl.Segmenter([], {}));
+
+assertDoesNotThrow(() => new Intl.Segmenter(["fr", "ar"], {}));
+
+assertDoesNotThrow(() => new Intl.Segmenter({ 0: "ja", 1: "fr" }, {}));
+
+assertDoesNotThrow(() => new Intl.Segmenter({ 1: "ja", 2: "fr" }, {}));
+
+assertDoesNotThrow(() => new Intl.Segmenter(["sr"]));
+
+assertDoesNotThrow(() => new Intl.Segmenter());
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            lineBreakStyle: "strict",
+            granularity: "grapheme"
+        })
+);
+
+assertDoesNotThrow(
+    () => new Intl.Segmenter(["sr"], { granularity: "sentence" })
+);
+
+assertDoesNotThrow(() => new Intl.Segmenter(["sr"], { granularity: "word" }));
+
+assertDoesNotThrow(
+    () => new Intl.Segmenter(["sr"], { granularity: "grapheme" })
+);
+
+assertDoesNotThrow(() => new Intl.Segmenter(["sr"], { granularity: "line" }));
+
+assertThrows(
+    () => new Intl.Segmenter(["sr"], { granularity: "standard" }),
+    RangeError
+);
+
+assertDoesNotThrow(
+    () => new Intl.Segmenter(["sr"], { lineBreakStyle: "normal" })
+);
+
+assertDoesNotThrow(
+    () => new Intl.Segmenter(["sr"], { lineBreakStyle: "strict" })
+);
+
+assertDoesNotThrow(
+    () => new Intl.Segmenter(["sr"], { lineBreakStyle: "loose" })
+);
+
+assertThrows(
+    () => new Intl.Segmenter(["sr"], { lineBreakStyle: "giant" }),
+    RangeError
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "sentence",
+            lineBreakStyle: "normal"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "sentence",
+            lineBreakStyle: "strict"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "sentence",
+            lineBreakStyle: "loose"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "word",
+            lineBreakStyle: "normal"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "word",
+            lineBreakStyle: "strict"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "word",
+            lineBreakStyle: "loose"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "grapheme",
+            lineBreakStyle: "normal"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "grapheme",
+            lineBreakStyle: "strict"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "grapheme",
+            lineBreakStyle: "loose"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "line",
+            lineBreakStyle: "loose"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "line",
+            lineBreakStyle: "normal"
+        })
+);
+
+assertDoesNotThrow(
+    () =>
+        new Intl.Segmenter(["sr"], {
+            granularity: "line",
+            lineBreakStyle: "strict"
+        })
+);
+
+// propagate exception from getter
+assertThrows(
+    () =>
+        new Intl.Segmenter(undefined, {
+            get localeMatcher() {
+                throw new TypeError("");
+            }
+        }),
+    TypeError
+);
+assertThrows(
+    () =>
+        new Intl.Segmenter(undefined, {
+            get lineBreakStyle() {
+                throw new TypeError("");
+            }
+        }),
+    TypeError
+);
+assertThrows(
+    () =>
+        new Intl.Segmenter(undefined, {
+            get granularity() {
+                throw new TypeError("");
+            }
+        }),
+    TypeError
+);
+
+// Throws only once during construction.
+// Check for all getters to prevent regression.
+// Preserve the order of getter initialization.
+let getCount = 0;
+let localeMatcher = -1;
+let lineBreakStyle = -1;
+let granularity = -1;
+
+new Intl.Segmenter(["en-US"], {
+    get localeMatcher() {
+        localeMatcher = ++getCount;
+    },
+    get lineBreakStyle() {
+        lineBreakStyle = ++getCount;
+    },
+    get granularity() {
+        granularity = ++getCount;
+    }
+});
+
+assertEquals(1, localeMatcher);
+assertEquals(2, lineBreakStyle);
+assertEquals(3, granularity);
--- a/implementation-contributed/v8/intl/segmenter/resolved-options.js
+++ b/implementation-contributed/v8/intl/segmenter/resolved-options.js
@ -0,0 +1,299 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-lineBreakStyle license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-segmenter
+
+let segmenter = new Intl.Segmenter([], { granularity: "line" });
+// The default lineBreakStyle is 'normal'
+assertEquals("normal", segmenter.resolvedOptions().lineBreakStyle);
+
+segmenter = new Intl.Segmenter();
+assertEquals(undefined, segmenter.resolvedOptions().lineBreakStyle);
+
+// The default granularity is 'grapheme'
+assertEquals("grapheme", segmenter.resolvedOptions().granularity);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], { lineBreakStyle: "strict" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], { lineBreakStyle: "strict" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], { lineBreakStyle: "normal" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], { lineBreakStyle: "normal" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], { lineBreakStyle: "loose" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], { lineBreakStyle: "loose" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    "word",
+    new Intl.Segmenter(["sr"], { granularity: "word" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], { granularity: "word" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], { granularity: "grapheme" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], { granularity: "grapheme" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "sentence",
+    new Intl.Segmenter(["sr"], { granularity: "sentence" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], { granularity: "sentence" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "line",
+    new Intl.Segmenter(["sr"], { granularity: "line" }).resolvedOptions()
+        .granularity
+);
+
+assertEquals(
+    "normal",
+    new Intl.Segmenter(["sr"], { granularity: "line" }).resolvedOptions()
+        .lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "grapheme"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "grapheme"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "grapheme"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "grapheme"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "grapheme",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "grapheme"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "grapheme"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "word",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "word"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "word"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "word",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "word"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "word"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "word",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "word"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "word"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "sentence",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "sentence"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "sentence"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "sentence",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "sentence"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    undefined,
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "sentence"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "sentence",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "sentence"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    "normal",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "line"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "line",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "line"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    "loose",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "loose",
+        granularity: "line"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "line",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "line"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    "strict",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "strict",
+        granularity: "line"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals(
+    "line",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "line"
+    }).resolvedOptions().granularity
+);
+
+assertEquals(
+    "normal",
+    new Intl.Segmenter(["sr"], {
+        lineBreakStyle: "normal",
+        granularity: "line"
+    }).resolvedOptions().lineBreakStyle
+);
+
+assertEquals("ar", new Intl.Segmenter(["ar"]).resolvedOptions().locale);
+
+assertEquals("ar", new Intl.Segmenter(["ar", "en"]).resolvedOptions().locale);
+
+assertEquals("fr", new Intl.Segmenter(["fr", "en"]).resolvedOptions().locale);
+
+assertEquals("ar", new Intl.Segmenter(["xyz", "ar"]).resolvedOptions().locale);
--- a/implementation-contributed/v8/intl/segmenter/supported-locale.js
+++ b/implementation-contributed/v8/intl/segmenter/supported-locale.js
@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-intl-segmenter
+assertEquals(
+    typeof Intl.Segmenter.supportedLocalesOf,
+    "function",
+    "Intl.Segmenter.supportedLocalesOf should be a function"
+);
+
+var undef = Intl.Segmenter.supportedLocalesOf();
+assertEquals([], undef);
+
+var empty = Intl.Segmenter.supportedLocalesOf([]);
+assertEquals([], empty);
+
+var strLocale = Intl.Segmenter.supportedLocalesOf("sr");
+assertEquals("sr", strLocale[0]);
+
+var multiLocale = ["sr-Thai-RS", "de", "zh-CN"];
+assertEquals(multiLocale, Intl.Segmenter.supportedLocalesOf(multiLocale));
--- a/implementation-contributed/v8/mjsunit/async-stack-traces-prepare-stacktrace-1.js
+++ b/implementation-contributed/v8/mjsunit/async-stack-traces-prepare-stacktrace-1.js
@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace doesn't expose strict
+// mode closures, even in the presence of async frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(two, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertEquals(undefined, frames[1].getFunction());
+  assertEquals(one.name, frames[1].getFunctionName());
+  return frames;
+};
+
+async function one(x) {
+  "use strict";
+  return await two(x);
+}
+
+async function two(x) {
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
--- a/implementation-contributed/v8/mjsunit/async-stack-traces-prepare-stacktrace-2.js
+++ b/implementation-contributed/v8/mjsunit/async-stack-traces-prepare-stacktrace-2.js
@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace doesn't expose strict
+// mode closures, even in the presence of async frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(undefined, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertEquals(undefined, frames[1].getFunction());
+  assertEquals(one.name, frames[1].getFunctionName());
+  return frames;
+};
+
+async function one(x) {
+  return await two(x);
+}
+
+async function two(x) {
+  "use strict";
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
--- a/implementation-contributed/v8/mjsunit/async-stack-traces-prepare-stacktrace-3.js
+++ b/implementation-contributed/v8/mjsunit/async-stack-traces-prepare-stacktrace-3.js
@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+// Check that Error.prepareStackTrace properly marks async frames.
+Error.prepareStackTrace = (e, frames) => {
+  assertEquals(two, frames[0].getFunction());
+  assertEquals(two.name, frames[0].getFunctionName());
+  assertFalse(frames[0].isAsync());
+  assertEquals(two, frames[1].getFunction());
+  assertEquals(one.name, frames[1].getFunctionName());
+  assertTrue(frames[1].isAsync());
+  return frames;
+};
+
+async function one(x) {
+  return await two(x);
+}
+
+async function two(x) {
+  try {
+    x = await x;
+    throw new Error();
+  } catch (e) {
+    return e.stack;
+  }
+}
+
+one(1).catch(e => setTimeout(_ => {throw e}, 0));
--- a/implementation-contributed/v8/mjsunit/async-stack-traces.js
+++ b/implementation-contributed/v8/mjsunit/async-stack-traces.js
@ -0,0 +1,270 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --async-stack-traces
+
+// Basic test with an explicit throw.
+(function() {
+  async function one(x) {
+    await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test with an implicit throw (via ToNumber on Symbol).
+(function() {
+  async function one(x) {
+    return await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    return +x;  // This will raise a TypeError.
+  }
+
+  async function test(f) {
+    try {
+      await f(Symbol());
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, TypeError);
+      assertMatches(/TypeError.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test with throw in inlined function.
+(function() {
+  function throwError() {
+    throw new Error();
+  }
+
+  async function one(x) {
+    return await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    return throwError();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test with async function inlined into sync function.
+(function() {
+  function callOne(x) {
+    return one(x);
+  }
+
+  function callTwo(x) {
+    return two(x);
+  }
+
+  async function one(x) {
+    return await callTwo(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    await test(callOne);
+    await test(callOne);
+    %OptimizeFunctionOnNextCall(callTwo);
+    await test(callOne);
+    %OptimizeFunctionOnNextCall(callOne);
+    await test(callOne);
+  })());
+})();
+
+// Basic test with async functions and promises chained via
+// Promise.prototype.then(), which should still work following
+// the generic chain upwards.
+(function() {
+  async function one(x) {
+    return await two(x).then(x => x);
+  }
+
+  async function two(x) {
+    await x.then(x => x);
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(Promise.resolve(1));
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async() => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test for async generators called from async
+// functions with an explicit throw.
+(function() {
+  async function one(x) {
+    for await (const y of two(x)) {}
+  }
+
+  async function* two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      await f(1);
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test for async functions called from async
+// generators with an explicit throw.
+(function() {
+  async function* one(x) {
+    await two(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      for await (const x of f(1)) {}
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
+
+// Basic test for async functions called from async
+// generators with an explicit throw (with yield).
+(function() {
+  async function* one(x) {
+    yield two(x);
+  }
+
+  async function two(x) {
+    await x;
+    throw new Error();
+  }
+
+  async function test(f) {
+    try {
+      for await (const x of f(1)) {}
+      assertUnreachable();
+    } catch (e) {
+      assertInstanceof(e, Error);
+      assertMatches(/Error.+at two.+at async one.+at async test/ms, e.stack);
+    }
+  }
+
+  assertPromiseResult((async () => {
+    await test(one);
+    await test(one);
+    %OptimizeFunctionOnNextCall(two);
+    await test(one);
+    %OptimizeFunctionOnNextCall(one);
+    await test(one);
+  })());
+})();
--- a/implementation-contributed/v8/mjsunit/code-coverage-block.js
+++ b/implementation-contributed/v8/mjsunit/code-coverage-block.js
@ -471,7 +471,7 @@ TestCoverage(
 {"start":472,"end":503,"count":0},
 {"start":626,"end":653,"count":0},
 {"start":768,"end":803,"count":0},
- {"start":867,"end":869,"count":0}]
+ {"start":867,"end":868,"count":0}]
 );

 TestCoverage(
@ -847,7 +847,7 @@ Util.escape("foo.bar");                   // 0400
 [{"start":0,"end":449,"count":1},
 {"start":64,"end":351,"count":1},
 {"start":112,"end":203,"count":0},
- {"start":303,"end":350,"count":0}]
+ {"start":268,"end":350,"count":0}]
 );

 %DebugToggleBlockCoverage(false);
--- a/implementation-contributed/v8/mjsunit/compiler/number-abs.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-abs.js
@ -0,0 +1,76 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberAbs correctly deals with PositiveInteger \/ MinusZero
+// and turns the -0 into a 0.
+(function() {
+  function foo(x) {
+    x = Math.floor(x);
+    x = Math.max(x, -0);
+    return 1 / Math.abs(x);
+  }
+
+  assertEquals(Infinity, foo(-0));
+  assertEquals(Infinity, foo(-0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(Infinity, foo(-0));
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    return Math.abs(x * -2);
+  }
+
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Math.abs(Math.max(x * -2, 0));
+  }
+
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberAbs properly passes the kIdentifyZeros truncation
+// for OrderedNumber inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    return Math.abs(Math.min(x * -2, 2 ** 32));
+  }
+
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(-1));
+  assertEquals(4, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-ceil.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-ceil.js
@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberCeil propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.ceil(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-comparison-truncations.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-comparison-truncations.js
@ -0,0 +1,152 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that SpeculativeNumberEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y === 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberEqual with Number feedback.
+  function bar(x, y) { return x === y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y < 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThan[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThan with Number feedback.
+  function bar(x, y) { return x < y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1, -1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(1, foo(-3, 0));
+  assertEquals(1, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[SignedSmall] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  function foo(x, y) {
+    if (x * y <= 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberLessThanOrEqual[Number] properly passes the
+// kIdentifyZeros truncation.
+(function() {
+  // Produce a SpeculativeNumberLessThanOrEqual with Number feedback.
+  function bar(x, y) { return x <= y; }
+  bar(0.1, 0.5);
+  bar(-0, 100);
+
+  function foo(x, y) {
+    if (bar(x * y, 0)) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(0, 1));
+  assertEquals(1, foo(1, 1));
+  assertEquals(1, foo(1, 2));
+  assertOptimized(foo);
+  // Even if x*y produces -0 now, it should stay optimized.
+  assertEquals(0, foo(-3, 0));
+  assertEquals(0, foo(0, -3));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-floor.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-floor.js
@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberFloor propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.floor(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-max.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-max.js
@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMax properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.max(x * -2, 1) == 1) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(-1));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-min.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-min.js
@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberMin properly passes the kIdentifyZeros truncation.
+(function() {
+  function foo(x) {
+    if (Math.min(x * -2, -1) == -2) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(1, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-modulus.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-modulus.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --opt
+// Flags: --allow-natives-syntax --opt --noalways-opt

 // Test that NumberModulus with Number feedback works if only in the
 // end SimplifiedLowering figures out that the inputs to this operation
@ -123,3 +123,134 @@
  assertEquals(1, foo(4));
  assertOptimized(foo);
 })();
+
+// Test that NumberModulus works in the case where TurboFan
+// can infer that the output is Signed32 \/ MinusZero, and
+// there's a truncation on the result that identifies zeros
+// (via the SpeculativeNumberEqual).
+(function() {
+  // We need a separately polluted % with NumberOrOddball feedback.
+  function bar(x) { return x % 2; }
+  bar(undefined);  // The % feedback is now NumberOrOddball.
+
+  // Now we just use the gadget above on an `x` that is known
+  // to be in Signed32 range and compare it to 0, which passes
+  // a truncation that identifies zeros.
+  function foo(x) {
+    if (bar(x | 0) == 0) return 0;
+    return 1;
+  }
+
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2));
+  assertEquals(1, foo(1));
+  assertOptimized(foo);
+
+  // Now `foo` should stay optimized even if `x % 2` would
+  // produce -0, aka when we pass a negative value for `x`.
+  assertEquals(0, foo(-2));
+  assertEquals(1, foo(-1));
+  assertOptimized(foo);
+})();
+
+// Test that CheckedInt32Mod handles the slow-path (when
+// the left hand side is negative) correctly.
+(function() {
+  // We need a SpeculativeNumberModulus with SignedSmall feedback.
+  function foo(x, y) {
+    return x % y;
+  }
+
+  assertEquals(0, foo(2, 1));
+  assertEquals(0, foo(2, 2));
+  assertEquals(-1, foo(-3, 2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2, 1));
+  assertEquals(0, foo(2, 2));
+  assertEquals(-1, foo(-3, 2));
+  assertOptimized(foo);
+
+  // Now `foo` should deoptimize if the result is -0.
+  assertEquals(-0, foo(-2, 2));
+  assertUnoptimized(foo);
+})();
+
+// Test that NumberModulus passes kIdentifiesZero to the
+// left hand side input when the result doesn't care about
+// 0 vs -0, even when the inputs are outside Signed32.
+(function() {
+  function foo(x) {
+    return (x * -2) % (2 ** 32) === 0;
+  }
+
+  assertFalse(foo(2));
+  assertFalse(foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(2));
+  assertFalse(foo(1));
+
+  // Now `foo` should stay optimized even if `x * -2` would
+  // produce -0, aka when we pass a zero value for `x`.
+  assertTrue(foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that NumberModulus passes kIdentifiesZero to the
+// right hand side input, even when the inputs are outside
+// the Signed32 range.
+(function() {
+  function foo(x) {
+    return (2 ** 32) % (x * -2);
+  }
+
+  assertEquals(0, foo(1));
+  assertEquals(0, foo(1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(1));
+
+  // Now `foo` should stay optimized even if `x * -2` would
+  // produce -0, aka when we pass a zero value for `x`.
+  assertEquals(NaN, foo(0));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberModulus passes kIdentifiesZero
+// to the right hand side input, even when feedback is consumed.
+(function() {
+  function foo(x, y) {
+    return (x % (y * -2)) | 0;
+  }
+
+  assertEquals(0, foo(2, 1));
+  assertEquals(-1, foo(-3, 1));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(0, foo(2, 1));
+  assertEquals(-1, foo(-3, 1));
+  assertOptimized(foo);
+
+  // Now `foo` should stay optimized even if `y * -2` would
+  // produce -0, aka when we pass a zero value for `y`.
+  assertEquals(0, foo(2, 0));
+  assertOptimized(foo);
+})();
+
+// Test that SpeculativeNumberModulus passes kIdentifiesZero
+// to the left hand side input, even when feedback is consumed.
+(function() {
+  function foo(x, y) {
+    return ((x * -2) % y) | 0;
+  }
+
+  assertEquals(-2, foo(1, 3));
+  assertEquals(-2, foo(1, 3));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(-2, foo(1, 3));
+  assertOptimized(foo);
+
+  // Now `foo` should stay optimized even if `x * -2` would
+  // produce -0, aka when we pass a zero value for `x`.
+  assertEquals(0, foo(0, 2));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-round.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-round.js
@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberRound propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.round(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-toboolean.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-toboolean.js
@ -0,0 +1,45 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Signed32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    if (x * -2) return 1;
+    return 0;
+  }
+
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(1));
+  assertEquals(1, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
+
+
+// Test that NumberToBoolean properly passes the kIdentifyZeros truncation
+// for Unsigned32 \/ MinusZero inputs.
+(function() {
+  function foo(x) {
+    x = x | 0;
+    if (Math.max(x * -2, 0)) return 1;
+    return 0;
+  }
+
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(1, foo(-1));
+  assertEquals(1, foo(-2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/number-trunc.js
+++ b/implementation-contributed/v8/mjsunit/compiler/number-trunc.js
@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test that NumberTrunc propagates kIdentifyZeros truncations.
+(function() {
+  function foo(x) {
+    return Math.abs(Math.trunc(x * -2));
+  }
+
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals(2, foo(1));
+  assertEquals(4, foo(2));
+  assertOptimized(foo);
+  // Now `foo` should stay optimized even if `x * -2` would produce `-0`.
+  assertEquals(0, foo(0));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/regress-7121.js
+++ b/implementation-contributed/v8/mjsunit/compiler/regress-7121.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 function foo() { %_ToLength(42n) }
 assertThrows(foo, TypeError);
--- a/implementation-contributed/v8/mjsunit/compiler/regress-890057.js
+++ b/implementation-contributed/v8/mjsunit/compiler/regress-890057.js
@ -0,0 +1,16 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {}
+function g() {
+  f.prototype = undefined;
+  f();
+  new f();
+}
+
+// Do not use %OptimizeFunctionOnNextCall here, this particular bug needs
+// to trigger truly concurrent compilation.
+for (let i = 0; i < 10000; i++) g();
--- a/implementation-contributed/v8/mjsunit/compiler/regress-890620.js
+++ b/implementation-contributed/v8/mjsunit/compiler/regress-890620.js
@ -0,0 +1,25 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = 42;
+
+function g(n) {
+  while (n > 0) {
+    a = new Array(n);
+    n--;
+  }
+}
+
+g(1);
+
+function f() {
+  g();
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertEquals(1, a.length);
--- a/implementation-contributed/v8/mjsunit/compiler/stress-deopt-count-2.js
+++ b/implementation-contributed/v8/mjsunit/compiler/stress-deopt-count-2.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --opt --no-always-opt --deopt-every-n-times=6
+// Flags: --allow-natives-syntax --opt --no-always-opt --deopt-every-n-times=3

 // Check that stress deopt count resets correctly

@ -14,34 +14,34 @@ function f(x) {
 f(1);
 %OptimizeFunctionOnNextCall(f);

-// stress_deopt_count == 6
-
-f(1);
-assertOptimized(f, undefined, undefined, false);
-
-// stress_deopt_count == 4
+// stress_deopt_count == 3

 f(1);
 assertOptimized(f, undefined, undefined, false);

 // stress_deopt_count == 2

+f(1);
+assertOptimized(f, undefined, undefined, false);
+
+// stress_deopt_count == 1
+
 f(1);
 // deopt & counter reset
 assertUnoptimized(f, undefined, undefined, false);

-// stress_deopt_count == 6
+// stress_deopt_count == 3

 %OptimizeFunctionOnNextCall(f);
 f(1);
 assertOptimized(f, undefined, undefined, false);

-// stress_deopt_count == 4
+// stress_deopt_count == 2

 f(1);
 assertOptimized(f, undefined, undefined, false);

-// stress_deopt_count == 2
+// stress_deopt_count == 1

 f(1);
 // deopt & counter reset
--- a/implementation-contributed/v8/mjsunit/compiler/string-from-code-point.js
+++ b/implementation-contributed/v8/mjsunit/compiler/string-from-code-point.js
@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt --noalways-opt
+
+// Test that String.fromCodePoint() properly identifies zeros.
+(function() {
+  function foo(x) {
+    return String.fromCodePoint(x);
+  }
+
+  assertEquals("\u0000", foo(0));
+  assertEquals("\u0000", foo(-0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("\u0000", foo(0));
+  assertEquals("\u0000", foo(-0));
+  assertOptimized(foo);
+
+  // Now passing anything outside the valid code point
+  // range should invalidate the optimized code.
+  assertThrows(_ => foo(-1));
+  assertUnoptimized(foo);
+
+  // And TurboFan should not inline the builtin anymore
+  // from now on (aka no deoptimization loop).
+  %OptimizeFunctionOnNextCall(foo);
+  assertEquals("\u0000", foo(0));
+  assertEquals("\u0000", foo(-0));
+  assertThrows(_ => foo(-1));
+  assertOptimized(foo);
+})();
--- a/implementation-contributed/v8/mjsunit/compiler/typed-array-constructor.js
+++ b/implementation-contributed/v8/mjsunit/compiler/typed-array-constructor.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 const limit = %MaxSmi() + 1;

--- a/implementation-contributed/v8/mjsunit/es6/proxy-function-tostring.js
+++ b/implementation-contributed/v8/mjsunit/es6/proxy-function-tostring.js
@ -1,7 +1,6 @@
 // Copyright 2018 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
-//
-// Flags: --noharmony-function-tostring

-assertThrows(() => new Proxy(function() {}, {}).toString(), TypeError);
+assertEquals(new Proxy(function() {}, {}).toString(),
+             'function () { [native code] }');
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator2.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator2.js
@ -0,0 +1,24 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertEquals(['o', 't', 't'], [...str]);
+assertTrue(%StringIteratorProtector());
+
+str[Symbol.iterator] = {};
+// Symbol.iterator can't be set on primitive strings, so it shouldn't invalidate
+// the protector.
+assertTrue(%StringIteratorProtector());
+
+// This changes the String Iterator prototype. No more tests should be run after
+// this in the same instance.
+var iterator = str[Symbol.iterator]();
+iterator.__proto__.next = () => ({value : undefined, done : true});
+
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator3.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator3.js
@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for primitive strings.
+
+var str = 'ott';
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str.__proto__[Symbol.iterator] =
+    function() {
+      return {next : () => ({value : undefined, done : true})};
+    };
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str]);
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator4.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator4.js
@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// Tests for wrapped strings.
+
+var str = new String('ott');
+assertTrue(%StringIteratorProtector());
+assertEquals(['o', 't', 't'], [...str]);
+
+function iterator_fn() {
+  return {next : () => ({value : undefined, done : true})};
+};
+
+str[Symbol.iterator] = iterator_fn;
+// This shouldn't invalidate the protector, because it doesn't support String
+// objects.
+assertTrue(%StringIteratorProtector());
+assertEquals([], [...str]);
+
+
+var str2 = new String('ott');
+assertEquals(['o', 't', 't'], [...str2]);
+// This changes the String prototype. No more tests should be run after this in
+// the same instance.
+str2.__proto__[Symbol.iterator] = iterator_fn;
+assertFalse(%StringIteratorProtector());
+assertEquals([], [...str2]);
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator5.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator5.js
@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Tests for primitive strings.
+
+var iterator = 'ott'[Symbol.iterator]();
+
+// These modifications shouldn't invalidate the String iterator protector.
+iterator.__proto__.fonts = {};
+assertTrue(%StringIteratorProtector());
+iterator.__proto__[0] = 0;
+assertTrue(%StringIteratorProtector());
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator6.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator6.js
@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+assertTrue(%StringIteratorProtector());
+
+delete 'ott'.__proto__[Symbol.iterator];
+
+assertFalse(%StringIteratorProtector());
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator7.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator7.js
@ -0,0 +1,13 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+const p = ""[Symbol.iterator]().__proto__;
+let x = Object.create(p);
+x.next = 42;
+
+assertTrue(%StringIteratorProtector());
--- a/implementation-contributed/v8/mjsunit/es6/string-iterator8.js
+++ b/implementation-contributed/v8/mjsunit/es6/string-iterator8.js
@ -0,0 +1,14 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertTrue(%StringIteratorProtector());
+
+var proto = String.prototype;
+
+String.prototype = {};
+
+assertEquals(proto, String.prototype);
+assertTrue(%StringIteratorProtector());
--- a/implementation-contributed/v8/mjsunit/es6/typedarray-construct-by-array-like.js
+++ b/implementation-contributed/v8/mjsunit/es6/typedarray-construct-by-array-like.js
@ -212,7 +212,7 @@ tests.push(function TestFromTypedArraySpeciesNeutersBuffer(constr) {
 });

 tests.push(function TestLengthIsMaxSmi(constr) {
-  var myObject = { 0: 5, 1: 6, length: %_MaxSmi() + 1 };
+  var myObject = { 0: 5, 1: 6, length: %MaxSmi() + 1 };

  assertThrows(function() {
    new constr(myObject);
@ -258,7 +258,7 @@ tests.push(function TestOffsetIsUsed(constr) {
 });

 tests.push(function TestLengthIsNonSmiNegativeNumber(constr) {
-  var ta = new constr({length: -%_MaxSmi() - 2});
+  var ta = new constr({length: -%MaxSmi() - 2});

  assertEquals(0, ta.length);
 });
--- a/implementation-contributed/v8/mjsunit/es6/typedarray-construct-offset-not-smi.js
+++ b/implementation-contributed/v8/mjsunit/es6/typedarray-construct-offset-not-smi.js
@ -5,7 +5,7 @@
 // Flags: --allow-natives-syntax --mock-arraybuffer-allocator

 (function TestBufferByteLengthNonSmi() {
-  var non_smi_byte_length = %_MaxSmi() + 1;
+  var non_smi_byte_length = %MaxSmi() + 1;

  var buffer = new ArrayBuffer(non_smi_byte_length);

@ -20,7 +20,7 @@
 })();

 (function TestByteOffsetNonSmi() {
-  var non_smi_byte_length = %_MaxSmi() + 11;
+  var non_smi_byte_length = %MaxSmi() + 11;

  var buffer = new ArrayBuffer(non_smi_byte_length);

--- a/implementation-contributed/v8/mjsunit/es6/typedarray-set-bytelength-not-smi.js
+++ b/implementation-contributed/v8/mjsunit/es6/typedarray-set-bytelength-not-smi.js
@ -5,13 +5,13 @@
 // Flags: --allow-natives-syntax --mock-arraybuffer-allocator

 (function TestBufferByteLengthNonSmi() {
-  const source_buffer_length = %_MaxSmi() + 1;
+  const source_buffer_length = %MaxSmi() + 1;
  const source_buffer = new ArrayBuffer(source_buffer_length);
  const source = new Uint16Array(source_buffer);
  assertEquals(source_buffer_length, source_buffer.byteLength);
  assertEquals(source_buffer_length / 2, source.length);

-  const target_buffer_length = %_MaxSmi() - 1;
+  const target_buffer_length = %MaxSmi() - 1;
  const target_buffer = new ArrayBuffer(target_buffer_length);
  const target = new Uint16Array(target_buffer);
  assertEquals(target_buffer_length, target_buffer.byteLength);
--- a/implementation-contributed/v8/mjsunit/harmony/async-await-optimization.js
+++ b/implementation-contributed/v8/mjsunit/harmony/async-await-optimization.js
@ -0,0 +1,124 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-await-optimization
+
+// test basic interleaving
+(function () {
+  const actual = [];
+  const expected = [ 'await', 1, 'await', 2 ];
+  const iterations = 2;
+
+  async function pushAwait() {
+    actual.push('await');
+  }
+
+  async function callAsync() {
+    for (let i = 0; i < iterations; i++) {
+      await pushAwait();
+    }
+    return 0;
+  }
+
+  function checkAssertions() {
+    assertArrayEquals(expected, actual,
+      'Async/await and promises should be interleaved.');
+  }
+
+  assertPromiseResult((async() => {
+    callAsync();
+
+    return new Promise(function (resolve) {
+      actual.push(1);
+      resolve();
+    }).then(function () {
+      actual.push(2);
+    }).then(checkAssertions);
+  })());
+})();
+
+// test async generators
+(function () {
+  const actual = [];
+  const expected = [ 'await', 1, 'await', 2 ];
+  const iterations = 2;
+
+  async function pushAwait() {
+    actual.push('await');
+  }
+
+  async function* callAsync() {
+    for (let i = 0; i < iterations; i++) {
+      await pushAwait();
+    }
+    return 0;
+  }
+
+  function checkAssertions() {
+    assertArrayEquals(expected, actual,
+      'Async/await and promises should be interleaved when using async generators.');
+  }
+
+  assertPromiseResult((async() => {
+    callAsync().next();
+
+    return new Promise(function (resolve) {
+      actual.push(1);
+      resolve();
+    }).then(function () {
+      actual.push(2);
+    }).then(checkAssertions);
+  })());
+})();
+
+// test yielding from async generators
+(function () {
+  const actual = [];
+  const expected = [
+    'Promise: 6',
+    'Promise: 5',
+    'Await: 3',
+    'Promise: 4',
+    'Promise: 3',
+    'Await: 2',
+    'Promise: 2',
+    'Promise: 1',
+    'Await: 1',
+    'Promise: 0'
+  ];
+  const iterations = 3;
+
+  async function* naturalNumbers(start) {
+    let current = start;
+    while (current > 0) {
+      yield Promise.resolve(current--);
+    }
+  }
+
+  async function trigger() {
+    for await (const num of naturalNumbers(iterations)) {
+      actual.push('Await: ' + num);
+    }
+  }
+
+  async function checkAssertions() {
+    assertArrayEquals(expected, actual,
+      'Async/await and promises should be interleaved when yielding.');
+  }
+
+  async function countdown(counter) {
+    actual.push('Promise: ' + counter);
+    if (counter > 0) {
+      return Promise.resolve(counter - 1).then(countdown);
+    } else {
+      await checkAssertions();
+    }
+  }
+
+  assertPromiseResult((async() => {
+    trigger();
+
+    return countdown(iterations * 2);
+  })());
+})();
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/add.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/add.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: -0xc4043e2c4cc49e4d6870103ce7c2ff2d512bf4b1b67553ba410db514ee0af8888ad6cfn,
  b: 0x2aae86de73ff479133a657a40d26e8dcf192019c7421836615ec34978bad93n,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/and.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/and.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0x9252b94f220ded0c18706998886397699c5a25527575dn,
  b: -0x286817ba2e8fd8n,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/as-int-n.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/as-int-n.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-bigint
-
 // BigInt.asIntN
 {
  assertEquals(2, BigInt.asIntN.length);
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/basics.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/basics.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 'use strict'

--- a/implementation-contributed/v8/mjsunit/harmony/bigint/comparisons.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/comparisons.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 'use strict'

--- a/implementation-contributed/v8/mjsunit/harmony/bigint/dataview.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/dataview.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-bigint
-
 var buffer = new ArrayBuffer(64);
 var dataview = new DataView(buffer, 8, 24);
 var bytes = new Uint8Array(buffer);
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/dec.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/dec.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e7n,
  r: 0x26ffcdbd233a53e7ca4612f2b02e1f2c1d885c3177e6n
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/div.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/div.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: -0x1e0f357314bac34227333c0c2086430dae88cb538f161174888591n,
  b: 0x390n,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/exp.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/exp.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 assertEquals(1n, (-1n) ** 0n);
 assertEquals(-1n, (-1n) ** 1n);
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/inc.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/inc.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0xb3df90n,
  r: 0xb3df91n
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/json.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/json.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 'use strict'

--- a/implementation-contributed/v8/mjsunit/harmony/bigint/mod.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/mod.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0xaed3c714bb42a73d708bcf1dc9a9deebadc913ef42bac6a6178a60n,
  b: -0xf3d6bd1c059b79n,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/mul.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/mul.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0x2bf1f236c2df29f7c99be052dfe1b69ae158d777fea487af889f6259f472c0n,
  b: -0xae0090dfn,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/neg.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/neg.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0xcn,
  r: -0xcn
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/not.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/not.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0x9f0305cd75e4n,
  r: -0x9f0305cd75e5n
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/or.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/or.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0x77a87n,
  b: 0xde08e7433fb9584911b8cb4bc7eed802299b4489fc635974d063847da4e8b461df5dn,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/regress-tonumbercode.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/regress-tonumbercode.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 function f(x, b) {
    if (b) return Math.trunc(+(x))
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/regressions.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/regressions.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-bigint
-
 var a = 5n;
 var b = a / -1n;
 assertEquals(5n, a);
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/sar.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/sar.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0x211a34fn,
  b: 0xa6n,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/shl.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/shl.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: -0xe813d76adc0a177778c0c232c595e8572b783210f4a7009d7c1787n,
  b: 0x9en,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/sub.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/sub.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: 0xc4fd438551d58edn,
  b: 0x91b42ee55a50d974an,
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/tonumber.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/tonumber.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-bigint
-
 function Check(bigint, number_string) {
  var number = Number(bigint);
  if (number_string.substring(0, 2) === "0x") {
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/turbo.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/turbo.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --allow-natives-syntax --harmony-bigint
+// Flags: --allow-natives-syntax

 'use strict'

--- a/implementation-contributed/v8/mjsunit/harmony/bigint/typedarray.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/typedarray.js
@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-bigint --allow-natives-syntax
+// Flags: --allow-natives-syntax

 var intarray = new BigInt64Array(8);
 var uintarray = new BigUint64Array(8);
--- a/implementation-contributed/v8/mjsunit/harmony/bigint/xor.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigint/xor.js
@ -4,8 +4,6 @@

 // Generated by tools/bigint-tester.py.

-// Flags: --harmony-bigint
-
 var data = [{
  a: -0x46505bec40d461c595b5e4be178b7d00n,
  b: -0x9170e5437d4e3ec7c0971e2c6d3bbbd2929ff108ea4ee64f7a91aa367fn,
--- a/implementation-contributed/v8/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
+++ b/implementation-contributed/v8/mjsunit/harmony/bigintarray-keyedstore-tobigint.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-bigint
-
 let TypedArrayConstructors = [
  BigUint64Array,
  BigInt64Array,
--- a/implementation-contributed/v8/mjsunit/harmony/function-tostring.js
+++ b/implementation-contributed/v8/mjsunit/harmony/function-tostring.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-function-tostring
-
 var prefix = "/*before*/";
 var suffix = "/*after*/";

--- a/implementation-contributed/v8/mjsunit/regress/regress-319722-ArrayBuffer.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-319722-ArrayBuffer.js
@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 // Flags: --nostress-opt --allow-natives-syntax --mock-arraybuffer-allocator
-var maxSize = %_MaxSmi() + 1;
+var maxSize = %MaxSmi() + 1;
 var ab;

 // Allocate the largest ArrayBuffer we can on this architecture.
--- a/implementation-contributed/v8/mjsunit/regress/regress-319722-TypedArrays.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-319722-TypedArrays.js
@ -27,7 +27,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.

 // Flags: --nostress-opt --allow-natives-syntax
-var maxSize = %_MaxSmi() + 1;
+var maxSize = %MaxSmi() + 1;
 function TestArray(constr) {
  assertThrows(function() {
    new constr(maxSize);
--- a/implementation-contributed/v8/mjsunit/regress/regress-707066.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-707066.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 //
-// Flags: --harmony-function-tostring
-
 // There was a bug in CreateDynamicFunction where a stack overflow
 // situation caused an assertion failure.

--- a/implementation-contributed/v8/mjsunit/regress/regress-8237.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-8237.js
@ -0,0 +1,57 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-always-opt
+// Files: test/mjsunit/code-coverage-utils.js
+
+%DebugToggleBlockCoverage(true);
+
+TestCoverage(
+"Repro for the bug",
+`
+function lib (n) {                        // 0000
+  if (n >= 0) {                           // 0050
+    if (n < 0) {                          // 0100
+      return;                             // 0150
+    }                                     // 0200
+  } else if (foo()) {                     // 0250
+  }                                       // 0300
+}                                         // 0350
+function foo () {                         // 0400
+  console.log('foo')                      // 0450
+  return false                            // 0500
+}                                         // 0550
+lib(1)                                    // 0600
+`,
+[{"start":0,"end":649,"count":1},
+{"start":0,"end":351,"count":1},
+{"start":115,"end":205,"count":0},
+{"start":253,"end":303,"count":0},
+{"start":400,"end":551,"count":0}]
+);
+
+TestCoverage(
+"Variant with omitted brackets",
+`
+function lib (n) {                        // 0000
+  if (n >= 0) {                           // 0050
+    if (n < 0)                            // 0100
+      return;                             // 0150
+  }                                       // 0200
+  else if (foo());                        // 0250
+}                                         // 0300
+function foo () {                         // 0350
+  console.log('foo')                      // 0400
+  return false                            // 0450
+}                                         // 0500
+lib(1)                                    // 0550
+`,
+[{"start":0,"end":599,"count":1},
+{"start":0,"end":301,"count":1},
+{"start":156,"end":163,"count":0},
+{"start":203,"end":268,"count":0},
+{"start":350,"end":501,"count":0}]
+);
+
+%DebugToggleBlockCoverage(false);
--- a/implementation-contributed/v8/mjsunit/regress/regress-8265.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-8265.js
@ -0,0 +1,12 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --random-seed=1
+
+for (let i = 0; i < 54; ++i) Math.random();
+let sum = 0;
+for (let i = 0; i < 10; ++i)
+  sum += Math.floor(Math.random() * 50);
+
+assertNotEquals(0, sum);
--- a/implementation-contributed/v8/mjsunit/regress/regress-890553.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-890553.js
@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+"use strict";
+var s = "function __f_9(func, testName) {" +
+  "var __v_0 = function __f_10(__v_14, __v_14) {" +
+  "  return __v_16;" +
+  "}; " +
+"}"
+assertThrows(function() { eval(s); });
--- a/implementation-contributed/v8/mjsunit/regress/regress-crbug-890243.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-890243.js
@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a SpeculativeNumberAdd with Number feedback.
+function bar(x) { return x + x; }
+bar(0.1);
+
+// We also need an indirection via an object field such
+// that only after escape analysis TurboFan can figure
+// out that the value `y` is actually a Number in the
+// safe integer range.
+function baz(y) { return {y}; }
+baz(null); baz(0);
+
+// Now we can put all of that together to get a kRepBit
+// use of a kWord64 value (on 64-bit architectures).
+function foo(o) {
+  return !baz(bar(o.x)).y;
+}
+
+assertFalse(foo({x:1}));
+assertFalse(foo({x:1}));
+%OptimizeFunctionOnNextCall(foo);
+assertFalse(foo({x:1}));
--- a/implementation-contributed/v8/mjsunit/regress/regress-crbug-891627.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-891627.js
@ -0,0 +1,43 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// We need a NumberModulus, so we make sure that we have a
+// SpeculativeNumberModulus with Number feedback, and later
+// on use it with known Number inputs (via the bitwise or),
+// such that JSTypedLowering turns it into the NumberModulus.
+function bar(x) { return x % 2; }
+bar(0.1);
+
+// Check that the Word32->Float64 conversion works properly.
+(function() {
+  function foo(x) {
+    // The NumberEqual identifies 0 and -0.
+    return bar(x | -1) == 4294967295;
+  }
+
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+})();
+
+// Check that the Word32->Word32 conversion works properly.
+(function() {
+  function makeFoo(y) {
+    return function foo(x) {
+      return bar(x | -1) == y;
+    }
+  }
+  makeFoo(0);  // Defeat the function context specialization.
+  const foo = makeFoo(1);
+
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+  %OptimizeFunctionOnNextCall(foo);
+  assertFalse(foo(1));
+  assertFalse(foo(0));
+})();
--- a/implementation-contributed/v8/mjsunit/regress/regress-crbug-892472-1.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-892472-1.js
@ -0,0 +1,9 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+const a = /x/;
+a.exec = RegExp.prototype.test;
+assertThrows(() => RegExp.prototype.test.call(a));
--- a/implementation-contributed/v8/mjsunit/regress/regress-crbug-892472-2.js
+++ b/implementation-contributed/v8/mjsunit/regress/regress-crbug-892472-2.js
@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --async-stack-traces
+
+assertThrows(_ => '' + {toString: Object.prototype.toLocaleString});
--- a/implementation-contributed/v8/mjsunit/smi-mul.js
+++ b/implementation-contributed/v8/mjsunit/smi-mul.js
@ -27,41 +27,34 @@

 // Flags: --allow-natives-syntax --opt --noalways-opt

-function mul(a, b) {
-    return a * b;
-}
+(function() {
+  function mul(a, b) {
+      return a * b;
+  }

+  mul(-1, 2);
+  mul(-1, 2);
+  %OptimizeFunctionOnNextCall(mul);
+  assertEquals(-2, mul(-1, 2));
+  assertOptimized(mul);

-mul(-1, 2);
-mul(-1, 2);
-%OptimizeFunctionOnNextCall(mul);
-assertEquals(-2, mul(-1, 2));
-assertOptimized(mul);
+  // Deopt on minus zero.
+  assertEquals(-0, mul(-1, 0));
+  assertUnoptimized(mul);
+})();

-// Deopt on minus zero.
-assertEquals(-0, mul(-1, 0));
-assertUnoptimized(mul);
+(function() {
+  function mul2(a, b) {
+      return a * b;
+  }

+  mul2(-1, 2);
+  mul2(-1, 2);
+  %OptimizeFunctionOnNextCall(mul2);
+  assertEquals(-2, mul2(-1, 2));
+  assertOptimized(mul2);

-function mul2(a, b) {
-    return a * b;
-}
-
-mul2(-1, 2);
-mul2(-1, 2);
-%OptimizeFunctionOnNextCall(mul2);
-
-// 2^30 is a smi boundary on arm and ia32.
-var two_30 = 1 << 30;
-// 2^31 is a smi boundary on x64.
-var two_31 = 2 * two_30;
-
-if (%IsValidSmi(two_31)) {
-  // Deopt on two_31 on x64.
-  assertEquals(two_31, mul2(-two_31, -1));
+  // Deopt on 2^31.
+  assertEquals(1 << 31, mul2(-(1 << 31), -1));
  assertUnoptimized(mul2);
-} else {
-  // Deopt on two_30 on ia32.
-  assertEquals(two_30, mul2(-two_30, -1));
-  assertUnoptimized(mul2);
-}
+})();
--- a/implementation-contributed/v8/mjsunit/string-trim.js
+++ b/implementation-contributed/v8/mjsunit/string-trim.js
@ -2,8 +2,6 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.

-// Flags: --harmony-string-trimming
-
 assertEquals('trim',      String.prototype.trim.name);
 assertEquals('trimStart', String.prototype.trimStart.name);
 assertEquals('trimStart', String.prototype.trimLeft.name);
--- a/implementation-contributed/v8/test262/test262.status
+++ b/implementation-contributed/v8/test262/test262.status
@ -364,9 +364,6 @@
  'language/global-code/script-decl-func-err-non-configurable': [FAIL],
  'language/global-code/script-decl-var-collision': [FAIL],

-  # https://bugs.chromium.org/p/v8/issues/detail?id=4958
-  'built-ins/Function/prototype/toString/*': ['--harmony-function-tostring'],
-
  # https://bugs.chromium.org/p/v8/issues/detail?id=5116
  'built-ins/TypedArray/prototype/fill/fill-values-conversion-operations-consistent-nan': [PASS, FAIL],

@ -563,27 +560,43 @@
  'intl402/Collator/prototype/compare/bound-to-collator-instance': [SKIP],
  'intl402/Collator/ignore-invalid-unicode-ext-values': [SKIP],

-  # https://bugs.chromium.org/p/v8/issues/detail?id=7684
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8260
+  'intl402/Locale/constructor-non-iana-canon': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8261
+  'intl402/Locale/constructor-options-language-valid': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8262
+  'intl402/Locale/constructor-parse-twice': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8259
+  'intl402/Locale/subclassing': [SKIP],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8246
+  'intl402/Locale/constructor-tag': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8244
  'intl402/Locale/constructor-getter-order': [FAIL],
  'intl402/Locale/constructor-locale-object': [FAIL],
-  'intl402/Locale/constructor-non-iana-canon': [FAIL],
  'intl402/Locale/constructor-options-language-grandfathered': [FAIL],
  'intl402/Locale/constructor-options-language-invalid': [FAIL],
-  'intl402/Locale/constructor-options-language-valid': [FAIL],
  'intl402/Locale/constructor-options-region-invalid': [FAIL],
  'intl402/Locale/constructor-options-region-valid': [FAIL],
  'intl402/Locale/constructor-options-script-invalid': [FAIL],
  'intl402/Locale/constructor-options-script-valid': [FAIL],
-  'intl402/Locale/constructor-parse-twice': [FAIL],
-  'intl402/Locale/constructor-tag': [FAIL],
-  'intl402/Locale/constructor-unicode-ext-invalid': [FAIL],
-  'intl402/Locale/extensions-grandfathered': [FAIL],
-  'intl402/Locale/extensions-private': [FAIL],
  'intl402/Locale/getters': [FAIL],
-  'intl402/Locale/getters-grandfathered': [FAIL],
-  'intl402/Locale/getters-privateuse': [FAIL],
  'intl402/Locale/invalid-tag-throws': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8243
+  'intl402/Locale/extensions-private': [FAIL],
+  'intl402/Locale/getters-privateuse': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8236
  'intl402/Locale/likely-subtags': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8242
+  'intl402/Locale/extensions-grandfathered': [FAIL],
+  'intl402/Locale/getters-grandfathered': [FAIL],
  'intl402/Locale/likely-subtags-grandfathered': [FAIL],

  # https://bugs.chromium.org/p/v8/issues/detail?id=6705
@ -616,6 +629,22 @@
  'built-ins/Atomics/wait/cannot-suspend-throws': [SKIP],
  'built-ins/Atomics/wait/undefined-index-defaults-to-zero': [SKIP],

+  # https://bugs.chromium.org/p/v8/issues/detail?id=6890#c12
+  'built-ins/RegExp/prototype/Symbol.matchAll/isregexp-called-once': [FAIL],
+  'built-ins/RegExp/prototype/Symbol.matchAll/species-constructor': [FAIL],
+  'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-global-throws': [FAIL],
+  'built-ins/RegExp/prototype/Symbol.matchAll/species-regexp-get-unicode-throws': [FAIL],
+  'built-ins/String/prototype/matchAll/regexp-prototype-has-no-matchAll': [FAIL],
+
+  # https://bugs.chromium.org/p/v8/issues/detail?id=8258
+  'intl402/DateTimeFormat/constructor-options-throwing-getters': [FAIL],
+  'intl402/Locale/constructor-options-language-valid-undefined': [FAIL],
+  'intl402/Locale/constructor-options-throwing-getters': [FAIL],
+  'intl402/Locale/constructor-tag-tostring': [FAIL],
+  'intl402/NumberFormat/prototype/format/format-fraction-digits-precision': [FAIL],
+  'intl402/NumberFormat/prototype/format/format-significant-digits-precision': [FAIL],
+  'intl402/NumberFormat/prototype/formatToParts/value-tonumber': [FAIL],
+
  ##################### DELIBERATE INCOMPATIBILITIES #####################

  # https://github.com/tc39/ecma262/pull/889
@ -643,6 +672,10 @@

  ############################ INVALID TESTS #############################

+  # https://github.com/tc39/test262/pull/1816#issuecomment-426799415
+  # https://github.com/tc39/test262/pull/1818
+  'language/reserved-words/unreserved-words': [PASS, FAIL],
+
  # Test makes unjustified assumptions about the number of calls to SortCompare.
  # Test262 Bug: https://bugs.ecmascript.org/show_bug.cgi?id=596
  'built-ins/Array/prototype/sort/bug_596_1': [PASS, FAIL_OK],
@ -713,6 +746,28 @@
  'language/statements/class/fields-same-line-async-method-static-private-methods-with-fields': [FAIL],
  'language/statements/class/fields-same-line-gen-static-private-methods-with-fields': [FAIL],

+  # https://github.com/tc39/test262/issues/1817
+  'language/expressions/class/dstr-private-gen-meth-dflt-ary-init-iter-close': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-dflt-ary-init-iter-no-close': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-dflt-ary-ptrn-rest-id-exhausted': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-ary-init-iter-close': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-ary-init-iter-no-close': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-ary-ptrn-rest-id': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-ary-ptrn-rest-id-exhausted': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-obj-ptrn-rest-getter': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-obj-ptrn-rest-skip-non-enumerable': [FAIL],
+  'language/expressions/class/dstr-private-gen-meth-static-dflt-obj-ptrn-rest-val-obj': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-dflt-ary-init-iter-close': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-dflt-ary-init-iter-no-close': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-dflt-ary-ptrn-rest-id-exhausted': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-ary-init-iter-close': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-ary-init-iter-no-close': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-ary-ptrn-rest-id': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-ary-ptrn-rest-id-exhausted': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-obj-ptrn-rest-getter': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-obj-ptrn-rest-skip-non-enumerable': [FAIL],
+  'language/statements/class/dstr-private-gen-meth-static-dflt-obj-ptrn-rest-val-obj': [FAIL],
+
  ############################ SLOW TESTS #############################

  'annexB/built-ins/RegExp/RegExp-leading-escape-BMP': [PASS, SLOW],
--- a/implementation-contributed/v8/test262/testcfg.py
+++ b/implementation-contributed/v8/test262/testcfg.py
@ -42,7 +42,6 @@ from testrunner.outproc import test262

 # TODO(littledan): move the flag mapping into the status file
 FEATURE_FLAGS = {
-  'BigInt': '--harmony-bigint',
  'class-fields-public': '--harmony-public-fields',
  'class-static-fields-public': '--harmony-class-fields',
  'Array.prototype.flat': '--harmony-array-flat',
@ -53,12 +52,13 @@ FEATURE_FLAGS = {
  'Intl.ListFormat': '--harmony-intl-list-format',
  'Intl.Locale': '--harmony-locale',
  'Intl.RelativeTimeFormat': '--harmony-intl-relative-time-format',
+  'Intl.Segmenter': '--harmony-intl-segmenter',
  'Symbol.prototype.description': '--harmony-symbol-description',
  'globalThis': '--harmony-global',
+  'well-formed-json-stringify': '--harmony-json-stringify',
 }

-SKIPPED_FEATURES = set(['Intl.Segmenter',
-                        'Object.fromEntries',
+SKIPPED_FEATURES = set(['Object.fromEntries',
                        'export-star-as-namespace-from-module',
                        'class-fields-private',
                        'class-static-fields-private',
--- a/src/dynamic-import/assignment-expr-not-optional.case
+++ b/src/dynamic-import/assignment-expr-not-optional.case
@ -0,0 +1,14 @@
+// Copyright (C) 2018 Rick Waldron. All rights reserved.
+// Copyright (C) 2018 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+desc: It's a SyntaxError if AssignmentExpression is omitted
+template: syntax/invalid
+info: |
+  ImportCall :
+      import( AssignmentExpression[+In, ?Yield] )
+---*/
+//- import
+import()
+//- teardown
+/* The params region intentionally empty */
--- a/src/dynamic-import/catch/nested-arrow.template
+++ b/src/dynamic-import/catch/nested-arrow.template
@ -0,0 +1,35 @@
+// Copyright (C) 2018 Rick Waldron. All rights reserved.
+// Copyright (C) 2018 the V8 project authors. All rights reserved.
+// This code is governed by the BSD license found in the LICENSE file.
+/*---
+path: language/module-code/dynamic-import/catch/nested-arrow-import-catch-
+name: nested arrow
+esid: sec-import-call-runtime-semantics-evaluation
+info: |
+  ImportCall :
+      import( AssignmentExpression )
+
+  1. Let referencingScriptOrModule be ! GetActiveScriptOrModule().
+  2. Assert: referencingScriptOrModule is a Script Record or Module Record (i.e. is not null).
+  3. Let argRef be the result of evaluating AssignmentExpression.
+  4. Let specifier be ? GetValue(argRef).
+  5. Let promiseCapability be ! NewPromiseCapability(%Promise%).
+  6. Let specifierString be ToString(specifier).
+  7. IfAbruptRejectPromise(specifierString, promiseCapability).
+  8. Perform ! HostImportModuleDynamically(referencingScriptOrModule, specifierString, promiseCapability).
+  9. Return promiseCapability.[[Promise]].
+
+
+features: [dynamic-import]
+flags: [async]
+---*/
+
+let f = () => {
+  import(/*{ params }*/).catch(error => {
+
+    /*{ body }*/
+
+  }).then($DONE, $DONE);
+};
+
+f();
--- a/Show More
+++ b/Show More