diff --git a/implementation-contributed/curation_logs/v8.json b/implementation-contributed/curation_logs/v8.json
index 68cd5372d5..ed16970ee5 100644
--- a/implementation-contributed/curation_logs/v8.json
+++ b/implementation-contributed/curation_logs/v8.json
@@ -1,5 +1,5 @@
 {
-  "sourceRevisionAtLastExport": "9f893284",
-  "targetRevisionAtLastExport": "234933fe8a",
+  "sourceRevisionAtLastExport": "4dc8ce93",
+  "targetRevisionAtLastExport": "25f3532881",
   "curatedFiles": {}
 }
\ No newline at end of file
diff --git a/implementation-contributed/v8/mjsunit/code-coverage-block.js b/implementation-contributed/v8/mjsunit/code-coverage-block.js
index 61ed87fc13..8cbb2969f7 100644
--- a/implementation-contributed/v8/mjsunit/code-coverage-block.js
+++ b/implementation-contributed/v8/mjsunit/code-coverage-block.js
@@ -471,7 +471,7 @@ TestCoverage(
  {"start":472,"end":503,"count":0},
  {"start":626,"end":653,"count":0},
  {"start":768,"end":803,"count":0},
- {"start":867,"end":868,"count":0}]
+ {"start":867,"end":869,"count":0}]
 );
 
 TestCoverage(
@@ -850,4 +850,46 @@ Util.escape("foo.bar");                   // 0400
  {"start":268,"end":350,"count":0}]
 );
 
+TestCoverage(
+"https://crbug.com/v8/8237",
+`
+!function() {                             // 0000
+  if (true)                               // 0050
+    while (false) return; else nop();     // 0100
+}();                                      // 0150
+!function() {                             // 0200
+  if (true) l0: { break l0; } else        // 0250
+    if (nop()) { }                        // 0300
+}();                                      // 0350
+!function() {                             // 0400
+  if (true) { if (false) { return; }      // 0450
+  } else if (nop()) { } }();              // 0500
+!function(){                              // 0550
+  if(true)while(false)return;else nop()   // 0600
+}();                                      // 0650
+!function(){                              // 0700
+  if(true) l0:{break l0}else if (nop()){} // 0750
+}();                                      // 0800
+!function(){                              // 0850
+  if(true){if(false){return}}else         // 0900
+    if(nop()){}                           // 0950
+}();                                      // 1000
+`,
+[{"start":0,"end":1049,"count":1},
+ {"start":1,"end":151,"count":1},
+ {"start":118,"end":137,"count":0},
+ {"start":201,"end":351,"count":1},
+ {"start":277,"end":318,"count":0},
+ {"start":401,"end":525,"count":1},
+ {"start":475,"end":486,"count":0},
+ {"start":503,"end":523,"count":0},
+ {"start":551,"end":651,"count":1},
+ {"start":622,"end":639,"count":0},
+ {"start":701,"end":801,"count":1},
+ {"start":773,"end":791,"count":0},
+ {"start":851,"end":1001,"count":1},
+ {"start":920,"end":928,"count":0},
+ {"start":929,"end":965,"count":0}]
+);
+
 %DebugToggleBlockCoverage(false);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-10.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-10.js
new file mode 100644
index 0000000000..d8d20ee9ca
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-10.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %IteratorPrototype%. No more tests should be run after this in
+// the same instance.
+var iterator = map.keys();
+// iterator object --> %MapIteratorPrototype% --> %IteratorPrototype%
+iterator.__proto__.__proto__[Symbol.iterator] =
+  () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-2.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-2.js
new file mode 100644
index 0000000000..7adf058fb4
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-2.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapPrototype%. No more tests should be run after this in the
+// same instance.
+map.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-3.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-3.js
new file mode 100644
index 0000000000..ca0dc9cac2
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-3.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map[Symbol.iterator]();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-4.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-4.js
new file mode 100644
index 0000000000..a43282a69c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-4.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.keys();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-5.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-5.js
new file mode 100644
index 0000000000..0af32b58ba
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-5.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.values();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-6.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-6.js
new file mode 100644
index 0000000000..6611e7aca0
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-6.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+var iterator = map.values();
+iterator.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-7.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-7.js
new file mode 100644
index 0000000000..b5a2345bd8
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-7.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.entries();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-8.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-8.js
new file mode 100644
index 0000000000..01dacfb72e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-8.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.keys();
+iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-9.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-9.js
new file mode 100644
index 0000000000..2db159d80e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-9.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+var iterator = map.keys();
+iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-1.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-1.js
new file mode 100644
index 0000000000..2e4447de68
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-1.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+set[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-10.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-10.js
new file mode 100644
index 0000000000..ec094d20d0
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-10.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %IteratorPrototype%. No more tests should be run after this in
+// the same instance.
+var iterator = set.keys();
+// iterator object --> %SetIteratorPrototype% --> %IteratorPrototype%
+iterator.__proto__.__proto__[Symbol.iterator] =
+  () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-2.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-2.js
new file mode 100644
index 0000000000..b1fc6bbfea
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-2.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetPrototype%. No more tests should be run after this in the
+// same instance.
+set.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-3.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-3.js
new file mode 100644
index 0000000000..b727f3280c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-3.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set[Symbol.iterator]();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-4.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-4.js
new file mode 100644
index 0000000000..69a18893e8
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-4.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.keys();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-5.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-5.js
new file mode 100644
index 0000000000..ec8a653b69
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-5.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.values();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-6.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-6.js
new file mode 100644
index 0000000000..c5a2a7b09d
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-6.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+var iterator = set.values();
+iterator.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-7.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-7.js
new file mode 100644
index 0000000000..a244b1e47f
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-7.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.entries();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-8.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-8.js
new file mode 100644
index 0000000000..2328a7b737
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-8.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.keys();
+iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-9.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-9.js
new file mode 100644
index 0000000000..42cbf3077a
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-9.js
@@ -0,0 +1,31 @@
+
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+var iterator = set.keys();
+iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/harmony/modules-import-17.js b/implementation-contributed/v8/mjsunit/harmony/modules-import-17.js
new file mode 100644
index 0000000000..f73aa68f3b
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/modules-import-17.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-namespace-exports
+
+var ns;
+import('modules-skip-13.js').then(x => ns = x);
+%RunMicrotasks();
+assertEquals(42, ns.default);
+assertEquals(ns, ns.self);
diff --git a/implementation-contributed/v8/mjsunit/harmony/modules-skip-13.js b/implementation-contributed/v8/mjsunit/harmony/modules-skip-13.js
new file mode 100644
index 0000000000..d823a283f8
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/modules-skip-13.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * as self from "./modules-skip-13.js";
+export default 42;
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.status b/implementation-contributed/v8/mjsunit/mjsunit.status
index 7200f41ac6..7f564ffe01 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.status
+++ b/implementation-contributed/v8/mjsunit/mjsunit.status
@@ -467,6 +467,9 @@
   'regress/wasm/regress-694433': [SKIP],
   'es6/typedarray': [PASS, NO_VARIANTS],
   'regress/regress-752764': [PASS, NO_VARIANTS],
+
+  # BUG(v8:8294). Started flaking from seemingly unrelated commits, investigating.
+  'object-seal': [SKIP],
 }],  # 'tsan == True'
 
 ##############################################################################
@@ -796,6 +799,9 @@
   'es6/classes': [PASS, ['tsan', SKIP]],
   'regress/regress-1122': [PASS, ['tsan', SKIP]],
 
+  # Too slow with gc_stress on arm64.
+  'messages': [PASS, ['gc_stress and arch == arm64', SKIP]],
+
   # Slow on arm64 simulator: https://crbug.com/v8/7783
   'string-replace-gc': [PASS, ['arch == arm64 and simulator_run', SKIP]],
 
@@ -892,4 +898,44 @@
   'wasm/asm-wasm-f64': [SKIP],
 }], # arch == x64
 
+##############################################################################
+['arch == ia32 and embedded_builtins == True', {
+  # TODO(v8:6666): Fix arguments adaptor trampoline
+  'wasm/compiled-module-serialization': [SKIP],
+  'asm/embenchen/copy': [SKIP],
+  'wasm/embenchen/corrections': [SKIP],
+  'asm/embenchen/primes': [SKIP],
+  'asm/embenchen/corrections': [SKIP],
+  'wasm/embenchen/copy': [SKIP],
+  'asm/embenchen/fannkuch': [SKIP],
+  'asm/embenchen/memops': [SKIP],
+  'asm/embenchen/fasta': [SKIP],
+  'wasm/embenchen/fannkuch': [SKIP],
+  'asm/embenchen/zlib': [SKIP],
+  'wasm/embenchen/fasta': [SKIP],
+  'wasm/embenchen/primes': [SKIP],
+  'wasm/embenchen/box2d': [SKIP],
+  'asm/embenchen/box2d': [SKIP],
+  'wasm/embenchen/memops': [SKIP],
+  'wasm/embenchen/zlib': [SKIP],
+  'asm/embenchen/lua_binarytrees': [SKIP],
+  'wasm/embenchen/lua_binarytrees': [SKIP],
+  'asm/sqlite3/sqlite': [SKIP],
+  'asm/sqlite3/sqlite-safe-heap': [SKIP],
+  'asm/sqlite3/sqlite-pointer-masking': [SKIP],
+  'asm/poppler/poppler': [SKIP],
+  'regress/wasm/regress-808848': [SKIP],
+  'regress/wasm/regress-834624': [SKIP],
+  'regress/wasm/regress-843563': [SKIP],
+  'wasm/anyref': [SKIP],
+  'wasm/exceptions-shared': [SKIP],
+  'wasm/errors': [SKIP],
+  'wasm/ffi-error': [SKIP],
+  'wasm/gc-frame': [SKIP],
+  'wasm/import-function': [SKIP],
+  'wasm/ffi': [SKIP],
+  'wasm/test-wasm-module-builder': [SKIP],
+  'wasm/stackwalk': [SKIP],
+}],  # arch == ia32 and embedded_builtins == True
+
 ]
diff --git a/implementation-contributed/v8/mjsunit/modules-export-star-as1.js b/implementation-contributed/v8/mjsunit/modules-export-star-as1.js
new file mode 100644
index 0000000000..1696c1c84d
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-export-star-as1.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+import {foo} from "./modules-skip-8.js";
+assertEquals(42, foo.default);
+assertEquals(1, foo.get_a());
diff --git a/implementation-contributed/v8/mjsunit/modules-export-star-as2.js b/implementation-contributed/v8/mjsunit/modules-export-star-as2.js
new file mode 100644
index 0000000000..57828ebd67
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-export-star-as2.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+export * as self from "./modules-export-star-as2.js";
+export * as self_again from "./modules-export-star-as2.js";
+import {self as myself} from "./modules-export-star-as2.js";
+import {self_again as myself_again} from "./modules-export-star-as2.js";
+
+assertEquals(["self", "self_again"], Object.keys(myself));
+assertEquals(myself, myself.self);
+assertEquals(myself_again, myself.self_again);
+assertEquals(myself, myself_again);
+
+assertThrows(_ => self, ReferenceError);
+assertThrows(_ => self_again, ReferenceError);
diff --git a/implementation-contributed/v8/mjsunit/modules-export-star-as3.js b/implementation-contributed/v8/mjsunit/modules-export-star-as3.js
new file mode 100644
index 0000000000..4077cbd9c6
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-export-star-as3.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+let self = 42;
+export * as self from "./modules-export-star-as3.js";
+import {self as myself} from "./modules-export-star-as3.js";
+assertEquals(["self"], Object.keys(myself));
+assertEquals(myself, myself.self);
+assertEquals(42, self);
+self++;
+assertEquals(43, self);
diff --git a/implementation-contributed/v8/mjsunit/modules-imports8.js b/implementation-contributed/v8/mjsunit/modules-imports8.js
new file mode 100644
index 0000000000..56ea60f4c3
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-imports8.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+import {a, b} from "./modules-skip-9.js";
+assertSame(a, b);
+assertEquals(42, a.default);
+assertEquals(1, a.a);
diff --git a/implementation-contributed/v8/mjsunit/modules-skip-8.js b/implementation-contributed/v8/mjsunit/modules-skip-8.js
new file mode 100644
index 0000000000..376788e283
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-skip-8.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * as foo from "./modules-skip-1.js";
diff --git a/implementation-contributed/v8/mjsunit/modules-skip-9.js b/implementation-contributed/v8/mjsunit/modules-skip-9.js
new file mode 100644
index 0000000000..c0afcdf99e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-skip-9.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as b from "./modules-skip-1.js";
+export {b};
+export * as a from "./modules-skip-1.js";