deps: upgrade to V8 4.9.385.18

Pick up the current branch head for V8 4.9
https://github.com/v8/v8/commit/1ecba0f

PR-URL: https://github.com/nodejs/node/pull/4722
Reviewed-By: Ben Noordhuis <info@bnoordhuis.nl>
Reviewed-By: Michaël Zasso <mic.besace@gmail.com>

79 files changed, 2570 insertions, 339 deletions

diff --git a/deps/v8/test/mjsunit/es6/array-tostring.js b/deps/v8/test/mjsunit/es6/array-tostring.js
index 8a9198ca16..397fde4ab1 100644
--- a/deps/v8/test/mjsunit/es6/array-tostring.js
+++ b/deps/v8/test/mjsunit/es6/array-tostring.js
@@ -41,7 +41,7 @@ function testToStringTag(className) {
   Object.defineProperty(obj, Symbol.toStringTag, {
     get: function() { throw className; }
   });
-  assertThrows(function() {
+  assertThrowsEquals(function() {
     Array.prototype.toString.call(obj);
   }, className);
 
diff --git a/deps/v8/test/mjsunit/es6/arrow-rest-params-lazy-parsing.js b/deps/v8/test/mjsunit/es6/arrow-rest-params-lazy-parsing.js
new file mode 100644
index 0000000000..05e92b6ed6
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/arrow-rest-params-lazy-parsing.js
@@ -0,0 +1,144 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --min-preparse-length=0
+
+(function testRestIndex() {
+  assertEquals(5, ((...args) => args.length)(1,2,3,4,5));
+  assertEquals(4, ((a, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(3, ((a, b, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(2, ((a, b, c, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(1, ((a, b, c, d, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(0, ((a, b, c, d, e, ...args) => args.length)(1,2,3,4,5));
+})();
+
+// strictTest and sloppyTest should be called with descending natural
+// numbers, as in:
+//
+//   strictTest(6,5,4,3,2,1)
+//
+var strictTest = (function() {
+  "use strict";
+  return (a, b, ...c) => {
+    assertEquals(Array, c.constructor);
+    assertTrue(Array.isArray(c));
+
+    var expectedLength = (a === undefined) ? 0 : a - 2;
+    assertEquals(expectedLength, c.length);
+
+    for (var i = 2; i < a; ++i) {
+      assertEquals(c[i - 2], a - i);
+    }
+  };
+})();
+
+var sloppyTest = (a, b, ...c) => {
+  assertEquals(Array, c.constructor);
+  assertTrue(Array.isArray(c));
+
+  var expectedLength = (a === undefined) ? 0 : a - 2;
+  assertEquals(expectedLength, c.length);
+
+  for (var i = 2; i < a; ++i) {
+    assertEquals(c[i - 2], a - i);
+  }
+};
+
+
+var O = {
+  strict: strictTest,
+  sloppy: sloppyTest
+};
+
+(function testStrictRestParamArity() {
+  assertEquals(2, strictTest.length);
+  assertEquals(2, O.strict.length);
+})();
+
+
+(function testRestParamsStrictMode() {
+  strictTest();
+  strictTest(2, 1);
+  strictTest(6, 5, 4, 3, 2, 1);
+  strictTest(3, 2, 1);
+  O.strict();
+  O.strict(2, 1);
+  O.strict(6, 5, 4, 3, 2, 1);
+  O.strict(3, 2, 1);
+})();
+
+
+(function testRestParamsStrictModeApply() {
+  strictTest.apply(null, []);
+  strictTest.apply(null, [2, 1]);
+  strictTest.apply(null, [6, 5, 4, 3, 2, 1]);
+  strictTest.apply(null, [3, 2, 1]);
+  O.strict.apply(O, []);
+  O.strict.apply(O, [2, 1]);
+  O.strict.apply(O, [6, 5, 4, 3, 2, 1]);
+  O.strict.apply(O, [3, 2, 1]);
+})();
+
+
+(function testRestParamsStrictModeCall() {
+  strictTest.call(null);
+  strictTest.call(null, 2, 1);
+  strictTest.call(null, 6, 5, 4, 3, 2, 1);
+  strictTest.call(null, 3, 2, 1);
+  O.strict.call(O);
+  O.strict.call(O, 2, 1);
+  O.strict.call(O, 6, 5, 4, 3, 2, 1);
+  O.strict.call(O, 3, 2, 1);
+})();
+
+
+(function testsloppyRestParamArity() {
+  assertEquals(2, sloppyTest.length);
+  assertEquals(2, O.sloppy.length);
+})();
+
+
+(function testRestParamsSloppyMode() {
+  sloppyTest();
+  sloppyTest(2, 1);
+  sloppyTest(6, 5, 4, 3, 2, 1);
+  sloppyTest(3, 2, 1);
+  O.sloppy();
+  O.sloppy(2, 1);
+  O.sloppy(6, 5, 4, 3, 2, 1);
+  O.sloppy(3, 2, 1);
+})();
+
+
+(function testRestParamssloppyModeApply() {
+  sloppyTest.apply(null, []);
+  sloppyTest.apply(null, [2, 1]);
+  sloppyTest.apply(null, [6, 5, 4, 3, 2, 1]);
+  sloppyTest.apply(null, [3, 2, 1]);
+  O.sloppy.apply(O, []);
+  O.sloppy.apply(O, [2, 1]);
+  O.sloppy.apply(O, [6, 5, 4, 3, 2, 1]);
+  O.sloppy.apply(O, [3, 2, 1]);
+})();
+
+
+(function testRestParamssloppyModeCall() {
+  sloppyTest.call(null);
+  sloppyTest.call(null, 2, 1);
+  sloppyTest.call(null, 6, 5, 4, 3, 2, 1);
+  sloppyTest.call(null, 3, 2, 1);
+  O.sloppy.call(O);
+  O.sloppy.call(O, 2, 1);
+  O.sloppy.call(O, 6, 5, 4, 3, 2, 1);
+  O.sloppy.call(O, 3, 2, 1);
+})();
+
+
+(function testUnmappedArguments() {
+  // Normal functions make their arguments object unmapped, but arrow
+  // functions don't have an arguments object anyway.  Check that the
+  // right thing happens for arguments in arrow functions with rest
+  // parameters.
+  assertSame(arguments, ((...rest) => arguments)());
+})();
diff --git a/deps/v8/test/mjsunit/es6/arrow-rest-params.js b/deps/v8/test/mjsunit/es6/arrow-rest-params.js
new file mode 100644
index 0000000000..dc25584fe0
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/arrow-rest-params.js
@@ -0,0 +1,142 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testRestIndex() {
+  assertEquals(5, ((...args) => args.length)(1,2,3,4,5));
+  assertEquals(4, ((a, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(3, ((a, b, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(2, ((a, b, c, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(1, ((a, b, c, d, ...args) => args.length)(1,2,3,4,5));
+  assertEquals(0, ((a, b, c, d, e, ...args) => args.length)(1,2,3,4,5));
+})();
+
+// strictTest and sloppyTest should be called with descending natural
+// numbers, as in:
+//
+//   strictTest(6,5,4,3,2,1)
+//
+var strictTest = (() => {
+  "use strict";
+  return (a, b, ...c) => {
+    assertEquals(Array, c.constructor);
+    assertTrue(Array.isArray(c));
+
+    var expectedLength = (a === undefined) ? 0 : a - 2;
+    assertEquals(expectedLength, c.length);
+
+    for (var i = 2; i < a; ++i) {
+      assertEquals(c[i - 2], a - i);
+    }
+  };
+})();
+
+var sloppyTest = (a, b, ...c) => {
+  assertEquals(Array, c.constructor);
+  assertTrue(Array.isArray(c));
+
+  var expectedLength = (a === undefined) ? 0 : a - 2;
+  assertEquals(expectedLength, c.length);
+
+  for (var i = 2; i < a; ++i) {
+    assertEquals(c[i - 2], a - i);
+  }
+}
+
+
+var O = {
+  strict: strictTest,
+  sloppy: sloppyTest
+};
+
+(function testStrictRestParamArity() {
+  assertEquals(2, strictTest.length);
+  assertEquals(2, O.strict.length);
+})();
+
+
+(function testRestParamsStrictMode() {
+  strictTest();
+  strictTest(2, 1);
+  strictTest(6, 5, 4, 3, 2, 1);
+  strictTest(3, 2, 1);
+  O.strict();
+  O.strict(2, 1);
+  O.strict(6, 5, 4, 3, 2, 1);
+  O.strict(3, 2, 1);
+})();
+
+
+(function testRestParamsStrictModeApply() {
+  strictTest.apply(null, []);
+  strictTest.apply(null, [2, 1]);
+  strictTest.apply(null, [6, 5, 4, 3, 2, 1]);
+  strictTest.apply(null, [3, 2, 1]);
+  O.strict.apply(O, []);
+  O.strict.apply(O, [2, 1]);
+  O.strict.apply(O, [6, 5, 4, 3, 2, 1]);
+  O.strict.apply(O, [3, 2, 1]);
+})();
+
+
+(function testRestParamsStrictModeCall() {
+  strictTest.call(null);
+  strictTest.call(null, 2, 1);
+  strictTest.call(null, 6, 5, 4, 3, 2, 1);
+  strictTest.call(null, 3, 2, 1);
+  O.strict.call(O);
+  O.strict.call(O, 2, 1);
+  O.strict.call(O, 6, 5, 4, 3, 2, 1);
+  O.strict.call(O, 3, 2, 1);
+})();
+
+
+(function testsloppyRestParamArity() {
+  assertEquals(2, sloppyTest.length);
+  assertEquals(2, O.sloppy.length);
+})();
+
+
+(function testRestParamssloppyMode() {
+  sloppyTest();
+  sloppyTest(2, 1);
+  sloppyTest(6, 5, 4, 3, 2, 1);
+  sloppyTest(3, 2, 1);
+  O.sloppy();
+  O.sloppy(2, 1);
+  O.sloppy(6, 5, 4, 3, 2, 1);
+  O.sloppy(3, 2, 1);
+})();
+
+
+(function testRestParamssloppyModeApply() {
+  sloppyTest.apply(null, []);
+  sloppyTest.apply(null, [2, 1]);
+  sloppyTest.apply(null, [6, 5, 4, 3, 2, 1]);
+  sloppyTest.apply(null, [3, 2, 1]);
+  O.sloppy.apply(O, []);
+  O.sloppy.apply(O, [2, 1]);
+  O.sloppy.apply(O, [6, 5, 4, 3, 2, 1]);
+  O.sloppy.apply(O, [3, 2, 1]);
+})();
+
+
+(function testRestParamssloppyModeCall() {
+  sloppyTest.call(null);
+  sloppyTest.call(null, 2, 1);
+  sloppyTest.call(null, 6, 5, 4, 3, 2, 1);
+  sloppyTest.call(null, 3, 2, 1);
+  O.sloppy.call(O);
+  O.sloppy.call(O, 2, 1);
+  O.sloppy.call(O, 6, 5, 4, 3, 2, 1);
+  O.sloppy.call(O, 3, 2, 1);
+})();
+
+
+(function testUnmappedArguments() {
+  // Normal functions make their arguments object unmapped, but arrow
+  // functions don't have an arguments object anyway.  Check that the
+  // right thing happens for arguments in arrow functions with rest
+  // parameters.
+  assertSame(arguments, ((...rest) => arguments)());
+})();
diff --git a/deps/v8/test/mjsunit/es6/block-early-errors.js b/deps/v8/test/mjsunit/es6/block-early-errors.js
index bf24942bb1..4af6521f64 100644
--- a/deps/v8/test/mjsunit/es6/block-early-errors.js
+++ b/deps/v8/test/mjsunit/es6/block-early-errors.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --no-harmony-sloppy-let
+
 function CheckException(e) {
   var string = e.toString();
   assertInstanceof(e, SyntaxError);
diff --git a/deps/v8/test/mjsunit/es6/block-eval-var-over-legacy-const.js b/deps/v8/test/mjsunit/es6/block-eval-var-over-legacy-const.js
new file mode 100644
index 0000000000..be1687b5e9
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/block-eval-var-over-legacy-const.js
@@ -0,0 +1,86 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sloppy --harmony-sloppy-let --harmony-sloppy-function
+// Flags: --legacy-const
+
+// Legacy-const-let conflict in a function throws, even if the legacy const
+// is in an eval
+
+// Throws at the top level of a function
+assertThrows(function() {
+  let x = 1;
+  eval('const x = 2');
+}, TypeError);
+
+// If the eval is in its own block scope, throws
+assertThrows(function() {
+  let y = 1;
+  { eval('const y = 2'); }
+}, TypeError);
+
+// If the let is in its own block scope, with the eval, throws
+assertThrows(function() {
+  {
+    let x = 1;
+    eval('const x = 2');
+  }
+}, TypeError);
+
+// Legal if the let is no longer visible
+assertDoesNotThrow(function() {
+  {
+    let x = 1;
+  }
+  eval('const x = 2');
+});
+
+// In global scope
+let caught = false;
+try {
+  let z = 1;
+  eval('const z = 2');
+} catch (e) {
+  caught = true;
+}
+assertTrue(caught);
+
+// Let declarations beyond a function boundary don't conflict
+caught = false;
+try {
+  let a = 1;
+  (function() {
+    eval('const a');
+  })();
+} catch (e) {
+  caught = true;
+}
+assertFalse(caught);
+
+// legacy const across with doesn't conflict
+caught = false;
+try {
+  (function() {
+    with ({x: 1}) {
+      eval("const x = 2;");
+    }
+  })();
+} catch (e) {
+  caught = true;
+}
+assertFalse(caught);
+
+// legacy const can still conflict with let across a with
+caught = false;
+try {
+  (function() {
+    let x;
+    with ({x: 1}) {
+      eval("const x = 2;");
+    }
+  })();
+} catch (e) {
+  caught = true;
+}
+assertTrue(caught);
diff --git a/deps/v8/test/mjsunit/es6/block-let-contextual-sloppy.js b/deps/v8/test/mjsunit/es6/block-let-contextual-sloppy.js
new file mode 100644
index 0000000000..20ca10719b
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/block-let-contextual-sloppy.js
@@ -0,0 +1,67 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sloppy --harmony-sloppy-let --harmony-destructuring-bind
+// Flags: --legacy-const
+
+// let is usable as a variable with var or legacy const, not let or ES6 const
+
+(function (){
+  assertEquals(undefined, let);
+
+  var let;
+
+  let = 5;
+  assertEquals(5, let);
+
+  (function() { var let = 1; assertEquals(1, let); })();
+  assertEquals(5, let);
+})();
+
+assertThrows(function() { return let; }, ReferenceError);
+
+(function() {
+   var let, sum = 0;
+   for (let in [1, 2, 3, 4]) sum += Number(let);
+   assertEquals(6, sum);
+
+   (function() { for (var let of [4, 5]) sum += let; })();
+   assertEquals(15, sum);
+
+   (function() { for (var let in [6]) sum += Number([6][let]); })();
+   assertEquals(21, sum);
+
+   for (let = 7; let < 8; let++) sum += let;
+   assertEquals(28, sum);
+   assertEquals(8, let);
+
+   (function() { for (var let = 8; let < 9; let++) sum += let; })();
+   assertEquals(36, sum);
+   assertEquals(8, let);
+})();
+
+assertThrows(function() { return let; }, ReferenceError);
+
+(function () {
+  let obj = {};
+  var {let} = {let() { return obj; }};
+  let().x = 1;
+  assertEquals(1, obj.x);
+})();
+
+(function () {
+  let obj = {};
+  const [let] = [function() { return obj; }];
+  let().x = 1;
+  assertEquals(1, obj.x);
+})();
+
+(function() {
+  function let() {
+    return 1;
+  }
+  assertEquals(1, let());
+})()
+
+assertThrows('for (let of []) {}', SyntaxError);
diff --git a/deps/v8/test/mjsunit/es6/block-non-strict-errors.js b/deps/v8/test/mjsunit/es6/block-non-strict-errors.js
index 50d5f22cf1..db7f558905 100644
--- a/deps/v8/test/mjsunit/es6/block-non-strict-errors.js
+++ b/deps/v8/test/mjsunit/es6/block-non-strict-errors.js
@@ -2,6 +2,9 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --no-harmony-sloppy-let --no-harmony-sloppy-function
+// Flags: --no-harmony-sloppy
+
 function CheckError(source) {
   var exception = null;
   try {
diff --git a/deps/v8/test/mjsunit/es6/block-scope-class.js b/deps/v8/test/mjsunit/es6/block-scope-class.js
new file mode 100644
index 0000000000..351feaa90e
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/block-scope-class.js
@@ -0,0 +1,59 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test for conflicting variable bindings.
+
+// Flags: --harmony-sloppy --harmony-sloppy-function
+
+function AssertEqualsStrictAndSloppy(value, code) {
+  assertEquals(value, eval("(function() {" + code + "})()"));
+  assertEquals(value, eval("(function() { 'use strict'; " + code + "})()"));
+  assertEquals(value, eval("(function() { var x = 0; {" + code + "} })()"));
+  assertEquals(value, eval("(function() { 'use strict'; var x = 0; {"
+                           + code + "} })()"));
+}
+
+function AssertThrowsStrictAndSloppy(code, error) {
+  assertThrows("(function() {" + code + "})()", error);
+  assertThrows("(function() { 'use strict'; " + code + "})()", error);
+  assertThrows("(function() { var x = 0; { " + code + "} })()", error);
+  assertThrows("(function() { 'use strict'; var x = 0; {" + code + "} })()",
+               error);
+}
+
+(function TestClassTDZ() {
+  AssertEqualsStrictAndSloppy(
+      "x", "function f() { return x; }; class x { }; return f().name;");
+  AssertEqualsStrictAndSloppy
+      ("x", "class x { }; function f() { return x; }; return f().name;");
+  AssertEqualsStrictAndSloppy(
+      "x", "class x { }; var result = f().name; " +
+      "function f() { return x; }; return result;");
+  AssertThrowsStrictAndSloppy(
+      "function f() { return x; }; f(); class x { };", ReferenceError);
+  AssertThrowsStrictAndSloppy(
+      "f(); function f() { return x; }; class x { };", ReferenceError);
+  AssertThrowsStrictAndSloppy(
+      "f(); class x { }; function f() { return x; };", ReferenceError);
+  AssertThrowsStrictAndSloppy(
+      "var x = 1; { f(); class x { }; function f() { return x; }; }",
+      ReferenceError);
+  AssertThrowsStrictAndSloppy("x = 3; class x { };", ReferenceError)
+})();
+
+(function TestClassNameConflict() {
+  AssertThrowsStrictAndSloppy("class x { }; var x;", SyntaxError);
+  AssertThrowsStrictAndSloppy("var x; class x { };", SyntaxError);
+  AssertThrowsStrictAndSloppy("class x { }; function x() { };", SyntaxError);
+  AssertThrowsStrictAndSloppy("function x() { }; class x { };", SyntaxError);
+  AssertThrowsStrictAndSloppy("class x { }; for (var x = 0; false;) { };",
+                              SyntaxError);
+  AssertThrowsStrictAndSloppy("for (var x = 0; false;) { }; class x { };",
+                              SyntaxError);
+})();
+
+(function TestClassMutableBinding() {
+  AssertEqualsStrictAndSloppy(
+      "x3", "class x { }; var y = x.name; x = 3; return y + x;")
+})();
diff --git a/deps/v8/test/mjsunit/es6/built-in-accessor-names.js b/deps/v8/test/mjsunit/es6/built-in-accessor-names.js
index d902ae6700..c5f8cec3c0 100644
--- a/deps/v8/test/mjsunit/es6/built-in-accessor-names.js
+++ b/deps/v8/test/mjsunit/es6/built-in-accessor-names.js
@@ -23,25 +23,13 @@ assertGetterName('get size', Set.prototype, 'size');
 assertGetterName('get size', Map.prototype, 'size');
 
 
-let typedArrays = [
-  Uint8Array,
-  Int8Array,
-  Uint16Array,
-  Int16Array,
-  Uint32Array,
-  Int32Array,
-  Float32Array,
-  Float64Array,
-  Uint8ClampedArray
-];
-
-for (let f of typedArrays) {
-  assertGetterName('get buffer', f.prototype, 'buffer');
-  assertGetterName('get byteOffset', f.prototype, 'byteOffset');
-  assertGetterName('get byteLength', f.prototype, 'byteLength');
-  assertGetterName('get length', f.prototype, 'length');
-  assertGetterName('get [Symbol.toStringTag]', f.prototype, Symbol.toStringTag);
-}
+let TypedArray = Uint8Array.__proto__;
+
+assertGetterName('get buffer', TypedArray.prototype, 'buffer');
+assertGetterName('get byteOffset', TypedArray.prototype, 'byteOffset');
+assertGetterName('get byteLength', TypedArray.prototype, 'byteLength');
+assertGetterName('get length', TypedArray.prototype, 'length');
+assertGetterName('get [Symbol.toStringTag]', TypedArray.prototype, Symbol.toStringTag);
 
 
 assertGetterName('get buffer', DataView.prototype, 'buffer');
diff --git a/deps/v8/test/mjsunit/es6/classes-derived-return-type.js b/deps/v8/test/mjsunit/es6/classes-derived-return-type.js
new file mode 100644
index 0000000000..8283bcb227
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/classes-derived-return-type.js
@@ -0,0 +1,90 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-sloppy
+
+
+class Base {}
+
+class DerivedWithReturn extends Base {
+  constructor(x) {
+    super();
+    return x;
+  }
+}
+
+assertThrows(function() {
+  new DerivedWithReturn(null);
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturn(42);
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturn(true);
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturn('hi');
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturn(Symbol());
+}, TypeError);
+
+
+assertInstanceof(new DerivedWithReturn(undefined), DerivedWithReturn);
+function f() {}
+assertInstanceof(new DerivedWithReturn(new f()), f);
+assertInstanceof(new DerivedWithReturn(/re/), RegExp);
+
+
+class DerivedWithReturnNoSuper extends Base {
+  constructor(x) {
+    return x;
+  }
+}
+
+
+assertThrows(function() {
+  new DerivedWithReturnNoSuper(null);
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturnNoSuper(42);
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturnNoSuper(true);
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturnNoSuper('hi');
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturnNoSuper(Symbol());
+}, TypeError);
+assertThrows(function() {
+  new DerivedWithReturnNoSuper(undefined);
+}, ReferenceError);
+
+
+function f2() {}
+assertInstanceof(new DerivedWithReturnNoSuper(new f2()), f2);
+assertInstanceof(new DerivedWithReturnNoSuper(/re/), RegExp);
+
+
+class DerivedReturn extends Base {
+  constructor() {
+    super();
+    return;
+  }
+}
+
+assertInstanceof(new DerivedReturn(), DerivedReturn);
+
+
+
+class DerivedReturnThis extends Base {
+  constructor() {
+    super();
+    return this;
+  }
+}
+
+assertInstanceof(new DerivedReturnThis(), DerivedReturnThis);
diff --git a/deps/v8/test/mjsunit/es6/classes-proxy.js b/deps/v8/test/mjsunit/es6/classes-proxy.js
new file mode 100644
index 0000000000..09d12c28dc
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/classes-proxy.js
@@ -0,0 +1,73 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-proxies --harmony-reflect
+
+function CreateConstructableProxy(handler) {
+  return new Proxy(function(){}, handler);
+}
+
+(function() {
+  var prototype = { x: 1 };
+  var log = [];
+
+  var proxy = CreateConstructableProxy({
+    get(k) {
+      log.push("get trap");
+      return prototype;
+    }});
+
+  var o = Reflect.construct(Number, [100], proxy);
+  assertEquals(["get trap"], log);
+  assertTrue(Object.getPrototypeOf(o) === prototype);
+  assertEquals(100, Number.prototype.valueOf.call(o));
+})();
+
+(function() {
+  var prototype = { x: 1 };
+  var log = [];
+
+  var proxy = CreateConstructableProxy({
+    get(k) {
+      log.push("get trap");
+      return 10;
+    }});
+
+  var o = Reflect.construct(Number, [100], proxy);
+  assertEquals(["get trap"], log);
+  assertTrue(Object.getPrototypeOf(o) === Number.prototype);
+  assertEquals(100, Number.prototype.valueOf.call(o));
+})();
+
+(function() {
+  var prototype = { x: 1 };
+  var log = [];
+
+  var proxy = CreateConstructableProxy({
+    get(k) {
+      log.push("get trap");
+      return prototype;
+    }});
+
+  var o = Reflect.construct(Function, ["return 1000"], proxy);
+  assertEquals(["get trap"], log);
+  assertTrue(Object.getPrototypeOf(o) === prototype);
+  assertEquals(1000, o());
+})();
+
+(function() {
+  var prototype = { x: 1 };
+  var log = [];
+
+  var proxy = CreateConstructableProxy({
+    get(k) {
+      log.push("get trap");
+      return prototype;
+    }});
+
+  var o = Reflect.construct(Array, [1, 2, 3], proxy);
+  assertEquals(["get trap"], log);
+  assertTrue(Object.getPrototypeOf(o) === prototype);
+  assertEquals([1, 2, 3], o);
+})();
diff --git a/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js b/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js
index 74dd489cb8..313aad1d8f 100644
--- a/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js
+++ b/deps/v8/test/mjsunit/es6/classes-subclass-builtins.js
@@ -2,7 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --harmony-reflect --harmony-regexp-subclass
+// Flags: --expose-gc --strong-mode
 
 "use strict";
 
@@ -20,10 +21,11 @@ function checkPrototypeChain(object, constructors) {
 (function() {
   class A extends Object {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -34,6 +36,7 @@ function checkPrototypeChain(object, constructors) {
   checkPrototypeChain(s, [A, Object]);
   assertEquals(42, s.a);
   assertEquals(4.2, s.d);
+  assertEquals(153, s.o.foo);
 
   var s1 = new A("bar");
   assertTrue(%HaveSameMap(s, s1));
@@ -46,6 +49,7 @@ function checkPrototypeChain(object, constructors) {
   checkPrototypeChain(s, [A, Object]);
   assertEquals(42, n.a);
   assertEquals(4.2, n.d);
+  assertEquals(153, n.o.foo);
 
   var n1 = new A(312);
   assertTrue(%HaveSameMap(n, n1));
@@ -59,46 +63,99 @@ function checkPrototypeChain(object, constructors) {
   checkPrototypeChain(s, [A, Object]);
   assertEquals(42, b.a);
   assertEquals(4.2, b.d);
+  assertEquals(153, b.o.foo);
 
   var b1 = new A(true);
   assertTrue(%HaveSameMap(b, b1));
   assertTrue(%HaveSameMap(b, s));
+
+  gc();
 })();
 
 
 (function() {
   class A extends Function {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
+      // Strong functions are not extensible, so don't add fields.
+      if (args[args.length - 1].indexOf("use strong") >= 0) {
+        assertThrows(()=>{ this.a = 10; }, TypeError);
+        return;
+      }
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
+    }
+  }
+  var sloppy_func = new A("");
+  var strict_func = new A("'use strict';");
+  assertNull(sloppy_func.caller);
+  assertThrows("strict_f.caller");
+  assertNull(Object.getOwnPropertyDescriptor(sloppy_func, "caller").value);
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(strict_func, "caller"));
+
+  function CheckFunction(func, is_strong) {
+    assertEquals("function", typeof func);
+    assertTrue(func instanceof Object);
+    assertTrue(func instanceof Function);
+    assertTrue(func instanceof A);
+    checkPrototypeChain(func, [A, Function, Object]);
+    if (!is_strong) {
+      assertEquals(42, func.a);
+      assertEquals(4.2, func.d);
+      assertEquals(153, func.o.foo);
+      assertTrue(undefined !== func.prototype);
+      func.prototype.bar = "func.bar";
+      var obj = new func();
+      assertTrue(obj instanceof Object);
+      assertTrue(obj instanceof func);
+      assertEquals("object", typeof obj);
+      assertEquals(113, obj.foo);
+      assertEquals("func.bar", obj.bar);
+      delete func.prototype.bar;
     }
   }
 
-  var o = new A("this.foo = 153;");
-  assertTrue(o instanceof Object);
-  assertTrue(o instanceof Function);
-  assertTrue(o instanceof A);
-  assertEquals("function", typeof o);
-  checkPrototypeChain(o, [A, Function, Object]);
-  assertEquals(42, o.a);
-  assertEquals(4.2, o.d);
-  var oo = new o();
-  assertEquals(153, oo.foo);
+  var source = "this.foo = 113;";
 
-  var o1 = new A("return 312;");
-  assertTrue(%HaveSameMap(o, o1));
+  // Sloppy function
+  var sloppy_func = new A(source);
+  assertTrue(undefined !== sloppy_func.prototype);
+  CheckFunction(sloppy_func, false);
+
+  var sloppy_func1 = new A("return 312;");
+  assertTrue(%HaveSameMap(sloppy_func, sloppy_func1));
+
+  // Strict function
+  var strict_func = new A("'use strict'; " + source);
+  assertFalse(%HaveSameMap(strict_func, sloppy_func));
+  CheckFunction(strict_func, false);
+
+  var strict_func1 = new A("'use strict'; return 312;");
+  assertTrue(%HaveSameMap(strict_func, strict_func1));
+
+  // Strong function
+  var strong_func = new A("'use strong'; " + source);
+  assertFalse(%HaveSameMap(strong_func, sloppy_func));
+  assertFalse(%HaveSameMap(strong_func, strict_func));
+  CheckFunction(strong_func, true);
+
+  var strong_func1 = new A("'use strong'; return 312;");
+  assertTrue(%HaveSameMap(strong_func, strong_func1));
+
+  gc();
 })();
 
 
 (function() {
   class A extends Boolean {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -111,19 +168,23 @@ function checkPrototypeChain(object, constructors) {
   assertTrue(o.valueOf());
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A(false);
   assertTrue(%HaveSameMap(o, o1));
+
+  gc();
 })();
 
 
 function TestErrorSubclassing(error) {
   class A extends error {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -142,9 +203,12 @@ function TestErrorSubclassing(error) {
   assertEquals(error.name + ": message", o.toString());
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A("achtung!");
   assertTrue(%HaveSameMap(o, o1));
+
+  gc();
 }
 
 
@@ -162,10 +226,11 @@ function TestErrorSubclassing(error) {
 (function() {
   class A extends Number {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -178,19 +243,23 @@ function TestErrorSubclassing(error) {
   assertEquals(153, o.valueOf());
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A(312);
   assertTrue(%HaveSameMap(o, o1));
+
+  gc();
 })();
 
 
 (function() {
   class A extends Date {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -203,22 +272,26 @@ function TestErrorSubclassing(error) {
   assertEquals(1234567890, o.getTime());
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A(2015, 10, 29);
   assertEquals(2015, o1.getFullYear());
   assertEquals(10, o1.getMonth());
   assertEquals(29, o1.getDate());
   assertTrue(%HaveSameMap(o, o1));
+
+  gc();
 })();
 
 
 (function() {
   class A extends String {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -232,19 +305,23 @@ function TestErrorSubclassing(error) {
   assertEquals("foo", o.valueOf());
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A("bar");
   assertTrue(%HaveSameMap(o, o1));
+
+  gc();
 })();
 
 
 (function() {
   class A extends RegExp {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -263,38 +340,81 @@ function TestErrorSubclassing(error) {
   assertEquals(10, o.lastIndex);
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
+
+  var o1 = new A(7);
+  assertTrue(%HaveSameMap(o, o1));
+
+  gc();
+})();
+
+
+(function TestArraySubclassing() {
+  class A extends Array {
+    constructor(...args) {
+      assertFalse(new.target === undefined);
+      super(...args);
+      this.a = 42;
+      this.d = 4.2;
+      this.o = {foo:153};
+    }
+  }
+
+  var o = new Array(13);
+  assertTrue(o instanceof Object);
+  assertTrue(o instanceof Array);
+  assertEquals("object", typeof o);
+  checkPrototypeChain(o, [Array, Object]);
+  assertEquals(13, o.length);
+
+  var o = new A(10);
+  assertTrue(o instanceof Object);
+  assertTrue(o instanceof Array);
+  assertTrue(o instanceof A);
+  assertEquals("object", typeof o);
+  checkPrototypeChain(o, [A, Array, Object]);
+  assertEquals(10, o.length);
+  assertEquals(42, o.a);
+  assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A(7);
   assertTrue(%HaveSameMap(o, o1));
 })();
 
 
-function TestArraySubclassing(array) {
+var TypedArray = Uint8Array.__proto__;
+
+function TestTypedArraySubclassing(array) {
   class A extends array {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
   var o = new array(13);
   assertTrue(o instanceof Object);
+  assertTrue(o instanceof TypedArray);
   assertTrue(o instanceof array);
   assertEquals("object", typeof o);
-  checkPrototypeChain(o, [array, Object]);
+  checkPrototypeChain(o, [array, TypedArray, Object]);
   assertEquals(13, o.length);
 
   var o = new A(10);
   assertTrue(o instanceof Object);
+  assertTrue(o instanceof TypedArray);
   assertTrue(o instanceof array);
   assertTrue(o instanceof A);
   assertEquals("object", typeof o);
-  checkPrototypeChain(o, [A, array, Object]);
+  checkPrototypeChain(o, [A, array, TypedArray, Object]);
   assertEquals(10, o.length);
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A(7);
   assertTrue(%HaveSameMap(o, o1));
@@ -302,16 +422,15 @@ function TestArraySubclassing(array) {
 
 
 (function() {
-  TestArraySubclassing(Array);
-  TestArraySubclassing(Int8Array);
-  TestArraySubclassing(Uint8Array);
-  TestArraySubclassing(Uint8ClampedArray);
-  TestArraySubclassing(Int16Array);
-  TestArraySubclassing(Uint16Array);
-  TestArraySubclassing(Int32Array);
-  TestArraySubclassing(Uint32Array);
-  TestArraySubclassing(Float32Array);
-  TestArraySubclassing(Float64Array);
+  TestTypedArraySubclassing(Int8Array);
+  TestTypedArraySubclassing(Uint8Array);
+  TestTypedArraySubclassing(Uint8ClampedArray);
+  TestTypedArraySubclassing(Int16Array);
+  TestTypedArraySubclassing(Uint16Array);
+  TestTypedArraySubclassing(Int32Array);
+  TestTypedArraySubclassing(Uint32Array);
+  TestTypedArraySubclassing(Float32Array);
+  TestTypedArraySubclassing(Float64Array);
 })();
 
 
@@ -320,10 +439,11 @@ function TestMapSetSubclassing(container, is_map) {
 
   class A extends container {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -358,9 +478,12 @@ function TestMapSetSubclassing(container, is_map) {
   }
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A();
   assertTrue(%HaveSameMap(o, o1));
+
+  gc();
 }
 
 
@@ -375,10 +498,11 @@ function TestMapSetSubclassing(container, is_map) {
 (function() {
   class A extends ArrayBuffer {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -392,6 +516,7 @@ function TestMapSetSubclassing(container, is_map) {
   assertEquals(16, o.byteLength);
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A("bar");
   assertTrue(%HaveSameMap(o, o1));
@@ -423,16 +548,19 @@ function TestMapSetSubclassing(container, is_map) {
   assertEquals(-1, int32view[1]);
   assertEquals(0xfffffffe, uint32view[0]);
   assertEquals(0xffffffff, uint32view[1]);
+
+  gc();
 })();
 
 
 (function() {
   class A extends DataView {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
     }
   }
 
@@ -449,55 +577,145 @@ function TestMapSetSubclassing(container, is_map) {
   assertEquals(0xbebafeca, o.getUint32(0, true));
   assertEquals(42, o.a);
   assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
 
   var o1 = new A(buffer);
   assertTrue(%HaveSameMap(o, o1));
 
+  gc();
 })();
 
 
 (function() {
-  // TODO(ishell): remove once GeneratorFunction is available.
-  var GeneratorFunction = (function*() {}).__proto__.constructor;
+  var GeneratorFunction = (function*() {}).constructor;
   class A extends GeneratorFunction {
     constructor(...args) {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(...args);
+      // Strong functions are not extensible, so don't add fields.
+      if (args[args.length - 1].indexOf("use strong") >= 0) {
+        assertThrows(()=>{ this.a = 10; }, TypeError);
+        return;
+      }
       this.a = 42;
       this.d = 4.2;
+      this.o = {foo:153};
+    }
+  }
+  var sloppy_func = new A("yield 153;");
+  var strict_func = new A("'use strict'; yield 153;");
+  // Unfortunately the difference is not observable from outside.
+  assertThrows("sloppy_func.caller");
+  assertThrows("strict_f.caller");
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(sloppy_func, "caller"));
+  assertEquals(undefined, Object.getOwnPropertyDescriptor(strict_func, "caller"));
+
+  function CheckFunction(func, is_strong) {
+    assertEquals("function", typeof func);
+    assertTrue(func instanceof Object);
+    assertTrue(func instanceof Function);
+    assertTrue(func instanceof GeneratorFunction);
+    assertTrue(func instanceof A);
+    checkPrototypeChain(func, [A, GeneratorFunction, Function, Object]);
+    if (!is_strong) {
+      assertEquals(42, func.a);
+      assertEquals(4.2, func.d);
+      assertEquals(153, func.o.foo);
+
+      assertTrue(undefined !== func.prototype);
+      func.prototype.bar = "func.bar";
+      var obj = func();  // Generator object.
+      assertTrue(obj instanceof Object);
+      assertTrue(obj instanceof func);
+      assertEquals("object", typeof obj);
+      assertEquals("func.bar", obj.bar);
+      delete func.prototype.bar;
+
+      assertPropertiesEqual({done: false, value: 1}, obj.next());
+      assertPropertiesEqual({done: false, value: 1}, obj.next());
+      assertPropertiesEqual({done: false, value: 2}, obj.next());
+      assertPropertiesEqual({done: false, value: 3}, obj.next());
+      assertPropertiesEqual({done: false, value: 5}, obj.next());
+      assertPropertiesEqual({done: false, value: 8}, obj.next());
+      assertPropertiesEqual({done: true, value: undefined}, obj.next());
     }
   }
-  var generator_func = new A("var index = 0; while (index < 5) { yield ++index; }");
-  assertTrue(generator_func instanceof Object);
-  assertTrue(generator_func instanceof Function);
-  assertTrue(generator_func instanceof GeneratorFunction);
-  assertTrue(generator_func instanceof A);
-  assertEquals("function", typeof generator_func);
-  checkPrototypeChain(generator_func, [A, GeneratorFunction, Function, Object]);
-  assertEquals(42, generator_func.a);
-  assertEquals(4.2, generator_func.d);
-
-  var o = new generator_func();
+
+  var source = "yield 1; yield 1; yield 2; yield 3; yield 5; yield 8;";
+
+  // Sloppy generator function
+  var sloppy_func = new A(source);
+  assertTrue(undefined !== sloppy_func.prototype);
+  CheckFunction(sloppy_func, false);
+
+  var sloppy_func1 = new A("yield 312;");
+  assertTrue(%HaveSameMap(sloppy_func, sloppy_func1));
+
+  // Strict generator function
+  var strict_func = new A("'use strict'; " + source);
+  assertFalse(%HaveSameMap(strict_func, sloppy_func));
+  CheckFunction(strict_func, false);
+
+  var strict_func1 = new A("'use strict'; yield 312;");
+  assertTrue(%HaveSameMap(strict_func, strict_func1));
+
+  // Strong generator function
+  var strong_func = new A("'use strong'; " + source);
+  assertFalse(%HaveSameMap(strong_func, sloppy_func));
+  assertFalse(%HaveSameMap(strong_func, strict_func));
+  CheckFunction(strong_func, true);
+
+  var strong_func1 = new A("'use strong'; yield 312;");
+  assertTrue(%HaveSameMap(strong_func, strong_func1));
+
+  gc();
+})();
+
+
+(function() {
+  class A extends Promise {
+    constructor(...args) {
+      assertFalse(new.target === undefined);
+      super(...args);
+      this.a = 42;
+      this.d = 4.2;
+      this.o = {foo:153};
+    }
+  }
+
+  var o = new A(function(resolve, reject) {
+    resolve("ok");
+  });
   assertTrue(o instanceof Object);
-  assertTrue(o instanceof generator_func);
+  assertTrue(o instanceof Promise);
+  assertTrue(o instanceof A);
   assertEquals("object", typeof o);
+  checkPrototypeChain(o, [A, Promise, Object]);
+  assertEquals(42, o.a);
+  assertEquals(4.2, o.d);
+  assertEquals(153, o.o.foo);
+  o.then(
+      function(val) { assertEquals("ok", val); },
+      function(reason) { assertUnreachable(); })
+    .catch(function(reason) { %AbortJS("catch handler called: " + reason); });
+
+  var o1 = new A(function(resolve, reject) {
+    reject("fail");
+  });
+  o1.then(
+      function(val) { assertUnreachable(); },
+      function(reason) { assertEquals("fail", reason); })
+    .catch(function(reason) { %AbortJS("catch handler called: " + reason); });
+  assertTrue(%HaveSameMap(o, o1));
 
-  assertPropertiesEqual({done: false, value: 1}, o.next());
-  assertPropertiesEqual({done: false, value: 2}, o.next());
-  assertPropertiesEqual({done: false, value: 3}, o.next());
-  assertPropertiesEqual({done: false, value: 4}, o.next());
-  assertPropertiesEqual({done: false, value: 5}, o.next());
-  assertPropertiesEqual({done: true, value: undefined}, o.next());
-
-  var generator_func1 = new A("return 0;");
-  assertTrue(%HaveSameMap(generator_func, generator_func1));
+  gc();
 })();
 
 
 (function() {
   class A extends Boolean {
     constructor() {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super(true);
       this.a00 = 0
       this.a01 = 0
@@ -524,7 +742,7 @@ function TestMapSetSubclassing(container, is_map) {
 
   class B extends A {
     constructor() {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super();
       this.b00 = 0
       this.b01 = 0
@@ -551,7 +769,7 @@ function TestMapSetSubclassing(container, is_map) {
 
   class C extends B {
     constructor() {
-      assertTrue(%IsConstructCall());
+      assertFalse(new.target === undefined);
       super();
       this.c00 = 0
       this.c01 = 0
@@ -584,6 +802,8 @@ function TestMapSetSubclassing(container, is_map) {
   assertTrue(o instanceof C);
   assertEquals("object", typeof o);
   checkPrototypeChain(o, [C, B, A, Boolean, Object]);
+
+  gc();
 })();
 
 
@@ -604,3 +824,133 @@ function TestMapSetSubclassing(container, is_map) {
   class A extends Symbol {}
   assertThrows("new A");
 })();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var o = Reflect.construct(
+        Number, [{valueOf() { f.prototype=p2; return 10; }}], f);
+
+  assertTrue(o.__proto__ === f.prototype);
+  assertTrue(p2 === f.prototype);
+  assertFalse(p === o.__proto__);
+  assertEquals(10, Number.prototype.valueOf.call(o));
+})();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var o = Reflect.construct(
+        String, [{toString() { f.prototype=p2; return "biep"; }}], f);
+
+  assertTrue(o.__proto__ === f.prototype);
+  assertTrue(p2 === o.__proto__);
+  assertFalse(p === o.__proto__);
+  assertEquals("biep", String.prototype.toString.call(o));
+})();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var o = Reflect.construct(
+        Date, [{valueOf() { f.prototype=p2; return 1447836899614; }}], f);
+
+  assertTrue(o.__proto__ === f.prototype);
+  assertTrue(p2 === f.prototype);
+  assertFalse(p === o.__proto__);
+  assertEquals(new Date(1447836899614).toString(),
+               Date.prototype.toString.call(o));
+})();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var o = Reflect.construct(
+        Date, [2015, {valueOf() { f.prototype=p2; return 10; }}], f);
+
+  assertTrue(o.__proto__ === f.prototype);
+  assertTrue(p2 === f.prototype);
+  assertFalse(p === o.__proto__);
+  assertEquals(new Date(2015, 10).getYear(), Date.prototype.getYear.call(o));
+  assertEquals(new Date(2015, 10).getMonth(), Date.prototype.getMonth.call(o));
+})();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var o = Reflect.construct(
+        DataView, [new ArrayBuffer(100),
+                   {valueOf(){ f.prototype=p2; return 5; }}], f);
+
+  var byteOffset = Object.getOwnPropertyDescriptor(
+      DataView.prototype, "byteOffset").get;
+  var byteLength = Object.getOwnPropertyDescriptor(
+      DataView.prototype, "byteLength").get;
+
+  assertTrue(o.__proto__ === f.prototype);
+  assertTrue(p2 === f.prototype);
+  assertFalse(p === o.__proto__);
+  assertEquals(5, byteOffset.call(o));
+  assertEquals(95, byteLength.call(o));
+})();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var o = Reflect.construct(
+        DataView, [new ArrayBuffer(100),
+                   30, {valueOf() { f.prototype=p2; return 5; }}], f);
+
+  var byteOffset = Object.getOwnPropertyDescriptor(
+      DataView.prototype, "byteOffset").get;
+  var byteLength = Object.getOwnPropertyDescriptor(
+      DataView.prototype, "byteLength").get;
+
+  assertTrue(o.__proto__ === f.prototype);
+  assertTrue(p2 === f.prototype);
+  assertFalse(p === o.__proto__);
+  assertEquals(30, byteOffset.call(o));
+  assertEquals(5, byteLength.call(o));
+})();
+
+
+(function() {
+  function f() {}
+
+  var p = f.prototype;
+  var p2 = {};
+  var p3 = {};
+
+  var log = [];
+
+  var pattern = {toString() {
+    log.push("tostring");
+    f.prototype = p3; return "biep" }};
+
+  Object.defineProperty(pattern, Symbol.match, {
+    get() { log.push("match"); f.prototype = p2; return false; }});
+
+  var o = Reflect.construct(RegExp, [pattern], f);
+  assertEquals(["match", "tostring"], log);
+  assertEquals(/biep/, o);
+  assertTrue(o.__proto__ === p2);
+  assertTrue(f.prototype === p3);
+})();
diff --git a/deps/v8/test/mjsunit/es6/classof-proxy.js b/deps/v8/test/mjsunit/es6/classof-proxy.js
new file mode 100644
index 0000000000..c3bc985bb9
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/classof-proxy.js
@@ -0,0 +1,27 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-proxies
+
+function test_function(o) {
+  if (%_ClassOf(o) === "Function") {
+    return true;
+  } else {
+    return false;
+  }
+}
+
+var non_callable = new Proxy({}, {});
+var callable = new Proxy(function(){}.__proto__, {});
+var constructable = new Proxy(function(){}, {});
+
+assertFalse(test_function(non_callable));
+assertTrue(test_function(callable));
+assertTrue(test_function(constructable));
+
+%OptimizeFunctionOnNextCall(test_function);
+
+assertFalse(test_function(non_callable));
+assertTrue(test_function(callable));
+assertTrue(test_function(constructable));
diff --git a/deps/v8/test/mjsunit/es6/debug-blockscopes.js b/deps/v8/test/mjsunit/es6/debug-blockscopes.js
index 3f890ebd54..d3c36207f1 100644
--- a/deps/v8/test/mjsunit/es6/debug-blockscopes.js
+++ b/deps/v8/test/mjsunit/es6/debug-blockscopes.js
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 // Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --debug-eval-readonly-locals
 // The functions used for testing backtraces. They are at the top to make the
 // testing of source line/column easier.
 
@@ -525,15 +526,12 @@ function shadowing_1() {
   {
     let i = 5;
     debugger;
-    assertEqualsUnlessOptimized(27, i, shadowing_1);
   }
   assertEquals(0, i);
-  debugger;
-  assertEqualsUnlessOptimized(27, i, shadowing_1);
 }
 
 listener_delegate = function (exec_state) {
-  exec_state.frame(0).evaluate("i = 27");
+  assertEqualsUnlessOptimized(5, exec_state.frame(0).evaluate("i").value());
 }
 shadowing_1();
 EndTest();
@@ -546,13 +544,12 @@ function shadowing_2() {
   {
     let j = 5;
     debugger;
-    assertEqualsUnlessOptimized(27, j, shadowing_2);
   }
-  assertEqualsUnlessOptimized(0, i, shadowing_2);
 }
 
 listener_delegate = function (exec_state) {
-  exec_state.frame(0).evaluate("j = 27");
+  assertEqualsUnlessOptimized(0, exec_state.frame(0).evaluate("i").value());
+  assertEqualsUnlessOptimized(5, exec_state.frame(0).evaluate("j").value());
 }
 shadowing_2();
 EndTest();
diff --git a/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js b/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js
index a06c3b52de..fc8bebd13d 100644
--- a/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js
+++ b/deps/v8/test/mjsunit/es6/debug-break-default-constructor.js
@@ -14,7 +14,7 @@ var step_count = 0;
 function listener(event, execState, eventData, data) {
   if (event != Debug.DebugEvent.Break) return;
   try {
-    execState.prepareStep(Debug.StepAction.StepInto);
+    execState.prepareStep(Debug.StepAction.StepIn);
     var s = execState.frame().sourceLineText();
     step_count++;
     assertTrue(s.indexOf('// ' + step_count + '.') >= 0);
diff --git a/deps/v8/test/mjsunit/es6/debug-evaluate-arrow-function-receiver.js b/deps/v8/test/mjsunit/es6/debug-evaluate-arrow-function-receiver.js
new file mode 100644
index 0000000000..ce7201df9c
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/debug-evaluate-arrow-function-receiver.js
@@ -0,0 +1,116 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+// Test that debug-evaluate can find the correct this value for an arrow
+// function, if "this" is referenced within the arrow function scope.
+
+Debug = debug.Debug
+
+var break_count = 0;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    for (var i = 0; i < exec_state.frameCount() - 1; i++) {
+      var frame = exec_state.frame(i);
+      var this_value = frame.evaluate("this").value();
+      var expected = frame.sourceLineText().match(/\/\/ (.*$)/)[1];
+      print(expected, this_value, frame.sourceLineText());
+      assertEquals(String(expected), String(this_value));
+    }
+    break_count++;
+  } catch (e) {
+    exception = e;
+    print(e + e.stack);
+  }
+}
+
+// Context-allocated receiver.
+function f() {
+  debugger;                          // foo
+  return () => {
+    debugger;                        // foo
+    with ({}) {
+      return () => {
+        debugger;                    // foo
+        try {
+          throw new Error();
+        } catch (e) {
+          return () => {
+            (() => this);            // bind this.
+            debugger;                // foo
+            return () => {
+              debugger;              // undefined
+              return g.call("goo");  // undefined
+            }
+          };
+        }
+      };
+    }
+  };
+}
+
+// Stack-allocated receiver.
+function g() {
+  debugger;                        // goo
+  return () => {
+    debugger;                      // undefined
+    with ({}) {
+      return () => {
+        debugger;                  // undefined
+        try {
+          throw new Error();
+        } catch (e) {
+          return () => {
+            debugger;              // undefined
+            return f.call("foo");  // undefined
+          };
+        }
+      };
+    }
+  };
+}
+
+Debug.setListener(listener);
+
+var h = f.call("foo");
+for (var i = 0; i < 20; i++) h = h();
+var h = g.call("goo");
+for (var i = 0; i < 20; i++) h = h();
+
+function x() {
+  (() => this);      // bind this.
+  function y() {
+    (() => {
+      (() => this);  // bind this.
+      debugger;      // Y
+     })();           // Y
+  }
+  y.call("Y");       // X
+}
+x.call("X");
+
+function u() {
+  (() => this);
+  function v() {
+    (() => {
+      debugger;      // undefined
+     })();           // V
+  }
+  v.call("V");       // U
+}
+u.call("U");
+
+(() => {
+  (() => this);
+  debugger;          // [object global]
+})();
+
+Debug.setListener(null);
+
+assertEquals(55, break_count);
+assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-1.js b/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-1.js
new file mode 100644
index 0000000000..043c5f10f7
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-1.js
@@ -0,0 +1,75 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-reflect --expose-debug-as debug --allow-natives-syntax
+
+// Test that live-editing a frame that uses new.target fails.
+
+Debug = debug.Debug
+var calls = 0;
+var exceptions = 0;
+var results = [];
+var replace_again;
+
+eval(`
+  function LogNewTarget() {
+    calls++;
+    ReplaceOnce();
+    results.push(true);
+    results.push(new.target);
+  }
+`);
+
+function Dummy() {}
+
+function Replace(fun, original, patch) {
+  %ExecuteInDebugContext(function() {
+    var change_log = [];
+    try {
+      var script = Debug.findScript(fun);
+      var patch_pos = script.source.indexOf(original);
+      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
+          script, patch_pos, original.length, patch, change_log);
+    } catch (e) {
+      assertEquals("BLOCKED_NO_NEW_TARGET_ON_RESTART",
+          change_log[0].functions_on_stack[0].replace_problem);
+      assertInstanceof(e, Debug.LiveEdit.Failure);
+      exceptions++;
+    }
+  });
+}
+
+function ReplaceOnce() {
+  if (replace_again) {
+    replace_again = false;
+    Replace(LogNewTarget, "true", "false");
+  }
+}
+
+function Revert() {
+  Replace(LogNewTarget, "false", "true");
+}
+
+replace_again = true;
+ReplaceOnce();
+new LogNewTarget();
+Revert();
+assertEquals(1, calls);
+assertEquals(0, exceptions);
+assertEquals([false, LogNewTarget], results);
+
+replace_again = true;
+LogNewTarget();
+
+replace_again = true;
+new LogNewTarget();
+
+replace_again = true;
+Reflect.construct(LogNewTarget, [], Dummy);
+
+assertEquals(
+    [false, LogNewTarget, true, undefined, true, LogNewTarget, true, Dummy],
+    results);
+assertEquals(4, calls);  // No restarts
+assertEquals(3, exceptions);  // Replace failed.
diff --git a/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-2.js b/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-2.js
new file mode 100644
index 0000000000..8c6dc7e7e1
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-2.js
@@ -0,0 +1,63 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+
+// Test that live-editing a frame to introduce new.target fails.
+
+Debug = debug.Debug
+var calls = 0;
+var exceptions = 0;
+var results = [];
+var replace_again;
+
+eval(`
+  function LogNewTarget() {
+    calls++;
+    ReplaceOnce();
+    results.push(true);
+  }
+`);
+
+function Replace(fun, original, patch) {
+  %ExecuteInDebugContext(function() {
+    var change_log = [];
+    try {
+      var script = Debug.findScript(fun);
+      var patch_pos = script.source.indexOf(original);
+      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
+          script, patch_pos, original.length, patch, change_log);
+    } catch (e) {
+      assertEquals("BLOCKED_NO_NEW_TARGET_ON_RESTART",
+                   change_log[0].functions_on_stack[0].replace_problem);
+      assertInstanceof(e, Debug.LiveEdit.Failure);
+      exceptions++;
+    }
+  });
+}
+
+function ReplaceOnce(x) {
+  if (replace_again) {
+    replace_again = false;
+    Replace(LogNewTarget, "true", "new.target");
+  }
+}
+
+function Revert() {
+  Replace(LogNewTarget, "new.target", "true");
+}
+
+replace_again = true;
+ReplaceOnce();
+new LogNewTarget();
+Revert();
+assertEquals(1, calls);
+assertEquals(0, exceptions);
+assertEquals([LogNewTarget], results);
+
+replace_again = true;
+new LogNewTarget();
+assertEquals(2, calls);  // No restarts
+assertEquals(1, exceptions);  // Replace failed.
+assertEquals([LogNewTarget, true], results);
diff --git a/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-3.js b/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-3.js
new file mode 100644
index 0000000000..40facd3167
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/debug-liveedit-new-target-3.js
@@ -0,0 +1,73 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+
+// Test that live-editing a frame above one that uses new.target succeeds.
+
+Debug = debug.Debug
+var wrapper_calls = 0;
+var construct_calls = 0;
+var exceptions = 0;
+var results = [];
+var replace_again;
+
+eval(`
+  function LogNewTarget(arg) {
+    construct_calls++;
+    results.push(new.target);
+  }
+  function Wrapper() {
+    wrapper_calls++;
+    ReplaceOnce();
+    new LogNewTarget(true);
+  }
+`);
+
+function Replace(fun, original, patch) {
+  %ExecuteInDebugContext(function() {
+    var change_log = [];
+    try {
+      var script = Debug.findScript(fun);
+      var patch_pos = script.source.indexOf(original);
+      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(
+          script, patch_pos, original.length, patch, change_log);
+    } catch (e) {
+      exceptions++;
+    }
+  });
+}
+
+function ReplaceOnce(x) {
+  if (replace_again) {
+    replace_again = false;
+    Replace(Wrapper, "true", "false");
+  }
+}
+
+function Revert() {
+  Replace(Wrapper, "false", "true");
+}
+
+replace_again = true;
+ReplaceOnce();
+Wrapper();
+Revert();
+assertEquals(1, construct_calls);
+assertEquals(1, wrapper_calls);
+assertEquals(0, exceptions);  // Replace succeeds
+assertEquals([LogNewTarget], results);
+
+Wrapper();
+assertEquals(2, construct_calls);
+assertEquals(2, wrapper_calls);
+assertEquals(0, exceptions);  // Replace succeeds
+assertEquals([LogNewTarget, LogNewTarget], results);
+
+replace_again = true;
+Wrapper();
+assertEquals(3, construct_calls);
+assertEquals(4, wrapper_calls);  // Restarts
+assertEquals(0, exceptions);  // Replace succeeds
+assertEquals([LogNewTarget, LogNewTarget, LogNewTarget], results);
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reentry.js b/deps/v8/test/mjsunit/es6/debug-promises/reentry.js
index fbe54242dd..a97ce81012 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reentry.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reentry.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug
+// Flags: --expose-debug-as debug --promise-extra
 
 // Test reentry of special try catch for Promises.
 
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js
index a0036cfd0f..ed4b2c435e 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-after-resolve.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we listen to uncaught exceptions and
 // the Promise is rejected in a chained closure after it has been resolved.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-all.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-all.js
index fd4770ebee..e1a653889d 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-all.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-all.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we listen to all exceptions and
 // there is a catch handler for the to-be-rejected Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js
index 2ff13d5605..922449261b 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-late.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we only listen to uncaught exceptions, the Promise
 // is rejected, and a catch handler is installed right before the rejection.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js
index d3fd9f3ae7..afb46fea8f 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-caught-uncaught.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we only listen to uncaught exceptions and
 // there is a catch handler for the to-be-rejected Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-all.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-all.js
index 0b0c0c8e38..63e3b8678d 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-all.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-all.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we listen to all exceptions and
 // there is a catch handler for the to-be-rejected Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-uncaught.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-uncaught.js
index ac23b48b6f..b542bc69dd 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-uncaught.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-uncaught-uncaught.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we only listen to uncaught exceptions and
 // there is no catch handler for the to-be-rejected Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-with-invalid-reject.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-with-invalid-reject.js
index fa263458c4..8775df687d 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-with-invalid-reject.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-with-invalid-reject.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when a Promise is rejected, which is caught by a custom
 // promise, which has a number for reject closure.  We expect an Exception debug
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-with-throw-in-reject.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-with-throw-in-reject.js
index 6b7dc1a77c..b6c06df49e 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-with-throw-in-reject.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-with-throw-in-reject.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when a Promise is rejected, which is caught by a
 // custom promise, which throws a new exception in its reject handler.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/reject-with-undefined-reject.js b/deps/v8/test/mjsunit/es6/debug-promises/reject-with-undefined-reject.js
index 4c57cf0237..d058d41b96 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/reject-with-undefined-reject.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/reject-with-undefined-reject.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when a Promise is rejected, which is caught by a custom
 // promise, which has undefined for reject closure.  We expect an Exception
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js b/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js
index 4f3891b187..906969e105 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/stepin-constructor.js
@@ -12,7 +12,7 @@ function listener(event, exec_state, event_data, data) {
   if (event != Debug.DebugEvent.Break) return;
   try {
     breaks.push(exec_state.frame(0).sourceLineText().trimLeft());
-    exec_state.prepareStep(Debug.StepAction.StepIn, 1);
+    exec_state.prepareStep(Debug.StepAction.StepIn);
   } catch (e) {
     exception = e;
   }
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js b/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js
index 8548a2badd..8083c17103 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/stepin-handler.js
@@ -27,7 +27,7 @@ function listener(event, exec_state, event_data, data) {
                  "Expected: // Break " + break_count + ".");
       ++break_count;
       if (break_count !== expected_breaks) {
-        exec_state.prepareStep(Debug.StepAction.StepIn, 1);
+        exec_state.prepareStep(Debug.StepAction.StepIn);
       }
     }
   } catch(e) {
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-all.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-all.js
index bd6d343f82..3b7c48c1cf 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-all.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-all.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we listen to all exceptions and
 // there is a catch handler for the exception thrown in a Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js
index ac79aba769..aa7e584320 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-late.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we only listen to uncaught exceptions, the Promise
 // throws, and a catch handler is installed right before throwing.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js
index 0ad9ce48a2..a424ccc9f7 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-caught-uncaught.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we only listen to uncaught exceptions and
 // there is a catch handler for the exception thrown in a Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-all.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-all.js
index c4bc6c44e3..bfe0bedbac 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-all.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-all.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we listen to all exceptions and
 // there is no catch handler for the exception thrown in a Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-uncaught.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-uncaught.js
index ba82a1f8cb..8dff592f33 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-uncaught.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-uncaught-uncaught.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when we only listen to uncaught exceptions and
 // there is a catch handler for the exception thrown in a Promise.
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-with-throw-in-reject.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-with-throw-in-reject.js
index bd39a155cc..349d014701 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-with-throw-in-reject.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-with-throw-in-reject.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when an exception is thrown inside a Promise, which is
 // caught by a custom promise, which throws a new exception in its reject
diff --git a/deps/v8/test/mjsunit/es6/debug-promises/throw-with-undefined-reject.js b/deps/v8/test/mjsunit/es6/debug-promises/throw-with-undefined-reject.js
index c88feb9c39..69ee01ee41 100644
--- a/deps/v8/test/mjsunit/es6/debug-promises/throw-with-undefined-reject.js
+++ b/deps/v8/test/mjsunit/es6/debug-promises/throw-with-undefined-reject.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --expose-debug-as debug --allow-natives-syntax --promise-extra
 
 // Test debug events when an exception is thrown inside a Promise, which is
 // caught by a custom promise, which has no reject handler.
@@ -48,7 +48,7 @@ function listener(event, exec_state, event_data, data) {
       } else if (expected_events == 0) {
         // All of the frames on the stack are from native Javascript.
         assertEquals(0, exec_state.frameCount());
-        assertEquals("undefined is not a function",
+        assertEquals("(var).reject is not a function",
                      event_data.exception().message);
       } else {
         assertUnreachable();
diff --git a/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js b/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js
index c368414ffc..6c887ab08d 100644
--- a/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js
+++ b/deps/v8/test/mjsunit/es6/debug-step-into-class-extends.js
@@ -14,7 +14,7 @@ var stepCount = 0;
 function listener(event, execState, eventData, data) {
   if (event == Debug.DebugEvent.Break) {
     if (!done) {
-      execState.prepareStep(Debug.StepAction.StepInto);
+      execState.prepareStep(Debug.StepAction.StepIn);
       var s = execState.frame().sourceLineText();
       assertTrue(s.indexOf('// ' + stepCount + '.') !== -1);
       stepCount++;
diff --git a/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js b/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js
index 1e903256fd..96cdc93159 100644
--- a/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js
+++ b/deps/v8/test/mjsunit/es6/debug-step-into-constructor.js
@@ -12,7 +12,7 @@ var done, stepCount;
 function listener(event, execState, eventData, data) {
   if (event == Debug.DebugEvent.Break) {
     if (!done) {
-      execState.prepareStep(Debug.StepAction.StepInto);
+      execState.prepareStep(Debug.StepAction.StepIn);
       var s = execState.frame().sourceLineText();
       assertTrue(s.indexOf('// ' + stepCount + '.') !== -1);
       stepCount++;
diff --git a/deps/v8/test/mjsunit/es6/debug-step-into-regexp-subclass.js b/deps/v8/test/mjsunit/es6/debug-step-into-regexp-subclass.js
new file mode 100644
index 0000000000..599fe05715
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/debug-step-into-regexp-subclass.js
@@ -0,0 +1,36 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug --harmony-regexp-subclass
+
+Debug = debug.Debug
+
+var exception = null;
+var break_count = 0;
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    print(event_data.sourceLineText());
+    assertTrue(
+        event_data.sourceLineText().indexOf(`Break ${break_count++}.`) > 0);
+    exec_state.prepareStep(Debug.StepAction.StepIn);
+  } catch (e) {
+    exception = e;
+  }
+};
+
+function customSplit() {
+  return "x";              // Break 2.
+}                          // Break 3.
+var o = {};
+o[Symbol.split] = customSplit;
+
+Debug.setListener(listener);
+debugger;                  // Break 0.
+var result = "".split(o);  // Break 1.
+Debug.setListener(null);   // Break 4.
+
+assertEquals("x", result);
+assertNull(exception);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js b/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js
index 08938f7751..5551843cb2 100644
--- a/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js
+++ b/deps/v8/test/mjsunit/es6/debug-stepin-collections-foreach.js
@@ -6,113 +6,95 @@
 
 Debug = debug.Debug
 
-var exception = false;
+var exception = null;
 
 function listener(event, exec_state, event_data, data) {
   try {
     if (event == Debug.DebugEvent.Break) {
-      if (breaks == 0) {
-        exec_state.prepareStep(Debug.StepAction.StepIn, 2);
-        breaks = 1;
-      } else if (breaks <= 3) {
-        breaks++;
-        // Check whether we break at the expected line.
-        print(event_data.sourceLineText());
-        assertTrue(event_data.sourceLineText().indexOf("Expected to step") > 0);
-        exec_state.prepareStep(Debug.StepAction.StepIn, 3);
-      }
+      exec_state.prepareStep(Debug.StepAction.StepIn);
+      print(event_data.sourceLineText());
+      assertTrue(
+          event_data.sourceLineText().indexOf(`B${breaks++}`) > 0);
     }
   } catch (e) {
-    exception = true;
+    print(e);
+    quit();
+    exception = e;
   }
 }
 
 function cb_set(num) {
-  print("element " + num);  // Expected to step to this point.
-  return true;
-}
+  print("element " + num);  // B2 B5 B8
+  return true;              // B3 B6 B9
+}                           // B4 B7 B10
 
 function cb_map(key, val) {
-  print("key " + key + ", value " + val);  // Expected to step to this point.
-  return true;
-}
+  print("key " + key + ", value " + val);  // B2 B5 B8
+  return true;                             // B3 B6 B9
+}                                          // B4 B7 B10
 
 var s = new Set();
 s.add(1);
 s.add(2);
 s.add(3);
-s.add(4);
 
 var m = new Map();
 m.set('foo', 1);
 m.set('bar', 2);
 m.set('baz', 3);
-m.set('bat', 4);
-
-Debug.setListener(listener);
 
 var breaks = 0;
-debugger;
-s.forEach(cb_set);
-assertFalse(exception);
-assertEquals(4, breaks);
+Debug.setListener(listener);
+debugger;                 // B0
+s.forEach(cb_set);        // B1
+Debug.setListener(null);  // B11
+assertNull(exception);
+assertEquals(12, breaks);
 
 breaks = 0;
-debugger;
-m.forEach(cb_map);
-assertFalse(exception);
-assertEquals(4, breaks);
-
-Debug.setListener(null);
-
+Debug.setListener(listener);
+debugger;                 // B0
+m.forEach(cb_map);        // B1
+Debug.setListener(null);  // B11
+assertNull(exception);
+assertEquals(12, breaks);
 
 // Test two levels of builtin callbacks:
 // Array.forEach calls a callback function, which by itself uses
 // Array.forEach with another callback function.
 
-function second_level_listener(event, exec_state, event_data, data) {
-  try {
-    if (event == Debug.DebugEvent.Break) {
-      if (breaks == 0) {
-        exec_state.prepareStep(Debug.StepAction.StepIn, 3);
-        breaks = 1;
-      } else if (breaks <= 16) {
-        breaks++;
-        // Check whether we break at the expected line.
-        assertTrue(event_data.sourceLineText().indexOf("Expected to step") > 0);
-        // Step two steps further every four breaks to skip the
-        // forEach call in the first level of recurision.
-        var step = (breaks % 4 == 1) ? 6 : 3;
-        exec_state.prepareStep(Debug.StepAction.StepIn, step);
-      }
-    }
-  } catch (e) {
-    exception = true;
-  }
-}
+function cb_set_2(num) {
+  print("element " + num);  // B3 B6 B9  B15 B18 B21 B27 B30 B33
+  return true;              // B4 B7 B10 B16 B19 B22 B28 B31 B34
+}                           // B5 B8 B11 B17 B20 B23 B29 B32 B35
+
+function cb_map_2(k, v) {
+  print(`key ${k}, value ${v}`);  // B3 B6 B9  B15 B18 B21 B27 B30 B33
+  return true;                    // B4 B7 B10 B16 B19 B22 B28 B31 B34
+}                                 // B5 B8 B11 B17 B20 B23 B29 B32 B35
 
 function cb_set_foreach(num) {
-  s.forEach(cb_set);
-  print("back to the first level of recursion.");
-}
+  s.forEach(cb_set_2);      // B2  B14 B26
+  print("back.");           // B12 B24 B36
+}                           // B13 B25 B37
 
 function cb_map_foreach(key, val) {
-  m.forEach(cb_set);
-  print("back to the first level of recursion.");
-}
-
-Debug.setListener(second_level_listener);
+  m.forEach(cb_map_2);      // B2  B14 B26
+  print("back.");           // B12 B24 B36
+}                           // B13 B25 B37
 
 breaks = 0;
-debugger;
-s.forEach(cb_set_foreach);
-assertFalse(exception);
-assertEquals(17, breaks);
+Debug.setListener(listener);
+debugger;                   // B0
+s.forEach(cb_set_foreach);  // B1
+Debug.setListener(null);    // B38
+assertNull(exception);
+assertEquals(39, breaks);
 
 breaks = 0;
-debugger;
-m.forEach(cb_map_foreach);
-assertFalse(exception);
-assertEquals(17, breaks);
-
-Debug.setListener(null);
+Debug.setListener(listener);
+debugger;                   // B0
+m.forEach(cb_map_foreach);  // B1
+Debug.setListener(null);    // B38
+assertNull(exception);
+assertEquals(39, breaks);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-generators.js b/deps/v8/test/mjsunit/es6/debug-stepin-generators.js
index f48c5ef75f..081dfb7063 100644
--- a/deps/v8/test/mjsunit/es6/debug-stepin-generators.js
+++ b/deps/v8/test/mjsunit/es6/debug-stepin-generators.js
@@ -15,7 +15,7 @@ function listener(event, exec_state, event_data, data) {
     print(source);
     if (/stop stepping/.test(source)) return;
     if (/yield/.test(source)) yields++;
-    exec_state.prepareStep(Debug.StepAction.StepIn, 1);
+    exec_state.prepareStep(Debug.StepAction.StepIn);
   } catch (e) {
     print(e, e.stack);
     exception = e;
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js b/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js
index 98510ff52b..6a7c5536dc 100644
--- a/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js
+++ b/deps/v8/test/mjsunit/es6/debug-stepin-microtasks.js
@@ -26,9 +26,9 @@ function listener(event, exec_state, event_data, data) {
                  "Unexpected pause at: " + source + "\n" +
                  "Expected: // Break " + break_count + ".");
       if (source.indexOf("StepOver.") !== -1) {
-        exec_state.prepareStep(Debug.StepAction.StepNext, 1);
+        exec_state.prepareStep(Debug.StepAction.StepNext);
       } else {
-        exec_state.prepareStep(Debug.StepAction.StepIn, 1);
+        exec_state.prepareStep(Debug.StepAction.StepIn);
       }
       ++break_count;
     }
diff --git a/deps/v8/test/mjsunit/es6/debug-stepin-string-template.js b/deps/v8/test/mjsunit/es6/debug-stepin-string-template.js
new file mode 100644
index 0000000000..f500faeee2
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/debug-stepin-string-template.js
@@ -0,0 +1,60 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug
+
+var exception = null;
+var log = [];
+
+function listener(event, exec_state, event_data, data) {
+  if (event != Debug.DebugEvent.Break) return;
+  try {
+    print(event_data.sourceLineText());
+    var entry = "";
+    for (var i = 0; i < exec_state.frameCount(); i++) {
+      entry += exec_state.frame(i).sourceLineText().substr(-1);
+      entry += exec_state.frame(i).sourceColumn();
+    }
+    log.push(entry);
+    exec_state.prepareStep(Debug.StepAction.StepIn);
+  } catch (e) {
+    exception = e;
+  }
+};
+
+function u(x) {
+  return x.toUpperCase();                         // d
+}                                                 // e
+
+var n = 3;
+
+var o = {
+  toString: function() {
+    return "D";                                   // f
+  }                                               // g
+}
+
+
+
+Debug.setListener(listener);
+debugger;                                         // a
+var s = `1 ${u("a")} 2 ${u("b")} 3 ${n} 4 ${o}`;  // b
+Debug.setListener(null);                          // c
+
+assertNull(exception);
+
+assertEquals([
+  "a0",
+  "b0",
+  "d2b13",
+  "e0b13",
+  "b25",
+  "d2b25",
+  "e0b25",
+  "f4b44",
+  "g2b44",
+  "c0"
+], log);
diff --git a/deps/v8/test/mjsunit/es6/debug-stepnext-for.js b/deps/v8/test/mjsunit/es6/debug-stepnext-for.js
index 001f7053fd..932840a6f9 100644
--- a/deps/v8/test/mjsunit/es6/debug-stepnext-for.js
+++ b/deps/v8/test/mjsunit/es6/debug-stepnext-for.js
@@ -72,7 +72,7 @@ function listener(event, exec_state, event_data, data) {
     var match = line.match(/\/\/ Break (\w)$/);
     assertEquals(2, match.length);
     log.push(match[1] + col);
-    exec_state.prepareStep(Debug.StepAction.StepNext, 1);
+    exec_state.prepareStep(Debug.StepAction.StepNext);
     break_count++;
   } catch (e) {
     exception = e;
@@ -86,6 +86,9 @@ Debug.setListener(null);         // Break z
 print("log:\n"+ JSON.stringify(log));
 // The let declaration differs from var in that the loop variable
 // is declared in every iteration.
+// TODO(verwaest): For-of has hacky position numbers for Symbol.iterator and
+// .next. Restore to proper positions once the CallPrinter can disambiguate
+// based on other values.
 var expected = [
   // Entry
   "a2","b2",
@@ -99,12 +102,12 @@ var expected = [
   "f12","f7","F4","f7","F4","f7","F4","f7",
   // For-in-let: get enumerable, next, body, next,  ...
   "g16","g11","G4","g11","G4","g11","G4","g11",
-  // For-of-var: next(), body, next(), body, ...
-  "h16","H4","h16","H4","h16","H4","h16",
-  // For-of: next(), body, next(), body, ...
-  "i12","I4","i12","I4","i12","I4","i12",
-  // For-of-let: next(), body, next(), ...
-  "j16","J4","j16","J4","j16","J4","j16",
+  // For-of-var: [Symbol.iterator](), next(), body, next(), body, ...
+  "h16","h14","h15","H4","h15","H4","h15","H4","h15",
+  // For-of: [Symbol.iterator](), next(), body, next(), body, ...
+  "i12","i10","i11","I4","i11","I4","i11","I4","i11",
+  // For-of-let: [Symbol.iterator](), next(), body, next(), ...
+  "j16","j14","j15","J4","j15","J4","j15","J4","j15",
   // For-var: var decl, condition, body, next, condition, body, ...
   "k7","k20","K4","k26","k20","K4","k26","k20","K4","k26","k20",
   // For: init, condition, body, next, condition, body, ...
diff --git a/deps/v8/test/mjsunit/es6/generators-parsing.js b/deps/v8/test/mjsunit/es6/generators-parsing.js
index e4408365d3..f3f8cad086 100644
--- a/deps/v8/test/mjsunit/es6/generators-parsing.js
+++ b/deps/v8/test/mjsunit/es6/generators-parsing.js
@@ -124,8 +124,8 @@ assertThrows("function* g() { yield 3 + yield 4; }", SyntaxError);
 // Yield is still a future-reserved-word in strict mode
 assertThrows("function f() { \"use strict\"; var yield = 13; }", SyntaxError);
 
-// The name of the NFE is let-bound in G, so is invalid.
-assertThrows("function* g() { yield (function yield() {}); }", SyntaxError);
+// The name of the NFE is bound in the generator expression, so is invalid.
+assertThrows("function f() { (function* yield() {}); }", SyntaxError);
 
 // In generators, yield is invalid as a formal argument name.
 assertThrows("function* g(yield) { yield (10); }", SyntaxError);
diff --git a/deps/v8/test/mjsunit/es6/instanceof-proxies.js b/deps/v8/test/mjsunit/es6/instanceof-proxies.js
new file mode 100644
index 0000000000..cc720ad8fe
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/instanceof-proxies.js
@@ -0,0 +1,62 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+// Flags: --harmony-proxies --allow-natives-syntax
+
+// Test instanceof with proxies.
+
+(function TestInstanceOfWithProxies() {
+  function foo(x) {
+    return x instanceof Array;
+  }
+  assertTrue(foo([]));
+  assertFalse(foo({}));
+  %OptimizeFunctionOnNextCall(foo);
+  assertTrue(foo([]));
+  assertFalse(foo({}));
+
+  var handler = {
+    getPrototypeOf: function(target) { return Array.prototype; }
+  };
+  var p = new Proxy({}, handler);
+  assertTrue(foo(p));
+  var o = {};
+  o.__proto__ = p;
+  assertTrue(foo(o));
+
+  // Make sure we are also correct if the handler throws.
+  handler.getPrototypeOf = function(target) {
+    throw "uncooperative";
+  }
+  assertThrows("foo(o)");
+
+  // Including if the optimized function has a catch handler.
+  function foo_catch(x) {
+    try {
+      x instanceof Array;
+    } catch(e) {
+      assertEquals("uncooperative", e);
+      return true;
+    }
+    return false;
+  }
+  assertTrue(foo_catch(o));
+  %OptimizeFunctionOnNextCall(foo_catch);
+  assertTrue(foo_catch(o));
+  handler.getPrototypeOf = function(target) { return Array.prototype; }
+  assertFalse(foo_catch(o));
+})();
+
+
+(function testInstanceOfWithRecursiveProxy() {
+  // Make sure we gracefully deal with recursive proxies.
+  var proxy = new Proxy({},{});
+  proxy.__proto__ = proxy;
+  // instanceof will cause an inifinite prototype walk.
+  assertThrows(() => { proxy instanceof Object }, RangeError);
+
+  var proxy2 = new Proxy({}, {getPrototypeOf() { return proxy2 }});
+  assertThrows(() => { proxy instanceof Object }, RangeError);
+})();
diff --git a/deps/v8/test/mjsunit/es6/iteration-semantics.js b/deps/v8/test/mjsunit/es6/iteration-semantics.js
index f29e6e011b..6466ac5e26 100644
--- a/deps/v8/test/mjsunit/es6/iteration-semantics.js
+++ b/deps/v8/test/mjsunit/es6/iteration-semantics.js
@@ -307,35 +307,36 @@ assertEquals(5,
              try_control(integers_until(10),
                          function(x) { return (x == 5) ? x : "continue" }));
 
+// TODO(neis,cbruni): Enable once the corresponding traps work again.
 // Proxy results, with getters.
-function transparent_proxy(x) {
-  return Proxy.create({
-    get: function(receiver, name) { return x[name]; }
-  });
-}
-assertEquals([1, 2],
-             fold(append, [],
-                  results([one_time_getter({ value: 1 }, 'done', false),
-                           one_time_getter({ done: false }, 'value', 2),
-                           { value: 37, done: true },
-                           never_getter(never_getter({}, 'done'), 'value')]
-                          .map(transparent_proxy))));
+// function transparent_proxy(x) {
+//   return new Proxy({}, {
+//     get: function(receiver, name) { return x[name]; }
+//   });
+// }
+// assertEquals([1, 2],
+//              fold(append, [],
+//                   results([one_time_getter({ value: 1 }, 'done', false),
+//                            one_time_getter({ done: false }, 'value', 2),
+//                            { value: 37, done: true },
+//                            never_getter(never_getter({}, 'done'), 'value')]
+//                           .map(transparent_proxy))));
 
 // Proxy iterators.
-function poison_proxy_after(iterable, n) {
-  var iterator = iterable[Symbol.iterator]();
-  return wrap_iterator(Proxy.create({
-    get: function(receiver, name) {
-      if (name == 'next' && n-- < 0) throw "unreachable";
-      return iterator[name];
-    },
-    // Needed for integers_until(10)'s this.n++.
-    set: function(receiver, name, val) {
-      return iterator[name] = val;
-    }
-  }));
-}
-assertEquals(45, fold(sum, 0, poison_proxy_after(integers_until(10), 10)));
+// function poison_proxy_after(iterable, n) {
+//   var iterator = iterable[Symbol.iterator]();
+//   return wrap_iterator(new Proxy({}, {
+//     get: function(receiver, name) {
+//       if (name == 'next' && n-- < 0) throw "unreachable";
+//       return iterator[name];
+//     },
+//     // Needed for integers_until(10)'s this.n++.
+//     set: function(receiver, name, val) {
+//       return iterator[name] = val;
+//     }
+//   }));
+// }
+// assertEquals(45, fold(sum, 0, poison_proxy_after(integers_until(10), 10)));
 
 
 function test_iterator_result_object_non_object(value, descr) {
diff --git a/deps/v8/test/mjsunit/es6/legacy-subclassing.js b/deps/v8/test/mjsunit/es6/legacy-subclassing.js
new file mode 100644
index 0000000000..dbf666d07c
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/legacy-subclassing.js
@@ -0,0 +1,38 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --noharmony-species
+
+// Before Symbol.species was added, ArrayBuffer subclasses constructed
+// ArrayBuffers, and Array subclasses constructed Arrays, but TypedArray and
+// Promise subclasses constructed an instance of the subclass.
+
+'use strict';
+
+assertEquals(undefined, Symbol.species);
+
+class MyArray extends Array { }
+let myArray = new MyArray();
+assertEquals(MyArray, myArray.constructor);
+assertEquals(Array, myArray.map(x => x + 1).constructor);
+assertEquals(Array, myArray.concat().constructor);
+
+class MyUint8Array extends Uint8Array { }
+Object.defineProperty(MyUint8Array.prototype, "BYTES_PER_ELEMENT", {value: 1});
+let myTypedArray = new MyUint8Array(3);
+assertEquals(MyUint8Array, myTypedArray.constructor);
+assertEquals(MyUint8Array, myTypedArray.map(x => x + 1).constructor);
+
+class MyArrayBuffer extends ArrayBuffer { }
+let myBuffer = new MyArrayBuffer(0);
+assertEquals(MyArrayBuffer, myBuffer.constructor);
+assertEquals(ArrayBuffer, myBuffer.slice().constructor);
+
+class MyPromise extends Promise { }
+let myPromise = new MyPromise(() => {});
+assertEquals(MyPromise, myPromise.constructor);
+assertEquals(MyPromise, myPromise.then().constructor);
+
+// However, subarray instantiates members of the parent class
+assertEquals(Uint8Array, myTypedArray.subarray(1).constructor);
diff --git a/deps/v8/test/mjsunit/es6/new-target.js b/deps/v8/test/mjsunit/es6/new-target.js
index 9ecff815fa..8a06ff6c89 100644
--- a/deps/v8/test/mjsunit/es6/new-target.js
+++ b/deps/v8/test/mjsunit/es6/new-target.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-reflect --harmony-destructuring --harmony-rest-parameters
+// Flags: --harmony-reflect --harmony-destructuring-bind
 
 
 (function TestClass() {
diff --git a/deps/v8/test/mjsunit/es6/no-unicode-regexp-flag.js b/deps/v8/test/mjsunit/es6/no-unicode-regexp-flag.js
new file mode 100644
index 0000000000..b56a4b56dd
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/no-unicode-regexp-flag.js
@@ -0,0 +1,24 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Before Unicode RegExps are shipped, we shouldn't have the 'unicode'
+// property on RegExp.prototype, or read it from 'flags'.
+// mjsunit/es6/regexp-flags tests that the property is there when the
+// flag is on.
+
+// Flags: --harmony-regexp
+
+'use strict';
+
+assertFalse(RegExp.prototype.hasOwnProperty('unicode'));
+
+// If we were going to be really strict, we could have a test like this,
+// with the assertTrue replaced by assertFalse, since flags shouldn't
+// Get the 'unicode' property. However, it is probably OK to omit this
+// detailed fix.
+var x = /a/;
+var y = false;
+Object.defineProperty(x, 'unicode', { get() { y = true; } });
+assertEquals("", x.flags);
+assertTrue(y);
diff --git a/deps/v8/test/mjsunit/es6/object-tostring.js b/deps/v8/test/mjsunit/es6/object-tostring.js
index c73a7686cd..4d6090faf1 100644
--- a/deps/v8/test/mjsunit/es6/object-tostring.js
+++ b/deps/v8/test/mjsunit/es6/object-tostring.js
@@ -1,8 +1,8 @@
-// Copyright 2014 the V8 project authors. All rights reserved.
+// Copyright 2015 the V8 project authors. All rights reserved.
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-tostring
+// Flags: --harmony-tostring --harmony-proxies
 
 var global = this;
 
@@ -41,7 +41,7 @@ function testToStringTag(className) {
   Object.defineProperty(obj, Symbol.toStringTag, {
     get: function() { throw className; }
   });
-  assertThrows(function() {
+  assertThrowsEquals(function() {
     Object.prototype.toString.call(obj);
   }, className);
 
@@ -137,3 +137,25 @@ function testObjectToStringOwnNonStringValue() {
   assertEquals("[object Object]", ({}).toString.call(obj));
 }
 testObjectToStringOwnNonStringValue();
+
+
+// Proxies
+
+function assertTag(tag, obj) {
+  assertEquals("[object " + tag + "]", Object.prototype.toString.call(obj));
+}
+
+assertTag("Object", new Proxy({}, {}));
+assertTag("Array", new Proxy([], {}));
+assertTag("Function", new Proxy(() => 42, {}));
+assertTag("Foo", new Proxy(() => 42, {get() {return "Foo"}}));
+assertTag("Function", new Proxy(() => 42, {get() {return 666}}));
+
+revocable = Proxy.revocable([], {});
+revocable.revoke();
+assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
+
+handler = {};
+revocable = Proxy.revocable([], handler);
+handler.get = () => revocable.revoke();
+assertThrows(() => Object.prototype.toString.call(revocable.proxy), TypeError);
diff --git a/deps/v8/test/mjsunit/es6/promise-internal-setter.js b/deps/v8/test/mjsunit/es6/promise-internal-setter.js
index 83e4738316..20d361f623 100644
--- a/deps/v8/test/mjsunit/es6/promise-internal-setter.js
+++ b/deps/v8/test/mjsunit/es6/promise-internal-setter.js
@@ -2,6 +2,8 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
+// Flags: --promise-extra
+
 'use strict';
 
 Object.defineProperties(Object.prototype, {
diff --git a/deps/v8/test/mjsunit/es6/promises.js b/deps/v8/test/mjsunit/es6/promises.js
index 341242f8d9..e4c8b389e8 100644
--- a/deps/v8/test/mjsunit/es6/promises.js
+++ b/deps/v8/test/mjsunit/es6/promises.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --harmony-tostring
+// Flags: --allow-natives-syntax --harmony-tostring --promise-extra
 
 // Make sure we don't rely on functions patchable by monkeys.
 var call = Function.prototype.call.call.bind(Function.prototype.call)
@@ -47,6 +47,8 @@ function clear(o) {
   clear(o.__proto__)
   var properties = getOwnPropertyNames(o)
   for (var i in properties) {
+    // Do not clobber Object.prototype.toString, which is used by tests.
+    if (properties[i] === "toString") continue;
     clearProp(o, properties[i])
   }
 }
@@ -93,13 +95,30 @@ function assertAsync(b, s) {
   --asyncAssertsExpected
 }
 
+function assertLater(f, name) {
+  assertFalse(f()); // should not be true synchronously
+  ++asyncAssertsExpected;
+  var iterations = 0;
+  function runAssertion() {
+    if (f()) {
+      print(name, "succeeded");
+      --asyncAssertsExpected;
+    } else if (iterations++ < 10) {
+      %EnqueueMicrotask(runAssertion);
+    } else {
+      %AbortJS(name + " FAILED!");
+    }
+  }
+  %EnqueueMicrotask(runAssertion);
+}
+
 function assertAsyncDone(iteration) {
   var iteration = iteration || 0;
   %EnqueueMicrotask(function() {
     if (asyncAssertsExpected === 0)
       assertAsync(true, "all")
     else if (iteration > 10)  // Shouldn't take more.
-      assertAsync(false, "all")
+      assertAsync(false, "all... " + asyncAssertsExpected)
     else
       assertAsyncDone(iteration + 1)
   });
@@ -176,8 +195,9 @@ function assertAsyncDone(iteration) {
   var p1 = Promise.accept(5)
   var p2 = Promise.accept(p1)
   var p3 = Promise.accept(p2)
+  // Note: Chain now has then-style semantics, here and in future tests.
   p3.chain(
-    function(x) { assertAsync(x === p2, "resolved/chain") },
+    function(x) { assertAsync(x === 5, "resolved/chain") },
     assertUnreachable
   )
   assertAsyncRan()
@@ -199,8 +219,8 @@ function assertAsyncDone(iteration) {
   var p2 = Promise.accept(p1)
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "rejected/chain") },
-    assertUnreachable
+    assertUnreachable,
+    function(x) { assertAsync(x === 5, "rejected/chain") }
   )
   assertAsyncRan()
 })();
@@ -221,7 +241,7 @@ function assertAsyncDone(iteration) {
   var p2 = Promise.accept(p1)
   var p3 = Promise.accept(p2)
   p3.chain(function(x) { return x }, assertUnreachable).chain(
-    function(x) { assertAsync(x === p1, "resolved/chain/chain") },
+    function(x) { assertAsync(x === 5, "resolved/chain/chain") },
     assertUnreachable
   )
   assertAsyncRan()
@@ -353,7 +373,7 @@ function assertAsyncDone(iteration) {
   var p2 = {then: function(onResolve, onReject) { onResolve(p1) }}
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "resolved/thenable/chain") },
+    function(x) { assertAsync(x === 5, "resolved/thenable/chain") },
     assertUnreachable
   )
   assertAsyncRan()
@@ -375,8 +395,8 @@ function assertAsyncDone(iteration) {
   var p2 = {then: function(onResolve, onReject) { onResolve(p1) }}
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "rejected/thenable/chain") },
-    assertUnreachable
+    assertUnreachable,
+    function(x) { assertAsync(x === 5, "rejected/thenable/chain") }
   )
   assertAsyncRan()
 })();
@@ -398,7 +418,7 @@ function assertAsyncDone(iteration) {
   var p2 = Promise.accept(p1)
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "chain/resolve") },
+    function(x) { assertAsync(x === 5, "chain/resolve") },
     assertUnreachable
   )
   deferred.resolve(5)
@@ -408,8 +428,8 @@ function assertAsyncDone(iteration) {
 (function() {
   var deferred = Promise.defer()
   var p1 = deferred.promise
-  var p2 = Promise.accept(p1)
-  var p3 = Promise.accept(p2)
+  var p2 = Promise.resolve(p1)
+  var p3 = Promise.resolve(p2)
   p3.then(
     function(x) { assertAsync(x === 5, "then/resolve") },
     assertUnreachable
@@ -424,8 +444,8 @@ function assertAsyncDone(iteration) {
   var p2 = Promise.accept(p1)
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "chain/reject") },
-    assertUnreachable
+    assertUnreachable,
+    function(x) { assertAsync(x === 5, "chain/reject") }
   )
   deferred.reject(5)
   assertAsyncRan()
@@ -474,7 +494,7 @@ function assertAsyncDone(iteration) {
   var p2 = {then: function(onResolve, onReject) { onResolve(p1) }}
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "chain/resolve/thenable") },
+    function(x) { assertAsync(x === 5, "chain/resolve/thenable") },
     assertUnreachable
   )
   deferred.resolve(5)
@@ -500,8 +520,8 @@ function assertAsyncDone(iteration) {
   var p2 = {then: function(onResolve, onReject) { onResolve(p1) }}
   var p3 = Promise.accept(p2)
   p3.chain(
-    function(x) { assertAsync(x === p2, "chain/reject/thenable") },
-    assertUnreachable
+    assertUnreachable,
+    function(x) { assertAsync(x === 5, "chain/reject/thenable") }
   )
   deferred.reject(5)
   assertAsyncRan()
@@ -526,7 +546,7 @@ function assertAsyncDone(iteration) {
   var deferred = Promise.defer()
   var p3 = deferred.promise
   p3.chain(
-    function(x) { assertAsync(x === p2, "chain/resolve2") },
+    function(x) { assertAsync(x === 5, "chain/resolve2") },
     assertUnreachable
   )
   deferred.resolve(p2)
@@ -578,7 +598,7 @@ function assertAsyncDone(iteration) {
   var deferred = Promise.defer()
   var p3 = deferred.promise
   p3.chain(
-    function(x) { assertAsync(x === p2, "chain/resolve/thenable2") },
+    function(x) { assertAsync(x === 5, "chain/resolve/thenable2") },
     assertUnreachable
   )
   deferred.resolve(p2)
@@ -623,8 +643,8 @@ function assertAsyncDone(iteration) {
   var p = deferred.promise
   deferred.resolve(p)
   p.chain(
-    function(x) { assertAsync(x === p, "cyclic/deferred/chain") },
-    assertUnreachable
+    assertUnreachable,
+    function(r) { assertAsync(r instanceof TypeError, "cyclic/deferred/then") }
   )
   assertAsyncRan()
 })();
@@ -741,7 +761,6 @@ function assertAsyncDone(iteration) {
   assertAsyncRan()
 })();
 
-
 (function() {
   'use strict';
   var getCalls = 0;
@@ -1033,7 +1052,8 @@ function assertAsyncDone(iteration) {
 
   log = ""
   MyPromise.all([21, Promise.accept(22), 23, MyPromise.accept(24), 25, 26])
-  assertTrue(log === "nx24nnx21nnnnx23nnnx25nnx26n", "subclass/all/self")
+  assertTrue(log === "nx24nnx21nnx[object Promise]nnx23nnnx25nnx26n",
+             "subclass/all/self")
 })();
 
 (function() {
@@ -1059,4 +1079,39 @@ function assertAsyncDone(iteration) {
              "subclass/resolve/descendant with transplanted own constructor");
 }());
 
+(function() {
+  var thenCalled = false;
+
+  var resolve;
+  var promise = new Promise(function(res) { resolve = res; });
+  resolve({ then() { thenCalled = true; throw new Error(); } });
+  assertLater(function() { return thenCalled; }, "resolve-with-thenable");
+});
+
+(function() {
+  var calledWith;
+
+  var resolve;
+  var p1 = (new Promise(function(res) { resolve = res; }));
+  var p2 = p1.then(function(v) {
+    return {
+      then(resolve, reject) { resolve({ then() { calledWith = v }}); }
+    };
+  });
+
+  resolve({ then(resolve) { resolve(2); } });
+  assertLater(function() { return calledWith === 2; },
+              "resolve-with-thenable2");
+})();
+
+(function() {
+  var p = Promise.resolve();
+  var callCount = 0;
+  defineProperty(p, "constructor", {
+    get: function() { ++callCount; return Promise; }
+  });
+  p.then();
+  assertEquals(1, callCount);
+})();
+
 assertAsyncDone()
diff --git a/deps/v8/test/mjsunit/es6/regexp-constructor.js b/deps/v8/test/mjsunit/es6/regexp-constructor.js
new file mode 100644
index 0000000000..e3b7efa0e7
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regexp-constructor.js
@@ -0,0 +1,99 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-subclass
+
+"use strict";
+
+function should_not_be_called() {
+  throw new Error("should not be called");
+}
+
+(function() {
+  var r = new RegExp("biep");
+  assertTrue(r === RegExp(r));
+  assertFalse(r === new RegExp(r));
+  r[Symbol.match] = false;
+  Object.defineProperty(r, "source", {get: should_not_be_called});
+  Object.defineProperty(r, "flags", {get: should_not_be_called});
+  assertFalse(r === RegExp(r));
+})();
+
+(function() {
+  class A extends RegExp {
+    get source() { throw new Error("should not be called") }
+    get flags() { throw new Error("should not be called") }
+  }
+
+  var r = new A("biep");
+  var r2 = RegExp(r);
+
+  assertFalse(r === r2);
+  assertEquals(r, r2);
+  assertTrue(A.prototype === r.__proto__);
+  assertTrue(RegExp.prototype === r2.__proto__);
+
+  var r3 = RegExp(r);
+  assertFalse(r3 === r);
+  assertEquals(r3, r);
+
+  var r4 = new A(r2);
+  assertFalse(r4 === r2);
+  assertEquals(r4, r2);
+  assertTrue(A.prototype === r4.__proto__);
+
+  r[Symbol.match] = false;
+  var r5 = new A(r);
+  assertFalse(r5 === r);
+  assertEquals(r5, r);
+  assertTrue(A.prototype === r5.__proto__);
+})();
+
+(function() {
+  var log = [];
+  var match = {
+    get source() { log.push("source"); return "biep"; },
+    get flags() { log.push("flags"); return "i"; }
+  };
+  Object.defineProperty(match, Symbol.match,
+      {get() { log.push("match"); return true; }});
+  var r = RegExp(match);
+  assertEquals(["match", "source", "flags"], log);
+  assertFalse(r === match);
+  assertEquals(/biep/i, r);
+})();
+
+(function() {
+  var log = [];
+  var match = {
+    get source() { log.push("source"); return "biep"; },
+    get flags() { log.push("flags"); return "i"; }
+  };
+  Object.defineProperty(match, Symbol.match,
+      {get() { log.push("match"); return true; }});
+  match.constructor = RegExp;
+  var r = RegExp(match);
+  assertEquals(["match"], log);
+  assertTrue(r === match);
+})();
+
+(function() {
+  var r = RegExp("biep", "i");
+  r[Symbol.match] = false;
+  var r2 = RegExp(r, "g");
+  assertFalse(r === r2);
+  assertEquals(/biep/i, r);
+  assertEquals(/biep/g, r2);
+})();
+
+(function() {
+  class A extends RegExp {
+    get ["constructor"]() { log.push("constructor"); return RegExp; }
+  }
+  var r = new A("biep");
+  var log = [];
+  var r2 = RegExp(r);
+  assertEquals(["constructor"], log);
+  assertTrue(r === r2);
+})();
diff --git a/deps/v8/test/mjsunit/es6/regexp-flags.js b/deps/v8/test/mjsunit/es6/regexp-flags.js
index 98070fb735..2f1222197d 100644
--- a/deps/v8/test/mjsunit/es6/regexp-flags.js
+++ b/deps/v8/test/mjsunit/es6/regexp-flags.js
@@ -50,7 +50,11 @@ assertEquals(4, get_count);
 
 
 function testName(name) {
-  assertThrows(() => RegExp.prototype[name], TypeError);
+  if (name === "sticky") {
+    assertEquals(undefined, RegExp.prototype[name]);
+  } else {
+    assertThrows(() => RegExp.prototype[name], TypeError);
+  }
   assertEquals(
       "get " + name,
       Object.getOwnPropertyDescriptor(RegExp.prototype, name).get.name);
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-4211.js b/deps/v8/test/mjsunit/es6/regress/regress-4211.js
new file mode 100644
index 0000000000..e276bb4333
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-4211.js
@@ -0,0 +1,10 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertThrows("()=>{}()", SyntaxError);
+assertThrows("x=>{}()", SyntaxError);
+assertThrows("(...x)=>{}()", SyntaxError);
+assertThrows("(x)=>{}()", SyntaxError);
+assertThrows("(x,y)=>{}()", SyntaxError);
+assertThrows("(x,y,...z)=>{}()", SyntaxError);
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-468661.js b/deps/v8/test/mjsunit/es6/regress/regress-468661.js
index 543a87c1df..4a42350930 100644
--- a/deps/v8/test/mjsunit/es6/regress/regress-468661.js
+++ b/deps/v8/test/mjsunit/es6/regress/regress-468661.js
@@ -44,7 +44,7 @@ function listener(event, exec_state, event_data, data) {
       ++break_count;
 
       if (break_count !== expected_breaks) {
-        exec_state.prepareStep(Debug.StepAction.StepIn, 1);
+        exec_state.prepareStep(Debug.StepAction.StepIn);
         print("Next step prepared");
       }
     }
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-508074.js b/deps/v8/test/mjsunit/es6/regress/regress-508074.js
new file mode 100644
index 0000000000..f4d1a44255
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-508074.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var f = (a, b, ...c) => {
+  print(a);
+  print(b);
+  print(c);
+  assertEquals(6, a);
+  assertEquals(5, b);
+  assertEquals([4, 3, 2, 1], c);
+};
+
+function g() {
+  f(6, 5, 4, 3, 2, 1);
+};
+
+g();
+g();
+g();
+
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-513474.js b/deps/v8/test/mjsunit/es6/regress/regress-513474.js
new file mode 100644
index 0000000000..98a052c549
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-513474.js
@@ -0,0 +1,5 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function(...a) { function f() { eval() } })();
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-cr372788.js b/deps/v8/test/mjsunit/es6/regress/regress-cr372788.js
index 9b66a7e08b..3144b39830 100644
--- a/deps/v8/test/mjsunit/es6/regress/regress-cr372788.js
+++ b/deps/v8/test/mjsunit/es6/regress/regress-cr372788.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --promise-extra
 
 var x = 0;
 var y = 0;
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js b/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js
index 9bb313ffbe..2b0b7eace7 100644
--- a/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js
+++ b/deps/v8/test/mjsunit/es6/regress/regress-cr493566.js
@@ -2,36 +2,43 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-proxies
+// Flags: --harmony-proxies --harmony-reflect
 
 "use strict";
-
-
 var global = this;
 
-
 (function TestGlobalReceiver() {
   class A {
-    s() {
-      super.bla = 10;
+    s(value) {
+      super.bla = value;
     }
   }
-  new A().s.call(global);
+  var a = new A();
+  a.s(9);
+  assertEquals(undefined, global.bla);
+  assertEquals(9, a.bla);
+
+  a = new A();
+  a.s.call(global, 10);
   assertEquals(10, global.bla);
+  assertEquals(undefined, a.bla);
 })();
 
 
 (function TestProxyProto() {
   var calls = 0;
   var handler = {
-    getPropertyDescriptor: function(name) {
+    set(t, p, v, r) {
       calls++;
+      return Reflect.set(t, p, v, r);
+    },
+    getPropertyDescriptor(target, name) {
+      calls += 10;
       return undefined;
     }
   };
-
-  var proto = {};
-  var proxy = Proxy.create(handler, proto);
+  var target = {};
+  var proxy = new Proxy(target, handler);
   var object = {
     __proto__: proxy,
     setX(v) {
@@ -43,15 +50,23 @@ var global = this;
   };
 
   object.setX(1);
+  assertEquals(1, object.x);
+  assertEquals(1, Object.getOwnPropertyDescriptor(object, 'x').value);
+  assertEquals(1, calls);
+
+  calls = 0;
+  object.setX.call(proxy, 2);
+  assertEquals(2, target.x);
   assertEquals(1, Object.getOwnPropertyDescriptor(object, 'x').value);
   assertEquals(1, calls);
 
   var sym = Symbol();
+  calls = 0;
   object.setSymbol.call(global, sym, 2);
   assertEquals(2, Object.getOwnPropertyDescriptor(global, sym).value);
   // We currently do not invoke proxy traps for symbols
   assertEquals(1, calls);
-})();
+});
 
 
 (function TestProxyReceiver() {
@@ -62,19 +77,28 @@ var global = this;
   };
 
   var calls = 0;
+  var target = {target:1};
   var handler = {
-    getPropertyDescriptor(name) {
-      assertUnreachable();
-    },
-    set(receiver, name, value) {
+    getOwnPropertyDescriptor(t, name) {
       calls++;
-      assertEquals(proxy, receiver);
-      assertEquals('y', name);
-      assertEquals(3, value);
+    },
+    defineProperty(t, name, desc) {
+      calls += 10;
+      t[name] = desc.value;
+      return true;
+    },
+    set(target, name, value) {
+      assertUnreachable();
     }
   };
+  var proxy = new Proxy(target, handler);
 
-  var proxy = Proxy.create(handler);
+  assertEquals(undefined, object.y);
+  object.setY(10);
+  assertEquals(10, object.y);
+
+  // Change the receiver to the proxy, but the set is called on the global.
   object.setY.call(proxy, 3);
-  assertEquals(1, calls);
+  assertEquals(3, target.y);
+  assertEquals(11, calls);
 })();
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-cr512574.js b/deps/v8/test/mjsunit/es6/regress/regress-cr512574.js
index 2c10e19315..8d843ee694 100644
--- a/deps/v8/test/mjsunit/es6/regress/regress-cr512574.js
+++ b/deps/v8/test/mjsunit/es6/regress/regress-cr512574.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-destructuring
+// Flags: --harmony-destructuring-bind
 
 function f({}) {
   for (var v in []);
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js b/deps/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js
new file mode 100644
index 0000000000..59932f6b4c
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-inlined-new-target.js
@@ -0,0 +1,13 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() { return { val: new.target }; }
+function f() { return (new g()).val; }
+
+assertEquals(g, f());
+assertEquals(g, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(g, f());
diff --git a/deps/v8/test/mjsunit/es6/regress/regress-new-target-context.js b/deps/v8/test/mjsunit/es6/regress/regress-new-target-context.js
new file mode 100644
index 0000000000..eadf6e3aec
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/regress/regress-new-target-context.js
@@ -0,0 +1,25 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test access of the new.target value in functions that also allocate local
+// function contexts of varying sizes, making sure the value is not clobbered.
+
+function makeFun(n) {
+  var source = "(function f" + n + "() { ";
+  for (var i = 0; i < n; ++i) source += "var v" + i + "; ";
+  source += "(function() { 0 ";
+  for (var i = 0; i < n; ++i) source += "+ v" + i + " ";
+  source += "})(); return { value: new.target }; })";
+  return eval(source);
+}
+
+// Exercise fast case.
+var a = makeFun(4);
+assertEquals(a, new a().value);
+assertEquals(undefined, a().value);
+
+// Exercise slow case.
+var b = makeFun(128);
+assertEquals(b, new b().value);
+assertEquals(undefined, b().value);
diff --git a/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js b/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js
new file mode 100644
index 0000000000..c9b81661dc
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/rest-params-lazy-parsing.js
@@ -0,0 +1,32 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --min-preparse-length=0
+
+function variadic(co, ...values) {
+  var sum = 0;
+  while (values.length) {
+    sum += co * values.pop();
+  }
+  return sum;
+}
+
+var arrowVariadic = (co, ...values) => {
+  var sum = 0;
+  while (values.length) {
+    sum += co * values.pop();
+  }
+  return sum;
+}
+
+assertEquals(1, variadic.length);
+assertEquals(1, arrowVariadic.length);
+
+assertEquals(90, variadic(2, 1, 2, 3, 4, 5, 6, 7, 8, 9));
+assertEquals(74, variadic(2, 1, 2, 3, 4, 5, 6, 7, 9));
+assertEquals(110, variadic(2, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
+
+assertEquals(90, arrowVariadic(2, 1, 2, 3, 4, 5, 6, 7, 8, 9));
+assertEquals(74, arrowVariadic(2, 1, 2, 3, 4, 5, 6, 7, 9));
+assertEquals(110, arrowVariadic(2, 1, 2, 3, 4, 5, 6, 7, 8, 9, 10));
diff --git a/deps/v8/test/mjsunit/es6/rest-params.js b/deps/v8/test/mjsunit/es6/rest-params.js
new file mode 100644
index 0000000000..9afe9b409e
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/rest-params.js
@@ -0,0 +1,242 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function testRestIndex() {
+  assertEquals(5, (function(...args) { return args.length; })(1,2,3,4,5));
+  assertEquals(4, (function(a, ...args) { return args.length; })(1,2,3,4,5));
+  assertEquals(3, (function(a, b, ...args) { return args.length; })(1,2,3,4,5));
+  assertEquals(2, (function(a, b, c, ...args) {
+                      return args.length; })(1,2,3,4,5));
+  assertEquals(1, (function(a, b, c, d, ...args) {
+                      return args.length; })(1,2,3,4,5));
+  assertEquals(0, (function(a, b, c, d, e, ...args) {
+                    return args.length; })(1,2,3,4,5));
+})();
+
+
+var strictTest = (function() {
+  "use strict";
+  return function strictTest(a, b, ...c) {
+    assertEquals(Array, c.constructor);
+    assertTrue(Array.isArray(c));
+
+    var expectedLength = arguments.length >= 3 ? arguments.length - 2 : 0;
+    assertEquals(expectedLength, c.length);
+
+    for (var i = 2, j = 0; i < arguments.length; ++i) {
+      assertEquals(c[j++], arguments[i]);
+    }
+  };
+})();
+
+
+function sloppyTest(a, b, ...c) {
+  assertEquals(Array, c.constructor);
+  assertTrue(Array.isArray(c));
+
+  var expectedLength = arguments.length >= 3 ? arguments.length - 2 : 0;
+  assertEquals(expectedLength, c.length);
+
+  for (var i = 2, j = 0; i < arguments.length; ++i) {
+    assertEquals(c[j++], arguments[i]);
+  }
+}
+
+
+var O = {
+  strict: strictTest,
+  sloppy: sloppyTest
+};
+
+(function testStrictRestParamArity() {
+  assertEquals(2, strictTest.length);
+  assertEquals(2, O.strict.length);
+})();
+
+
+(function testRestParamsStrictMode() {
+  strictTest();
+  strictTest(1, 2);
+  strictTest(1, 2, 3, 4, 5, 6);
+  strictTest(1, 2, 3);
+  O.strict();
+  O.strict(1, 2);
+  O.strict(1, 2, 3, 4, 5, 6);
+  O.strict(1, 2, 3);
+})();
+
+
+(function testRestParamsStrictModeApply() {
+  strictTest.apply(null, []);
+  strictTest.apply(null, [1, 2]);
+  strictTest.apply(null, [1, 2, 3, 4, 5, 6]);
+  strictTest.apply(null, [1, 2, 3]);
+  O.strict.apply(O, []);
+  O.strict.apply(O, [1, 2]);
+  O.strict.apply(O, [1, 2, 3, 4, 5, 6]);
+  O.strict.apply(O, [1, 2, 3]);
+})();
+
+
+(function testRestParamsStrictModeCall() {
+  strictTest.call(null);
+  strictTest.call(null, 1, 2);
+  strictTest.call(null, 1, 2, 3, 4, 5, 6);
+  strictTest.call(null, 1, 2, 3);
+  O.strict.call(O);
+  O.strict.call(O, 1, 2);
+  O.strict.call(O, 1, 2, 3, 4, 5, 6);
+  O.strict.call(O, 1, 2, 3);
+})();
+
+
+(function testsloppyRestParamArity() {
+  assertEquals(2, sloppyTest.length);
+  assertEquals(2, O.sloppy.length);
+})();
+
+
+(function testRestParamssloppyMode() {
+  sloppyTest();
+  sloppyTest(1, 2);
+  sloppyTest(1, 2, 3, 4, 5, 6);
+  sloppyTest(1, 2, 3);
+  O.sloppy();
+  O.sloppy(1, 2);
+  O.sloppy(1, 2, 3, 4, 5, 6);
+  O.sloppy(1, 2, 3);
+})();
+
+
+(function testRestParamssloppyModeApply() {
+  sloppyTest.apply(null, []);
+  sloppyTest.apply(null, [1, 2]);
+  sloppyTest.apply(null, [1, 2, 3, 4, 5, 6]);
+  sloppyTest.apply(null, [1, 2, 3]);
+  O.sloppy.apply(O, []);
+  O.sloppy.apply(O, [1, 2]);
+  O.sloppy.apply(O, [1, 2, 3, 4, 5, 6]);
+  O.sloppy.apply(O, [1, 2, 3]);
+})();
+
+
+(function testRestParamssloppyModeCall() {
+  sloppyTest.call(null);
+  sloppyTest.call(null, 1, 2);
+  sloppyTest.call(null, 1, 2, 3, 4, 5, 6);
+  sloppyTest.call(null, 1, 2, 3);
+  O.sloppy.call(O);
+  O.sloppy.call(O, 1, 2);
+  O.sloppy.call(O, 1, 2, 3, 4, 5, 6);
+  O.sloppy.call(O, 1, 2, 3);
+})();
+
+
+(function testUnmappedArguments() {
+  // Strict/Unmapped arguments should always be used for functions with rest
+  // parameters
+  assertThrows(function(...rest) { return arguments.caller; }, TypeError);
+  assertThrows(function(...rest) { return arguments.callee; }, TypeError);
+  // TODO(caitp): figure out why this doesn't throw sometimes, even though the
+  //              getter always does =)
+  // assertThrows(function(...rest) { arguments.caller = 1; }, TypeError);
+  // assertThrows(function(...rest) { arguments.callee = 1; }, TypeError);
+})();
+
+
+(function testNoAliasArgumentsStrict() {
+  ((function() {
+    "use strict";
+    return (function strictF(a, ...rest) {
+              arguments[0] = 1;
+              assertEquals(3, a);
+              arguments[1] = 2;
+              assertArrayEquals([4, 5], rest);
+            });
+  })())(3, 4, 5);
+})();
+
+
+(function testNoAliasArgumentsSloppy() {
+  function sloppyF(a, ...rest) {
+    arguments[0] = 1;
+    assertEquals(3, a);
+    arguments[1] = 2;
+    assertArrayEquals([4, 5], rest);
+  }
+  sloppyF(3, 4, 5);
+})();
+
+
+(function testRestParamsWithNewTarget() {
+  "use strict";
+  class Base {
+    constructor(...a) {
+      this.base = a;
+      assertEquals(arguments.length, a.length);
+      var args = [];
+      for (var i = 0; i < arguments.length; ++i) {
+        args.push(arguments[i]);
+      }
+      assertEquals(args, a);
+    }
+  }
+  class Child extends Base {
+    constructor(...b) {
+      super(1, 2, 3);
+      this.child = b;
+      assertEquals(arguments.length, b.length);
+      var args = [];
+      for (var i = 0; i < arguments.length; ++i) {
+        args.push(arguments[i]);
+      }
+      assertEquals(args, b);
+    }
+  }
+
+  var c = new Child(1, 2, 3);
+  assertEquals([1, 2, 3], c.child);
+  assertEquals([1, 2, 3], c.base);
+})();
+
+(function TestDirectiveThrows() {
+  "use strict";
+
+  assertThrows(
+    function(){ eval("function(...rest){'use strict';}") }, SyntaxError);
+  assertThrows(function(){ eval("(...rest) => {'use strict';}") }, SyntaxError);
+  assertThrows(
+    function(){ eval("(class{foo(...rest) {'use strict';}});") }, SyntaxError);
+
+  assertThrows(
+    function(){ eval("function(a, ...rest){'use strict';}") }, SyntaxError);
+  assertThrows(
+    function(){ eval("(a, ...rest) => {'use strict';}") }, SyntaxError);
+  assertThrows(
+    function(){ eval("(class{foo(a, ...rest) {'use strict';}});") },
+    SyntaxError);
+})();
+
+(function TestRestArrayPattern() {
+  function f(...[a, b, c]) { return a + b + c; }
+  assertEquals(6, f(1, 2, 3));
+  assertEquals("123", f(1, "2", 3));
+  assertEquals(NaN, f(1));
+
+  var f2 = (...[a, b, c]) => a + b + c;
+  assertEquals(6, f2(1, 2, 3));
+  assertEquals("123", f2(1, "2", 3));
+  assertEquals(NaN, f2(1));
+})();
+
+(function TestRestObjectPattern() {
+  function f(...{length, 0: firstName, 1: lastName}) {
+    return `Hello ${lastName}, ${firstName}! Called with ${length} args!`;
+  }
+  assertEquals("Hello Ross, Bob! Called with 4 args!", f("Bob", "Ross", 0, 0));
+
+  var f2 = (...{length, 0: firstName, 1: lastName}) =>
+      `Hello ${lastName}, ${firstName}! Called with ${length} args!`;
+  assertEquals("Hello Ross, Bob! Called with 4 args!", f2("Bob", "Ross", 0, 0));
+})();
diff --git a/deps/v8/test/mjsunit/es6/spread-call-new-class.js b/deps/v8/test/mjsunit/es6/spread-call-new-class.js
index fc4770de7c..1fdf25b616 100644
--- a/deps/v8/test/mjsunit/es6/spread-call-new-class.js
+++ b/deps/v8/test/mjsunit/es6/spread-call-new-class.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy --harmony-rest-parameters
+// Flags: --harmony-sloppy
 
 
 (function testConstructClassStrict() {
diff --git a/deps/v8/test/mjsunit/es6/spread-call-super-property.js b/deps/v8/test/mjsunit/es6/spread-call-super-property.js
index b7326294fe..b298a69aa1 100644
--- a/deps/v8/test/mjsunit/es6/spread-call-super-property.js
+++ b/deps/v8/test/mjsunit/es6/spread-call-super-property.js
@@ -2,7 +2,7 @@
 // Use of this source code is governed by a BSD-style license that can be
 // found in the LICENSE file.
 
-// Flags: --harmony-sloppy --harmony-rest-parameters
+// Flags: --harmony-sloppy
 
 (function testCallSuperPropertyStrict() {
   "use strict";
diff --git a/deps/v8/test/mjsunit/es6/string-repeat.js b/deps/v8/test/mjsunit/es6/string-repeat.js
index 15caea14f3..d61aec066c 100644
--- a/deps/v8/test/mjsunit/es6/string-repeat.js
+++ b/deps/v8/test/mjsunit/es6/string-repeat.js
@@ -65,6 +65,12 @@ assertThrows('"a".repeat(Number.POSITIVE_INFINITY)', RangeError);
 assertThrows('"a".repeat(Math.pow(2, 30))', RangeError);
 assertThrows('"a".repeat(Math.pow(2, 40))', RangeError);
 
+// Handling empty strings
+assertThrows('"".repeat(-1)', RangeError);
+assertThrows('"".repeat(Number.POSITIVE_INFINITY)', RangeError);
+assertEquals("", "".repeat(Math.pow(2, 30)));
+assertEquals("", "".repeat(Math.pow(2, 40)));
+
 var myobj = {
   toString: function() {
     return "abc";
diff --git a/deps/v8/test/mjsunit/es6/string-search.js b/deps/v8/test/mjsunit/es6/string-search.js
new file mode 100644
index 0000000000..dc029826ad
--- /dev/null
+++ b/deps/v8/test/mjsunit/es6/string-search.js
@@ -0,0 +1,20 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --harmony-regexp-subclass
+
+var pattern = {};
+pattern[Symbol.search] = function(string) {
+  return string.length;
+};
+// Check object coercible fails.
+assertThrows(() => String.prototype.search.call(null, pattern),
+             TypeError);
+// Override is called.
+assertEquals(5, "abcde".search(pattern));
+// Non-callable override.
+pattern[Symbol.search] = "dumdidum";
+assertThrows(() => "abcde".search(pattern), TypeError);
+
+assertEquals("[Symbol.search]", RegExp.prototype[Symbol.search].name);
diff --git a/deps/v8/test/mjsunit/es6/super.js b/deps/v8/test/mjsunit/es6/super.js
index f93b259fd2..67cb45f590 100644
--- a/deps/v8/test/mjsunit/es6/super.js
+++ b/deps/v8/test/mjsunit/es6/super.js
@@ -3,7 +3,7 @@
 // found in the LICENSE file.
 
 // Flags: --allow-natives-syntax
-// Flags: --harmony-destructuring --harmony-rest-parameters --harmony-sloppy
+// Flags: --harmony-destructuring-bind --harmony-sloppy
 
 (function TestSuperNamedLoads() {
   function Base() { }
diff --git a/deps/v8/test/mjsunit/es6/symbols.js b/deps/v8/test/mjsunit/es6/symbols.js
index 58142cf27f..d502a83681 100644
--- a/deps/v8/test/mjsunit/es6/symbols.js
+++ b/deps/v8/test/mjsunit/es6/symbols.js
@@ -526,3 +526,39 @@ function TestComparison() {
   }
 }
 TestComparison();
+
+
+// Make sure that throws occur in the context of the Symbol function.
+function TestContext() {
+  var r = Realm.create();
+  var rSymbol = Realm.eval(r, "Symbol");
+  var rError = Realm.eval(r, "TypeError");
+
+  function verifier(symbol, error) {
+    try {
+      new symbol();
+    } catch(e) {
+      return e.__proto__ === error.__proto__;
+    }
+    assertTrue(false);  // should never get here.
+  }
+
+  assertTrue(verifier(Symbol, TypeError()));
+  assertTrue(verifier(rSymbol, rError()));
+  assertFalse(verifier(Symbol, rError()));
+  assertFalse(verifier(rSymbol, TypeError()));
+}
+TestContext();
+
+
+function TestStringify(expected, input) {
+  assertEquals(expected, JSON.stringify(input));
+  assertEquals(expected, JSON.stringify(input, null, 0));
+}
+
+TestStringify(undefined, Symbol("a"));
+TestStringify('[{}]', [Object(Symbol())]);
+var symbol_wrapper = Object(Symbol("a"))
+TestStringify('{}', symbol_wrapper);
+symbol_wrapper.a = 1;
+TestStringify('{"a":1}', symbol_wrapper);
diff --git a/deps/v8/test/mjsunit/es6/templates.js b/deps/v8/test/mjsunit/es6/templates.js
index 621b06074e..3c4584d337 100644
--- a/deps/v8/test/mjsunit/es6/templates.js
+++ b/deps/v8/test/mjsunit/es6/templates.js
@@ -697,3 +697,22 @@ var global = this;
   assertArrayEquals(["get0"], log);
   assertArrayEquals([1], tagged);
 })();
+
+
+// Since the first argument to the tag function is always an array,
+// eval calls will always just return that array.
+(function testEvalTagStrict() {
+  "use strict";
+  var f = (x) => eval`a${x}b`;
+  var result = f();
+  assertEquals(["a", "b"], result);
+  assertSame(result, f());
+})();
+
+
+(function testEvalTagSloppy() {
+  var f = (x) => eval`a${x}b`;
+  var result = f();
+  assertEquals(["a", "b"], result);
+  assertSame(result, f());
+})();
diff --git a/deps/v8/test/mjsunit/es6/typed-array-iterator.js b/deps/v8/test/mjsunit/es6/typed-array-iterator.js
index 9903b0abae..0b27625c5c 100644
--- a/deps/v8/test/mjsunit/es6/typed-array-iterator.js
+++ b/deps/v8/test/mjsunit/es6/typed-array-iterator.js
@@ -9,23 +9,22 @@ var constructors = [Uint8Array, Int8Array,
                     Float32Array, Float64Array,
                     Uint8ClampedArray];
 
-function TestTypedArrayPrototype(constructor) {
-  assertTrue(constructor.prototype.hasOwnProperty('entries'));
-  assertTrue(constructor.prototype.hasOwnProperty('values'));
-  assertTrue(constructor.prototype.hasOwnProperty('keys'));
-  assertTrue(constructor.prototype.hasOwnProperty(Symbol.iterator));
-
-  assertFalse(constructor.prototype.propertyIsEnumerable('entries'));
-  assertFalse(constructor.prototype.propertyIsEnumerable('values'));
-  assertFalse(constructor.prototype.propertyIsEnumerable('keys'));
-  assertFalse(constructor.prototype.propertyIsEnumerable(Symbol.iterator));
-
-  assertEquals(Array.prototype.entries, constructor.prototype.entries);
-  assertEquals(Array.prototype[Symbol.iterator], constructor.prototype.values);
-  assertEquals(Array.prototype.keys, constructor.prototype.keys);
-  assertEquals(Array.prototype[Symbol.iterator], constructor.prototype[Symbol.iterator]);
-}
-constructors.forEach(TestTypedArrayPrototype);
+var TypedArrayPrototype = Uint8Array.prototype.__proto__;
+
+assertTrue(TypedArrayPrototype.hasOwnProperty('entries'));
+assertTrue(TypedArrayPrototype.hasOwnProperty('values'));
+assertTrue(TypedArrayPrototype.hasOwnProperty('keys'));
+assertTrue(TypedArrayPrototype.hasOwnProperty(Symbol.iterator));
+
+assertFalse(TypedArrayPrototype.propertyIsEnumerable('entries'));
+assertFalse(TypedArrayPrototype.propertyIsEnumerable('values'));
+assertFalse(TypedArrayPrototype.propertyIsEnumerable('keys'));
+assertFalse(TypedArrayPrototype.propertyIsEnumerable(Symbol.iterator));
+
+assertEquals(Array.prototype.entries, TypedArrayPrototype.entries);
+assertEquals(Array.prototype[Symbol.iterator], TypedArrayPrototype.values);
+assertEquals(Array.prototype.keys, TypedArrayPrototype.keys);
+assertEquals(Array.prototype[Symbol.iterator], TypedArrayPrototype[Symbol.iterator]);
 
 
 function TestTypedArrayValues(constructor) {
diff --git a/deps/v8/test/mjsunit/es6/typedarray-of.js b/deps/v8/test/mjsunit/es6/typedarray-of.js
index cf57615d12..a6df29a0dd 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-of.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-of.js
@@ -4,6 +4,8 @@
 
 // Based on Mozilla Array.of() tests at http://dxr.mozilla.org/mozilla-central/source/js/src/jit-test/tests/collections
 
+'use strict';
+
 var typedArrayConstructors = [
   Uint8Array,
   Int8Array,
@@ -51,28 +53,29 @@ function TestTypedArrayOf(constructor) {
   assertEquals(aux.length, a.length);
   assertArrayEquals(aux, a);
 
-  // %TypedArray%.of can be transplanted to other constructors.
+  // %TypedArray%.of can be called on subclasses of TypedArrays
   var hits = 0;
-  function Bag(length) {
-    assertEquals(arguments.length, 1);
-    assertEquals(length, 2);
-    this.length = length;
-    hits++;
+  class Bag extends constructor {
+    constructor(length) {
+      super(length);
+      assertEquals(arguments.length, 1);
+      assertEquals(length, 2);
+      hits++;
+    }
   }
-  Bag.of = constructor.of;
 
   hits = 0;
-  a = Bag.of("zero", "one");
+  a = Bag.of(5, 6);
   assertEquals(1, hits);
   assertEquals(2, a.length);
-  assertArrayEquals(["zero", "one"], a);
+  assertArrayEquals([5, 6], a);
   assertEquals(Bag.prototype, a.__proto__);
 
   hits = 0;
-  actual = constructor.of.call(Bag, "zero", "one");
+  var actual = constructor.of.call(Bag, 5, 6);
   assertEquals(1, hits);
   assertEquals(2, a.length);
-  assertArrayEquals(["zero", "one"], a);
+  assertArrayEquals([5, 6], a);
   assertEquals(Bag.prototype, a.__proto__);
 
   // %TypedArray%.of does not trigger prototype setters.
@@ -90,26 +93,27 @@ function TestTypedArrayOf(constructor) {
   // invoked.
 
   // Setter on the newly created object.
-  function Pack() {
-    Object.defineProperty(this, "length", {
-      set: function (v) { status = "fail"; }
-    });
+  class Pack extends constructor {
+    constructor(length) {
+      super(length);
+      Object.defineProperty(this, "length", {
+        set: function (v) { status = "fail"; }
+      });
+    }
   }
-  Pack.of = constructor.of;
-  var pack = Pack.of("wolves", "cards", "cigarettes", "lies");
+  var pack = Pack.of(5, 6, 7, 8);
   assertEquals("pass", status);
 
   // when the setter is on the new object's prototype
-  function Bevy() {}
+  class Bevy extends constructor {}
   Object.defineProperty(Bevy.prototype, "length", {
     set: function (v) { status = "fail"; }
   });
-  Bevy.of = constructor.of;
-  var bevy = Bevy.of("quail");
+  var bevy = Bevy.of(3);
   assertEquals("pass", status);
 
   // Check superficial features of %TypedArray%.of.
-  var desc = Object.getOwnPropertyDescriptor(constructor, "of");
+  var desc = Object.getOwnPropertyDescriptor(constructor.__proto__, "of");
 
   assertEquals(desc.configurable, false);
   assertEquals(desc.enumerable, false);
diff --git a/deps/v8/test/mjsunit/es6/typedarray-proto.js b/deps/v8/test/mjsunit/es6/typedarray-proto.js
index 558cb0ad7a..346b2ea63d 100644
--- a/deps/v8/test/mjsunit/es6/typedarray-proto.js
+++ b/deps/v8/test/mjsunit/es6/typedarray-proto.js
@@ -4,12 +4,10 @@
 
 // Test that the methods for different TypedArray types have the same
 // identity.
-// TODO(dehrenberg): Test that the TypedArray proto hierarchy is set
-// up properly.
-// TODO(dehrenberg): subarray is currently left out because that still
-// uses per-type methods. When that's fixed, stop leaving it out.
 
-var typedArrayConstructors = [
+'use strict';
+
+let typedArrayConstructors = [
   Uint8Array,
   Int8Array,
   Uint16Array,
@@ -20,23 +18,57 @@ var typedArrayConstructors = [
   Float32Array,
   Float64Array];
 
+let TypedArray = Uint8Array.__proto__;
+let TypedArrayPrototype = TypedArray.prototype;
+
+assertEquals(TypedArray.__proto__, Function.prototype);
+assertEquals(TypedArrayPrototype.__proto__, Object.prototype);
+
+// There are extra own class properties due to it simply being a function
+let classProperties = new Set([
+  "length", "name", "arguments", "caller", "prototype", "BYTES_PER_ELEMENT"
+]);
+let instanceProperties = new Set([
+  "BYTES_PER_ELEMENT", "constructor", "prototype",
+  // length is also an instance property as a temporary workaround to
+  // BUG(chromium:579905). TODO(littledan): remove the workaround
+  "length"
+]);
+
 function functionProperties(object) {
   return Object.getOwnPropertyNames(object).filter(function(name) {
     return typeof Object.getOwnPropertyDescriptor(object, name).value
-        == "function"
-      && name != 'constructor' && name != 'subarray';
+        == "function" && name != 'constructor';
   });
 }
 
-var typedArrayMethods = functionProperties(Uint8Array.prototype);
-var typedArrayClassMethods = functionProperties(Uint8Array);
+let typedArrayMethods = functionProperties(Uint8Array.prototype);
+let typedArrayClassMethods = functionProperties(Uint8Array);
 
-for (var constructor of typedArrayConstructors) {
-  for (var method of typedArrayMethods) {
-    assertEquals(constructor.prototype[method],
-                 Uint8Array.prototype[method], method);
+for (let constructor of typedArrayConstructors) {
+  for (let property of Object.getOwnPropertyNames(constructor.prototype)) {
+    assertTrue(instanceProperties.has(property), property);
   }
-  for (var classMethod of typedArrayClassMethods) {
-    assertEquals(constructor[method], Uint8Array[method], classMethod);
+  for (let property of Object.getOwnPropertyNames(constructor)) {
+    assertTrue(classProperties.has(property), property);
   }
 }
+
+// Abstract %TypedArray% class can't be constructed directly
+
+assertThrows(() => new TypedArray(), TypeError);
+
+// The "prototype" property is nonconfigurable, nonenumerable, nonwritable,
+// both for %TypedArray% and for all subclasses
+
+let desc = Object.getOwnPropertyDescriptor(TypedArray, "prototype");
+assertFalse(desc.writable);
+assertFalse(desc.configurable);
+assertFalse(desc.enumerable);
+
+for (let constructor of typedArrayConstructors) {
+  let desc = Object.getOwnPropertyDescriptor(constructor, "prototype");
+  assertFalse(desc.writable);
+  assertFalse(desc.configurable);
+  assertFalse(desc.enumerable);
+}
diff --git a/deps/v8/test/mjsunit/es6/typedarray.js b/deps/v8/test/mjsunit/es6/typedarray.js
index a45b6308f3..c43ba1c4bf 100644
--- a/deps/v8/test/mjsunit/es6/typedarray.js
+++ b/deps/v8/test/mjsunit/es6/typedarray.js
@@ -270,7 +270,7 @@ function TestTypedArray(constr, elementSize, typicalElement) {
   assertEquals("[object " + constr.name + "]",
       Object.prototype.toString.call(a));
   var desc = Object.getOwnPropertyDescriptor(
-      constr.prototype, Symbol.toStringTag);
+      constr.prototype.__proto__, Symbol.toStringTag);
   assertTrue(desc.configurable);
   assertFalse(desc.enumerable);
   assertFalse(!!desc.writable);
@@ -418,17 +418,13 @@ var typedArrayConstructors = [
 function TestPropertyTypeChecks(constructor) {
   function CheckProperty(name) {
     assertThrows(function() { 'use strict'; new constructor(10)[name] = 0; })
-    var d = Object.getOwnPropertyDescriptor(constructor.prototype, name);
+    var d = Object.getOwnPropertyDescriptor(constructor.prototype.__proto__, name);
     var o = {};
     assertThrows(function() {d.get.call(o);}, TypeError);
     for (var i = 0; i < typedArrayConstructors.length; i++) {
       var ctor = typedArrayConstructors[i];
       var a = new ctor(10);
-      if (ctor === constructor) {
-        d.get.call(a); // shouldn't throw
-      } else {
-        assertThrows(function() {d.get.call(a);}, TypeError);
-      }
+      d.get.call(a); // shouldn't throw
     }
   }