diff --git a/implementation-contributed/curation_logs/v8.json b/implementation-contributed/curation_logs/v8.json
index 68cd5372d59a25ccc538f4c1c8ab4cd5ecf9c883..ed16970ee5e549140f183e9935c3db89129518db 100644
--- a/implementation-contributed/curation_logs/v8.json
+++ b/implementation-contributed/curation_logs/v8.json
@@ -1,5 +1,5 @@
{
- "sourceRevisionAtLastExport": "9f893284",
- "targetRevisionAtLastExport": "234933fe8a",
+ "sourceRevisionAtLastExport": "4dc8ce93",
+ "targetRevisionAtLastExport": "25f3532881",
"curatedFiles": {}
}
\ No newline at end of file
diff --git a/implementation-contributed/v8/mjsunit/code-coverage-block.js b/implementation-contributed/v8/mjsunit/code-coverage-block.js
index 61ed87fc13e15442fd2a7175fcf6a42f81280a48..8cbb2969f7d050f325a805f31546dc70376d32f6 100644
--- a/implementation-contributed/v8/mjsunit/code-coverage-block.js
+++ b/implementation-contributed/v8/mjsunit/code-coverage-block.js
@@ -471,7 +471,7 @@ TestCoverage(
{"start":472,"end":503,"count":0},
{"start":626,"end":653,"count":0},
{"start":768,"end":803,"count":0},
- {"start":867,"end":868,"count":0}]
+ {"start":867,"end":869,"count":0}]
);
TestCoverage(
@@ -850,4 +850,46 @@ Util.escape("foo.bar"); // 0400
{"start":268,"end":350,"count":0}]
);
+TestCoverage(
+"https://crbug.com/v8/8237",
+`
+!function() { // 0000
+ if (true) // 0050
+ while (false) return; else nop(); // 0100
+}(); // 0150
+!function() { // 0200
+ if (true) l0: { break l0; } else // 0250
+ if (nop()) { } // 0300
+}(); // 0350
+!function() { // 0400
+ if (true) { if (false) { return; } // 0450
+ } else if (nop()) { } }(); // 0500
+!function(){ // 0550
+ if(true)while(false)return;else nop() // 0600
+}(); // 0650
+!function(){ // 0700
+ if(true) l0:{break l0}else if (nop()){} // 0750
+}(); // 0800
+!function(){ // 0850
+ if(true){if(false){return}}else // 0900
+ if(nop()){} // 0950
+}(); // 1000
+`,
+[{"start":0,"end":1049,"count":1},
+ {"start":1,"end":151,"count":1},
+ {"start":118,"end":137,"count":0},
+ {"start":201,"end":351,"count":1},
+ {"start":277,"end":318,"count":0},
+ {"start":401,"end":525,"count":1},
+ {"start":475,"end":486,"count":0},
+ {"start":503,"end":523,"count":0},
+ {"start":551,"end":651,"count":1},
+ {"start":622,"end":639,"count":0},
+ {"start":701,"end":801,"count":1},
+ {"start":773,"end":791,"count":0},
+ {"start":851,"end":1001,"count":1},
+ {"start":920,"end":928,"count":0},
+ {"start":929,"end":965,"count":0}]
+);
+
%DebugToggleBlockCoverage(false);
diff --git a/implementation-contributed/v8/mjsunit/compiler/lazy-deopt-async-function-resolve.js b/implementation-contributed/v8/mjsunit/compiler/lazy-deopt-async-function-resolve.js
new file mode 100644
index 0000000000000000000000000000000000000000..faa5e632391d95bba17435f397ffd1cc609f8ebe
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/compiler/lazy-deopt-async-function-resolve.js
@@ -0,0 +1,27 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test that the lazy deoptimization point for JSAsyncFunctionResolve
+// works correctly, aka that we return the promise and not the result
+// of the JSResolvePromise operation.
+(function() {
+ async function foo(x) {
+ return x;
+ }
+
+ assertPromiseResult((async () => {
+ await foo(1);
+ await foo(2);
+ %OptimizeFunctionOnNextCall(foo);
+ const p = new Proxy({}, {
+ get(...args) {
+ %DeoptimizeFunction(foo);
+ return Reflect.get(...args);
+ }
+ });
+ assertEquals(p, await foo(p));
+ })());
+})();
diff --git a/implementation-contributed/v8/mjsunit/compiler/number-multiply.js b/implementation-contributed/v8/mjsunit/compiler/number-multiply.js
new file mode 100644
index 0000000000000000000000000000000000000000..5b644974ec0fefef74845f19e886c6b9c180b899
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/compiler/number-multiply.js
@@ -0,0 +1,59 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --opt
+
+// Test the extreme case where -0 is produced by rounding errors.
+(function() {
+ function bar(x) {
+ return 1e-308 * x;
+ }
+ bar(1);
+
+ function foo() {
+ return Object.is(-0, bar(-1e-308));
+ }
+
+ assertTrue(foo());
+ assertTrue(foo());
+ %OptimizeFunctionOnNextCall(foo);
+ assertTrue(foo());
+})();
+
+// Test that multiplication of integer by 0 produces the correct results.
+(function() {
+ function foo(x) {
+ return 0 * Math.round(x);
+ }
+
+ assertEquals(0, foo(0.1));
+ assertEquals(-0, foo(-0.1));
+ assertEquals(NaN, foo(NaN));
+ assertEquals(NaN, foo(Infinity));
+ assertEquals(NaN, foo(-Infinity));
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(0, foo(0.1));
+ assertEquals(-0, foo(-0.1));
+ assertEquals(NaN, foo(NaN));
+ assertEquals(NaN, foo(Infinity));
+ assertEquals(NaN, foo(-Infinity));
+})();
+
+// Test that multiplication properly preserves -0 and NaN, and doesn't
+// cut it short incorrectly.
+(function() {
+ function foo(x, y) {
+ x = Math.sign(x);
+ y = Math.sign(y);
+ return Math.min(x * y, 0);
+ }
+
+ assertEquals(0, foo(1, 0));
+ assertEquals(-0, foo(1, -0));
+ assertEquals(NaN, foo(NaN, -0));
+ %OptimizeFunctionOnNextCall(foo);
+ assertEquals(0, foo(1, 0));
+ assertEquals(-0, foo(1, -0));
+ assertEquals(NaN, foo(NaN, -0));
+})();
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-1.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-1.js
new file mode 100644
index 0000000000000000000000000000000000000000..50d37726a91d24a4054b964e3e7529a92ecb0506
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-1.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+map[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-10.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-10.js
new file mode 100644
index 0000000000000000000000000000000000000000..d8d20ee9ca57bc7a9219cd509442333ecfe0572b
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-10.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %IteratorPrototype%. No more tests should be run after this in
+// the same instance.
+var iterator = map.keys();
+// iterator object --> %MapIteratorPrototype% --> %IteratorPrototype%
+iterator.__proto__.__proto__[Symbol.iterator] =
+ () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-2.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-2.js
new file mode 100644
index 0000000000000000000000000000000000000000..7adf058fb44f42427315ef971e4d2bae2deebc87
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-2.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapPrototype%. No more tests should be run after this in the
+// same instance.
+map.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-3.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-3.js
new file mode 100644
index 0000000000000000000000000000000000000000..ca0dc9cac20a1864bc97eab82a8a010cd551714b
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-3.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map[Symbol.iterator]();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-4.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-4.js
new file mode 100644
index 0000000000000000000000000000000000000000..a43282a69c1b2030c392be876357d0f477f77a01
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-4.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.keys();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-5.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-5.js
new file mode 100644
index 0000000000000000000000000000000000000000..0af32b58ba83743c429cad46f770f092a6d3aaef
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-5.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.values();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-6.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-6.js
new file mode 100644
index 0000000000000000000000000000000000000000..6611e7aca0962178ac10a24482c686046e383917
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-6.js
@@ -0,0 +1,20 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+var iterator = map.values();
+iterator.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-7.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-7.js
new file mode 100644
index 0000000000000000000000000000000000000000..b5a2345bd8b9a9caa466544a2c740d01c2395200
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-7.js
@@ -0,0 +1,22 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.entries();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%MapIteratorProtector());
+assertTrue(%SetIteratorProtector());
+assertEquals([], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-8.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-8.js
new file mode 100644
index 0000000000000000000000000000000000000000..01dacfb72e5a7352539f499939316db1802e4817
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-8.js
@@ -0,0 +1,32 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %MapIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = map.keys();
+iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/map-iterator-9.js b/implementation-contributed/v8/mjsunit/es6/map-iterator-9.js
new file mode 100644
index 0000000000000000000000000000000000000000..2db159d80ec8516c43e7f5c35f46320c3e42844f
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/map-iterator-9.js
@@ -0,0 +1,30 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+var iterator = map.keys();
+iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+assertEquals([], [...iterator]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-1.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-1.js
new file mode 100644
index 0000000000000000000000000000000000000000..2e4447de6892775a2b2fb70f6ccb9eb2e76884f8
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-1.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+set[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-10.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-10.js
new file mode 100644
index 0000000000000000000000000000000000000000..ec094d20d0df1564d4f4301ef77029f6105cf561
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-10.js
@@ -0,0 +1,34 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %IteratorPrototype%. No more tests should be run after this in
+// the same instance.
+var iterator = set.keys();
+// iterator object --> %SetIteratorPrototype% --> %IteratorPrototype%
+iterator.__proto__.__proto__[Symbol.iterator] =
+ () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([], [...map.entries()]);
+assertEquals([], [...map.keys()]);
+assertEquals([], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-2.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-2.js
new file mode 100644
index 0000000000000000000000000000000000000000..b1fc6bbfea08b1d6d1d93ab63b93f631994a7cc5
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-2.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetPrototype%. No more tests should be run after this in the
+// same instance.
+set.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-3.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-3.js
new file mode 100644
index 0000000000000000000000000000000000000000..b727f3280ce5f4732da83291ceb1f86dd26745ec
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-3.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set[Symbol.iterator]();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-4.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-4.js
new file mode 100644
index 0000000000000000000000000000000000000000..69a18893e8ca1f67d4beb11337aba8aad18a8ff3
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-4.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.keys();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-5.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-5.js
new file mode 100644
index 0000000000000000000000000000000000000000..ec8a653b69f1d4c1a32190e210a467ba08746f26
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-5.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.values();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-6.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-6.js
new file mode 100644
index 0000000000000000000000000000000000000000..c5a2a7b09dac34c681c98ca992cbc1af563264bf
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-6.js
@@ -0,0 +1,21 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+var iterator = set.values();
+iterator.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([1,2,3], [...set]);
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-7.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-7.js
new file mode 100644
index 0000000000000000000000000000000000000000..a244b1e47f7212f5ac0130e1cb1ae5d91424f699
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-7.js
@@ -0,0 +1,23 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+var set = new Set([1,2,3]);
+
+assertTrue(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.entries();
+iterator.__proto__.next = () => ({done: true});
+
+assertFalse(%SetIteratorProtector());
+assertTrue(%MapIteratorProtector());
+assertEquals([], [...set]);
+assertEquals([], [...set.entries()]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-8.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-8.js
new file mode 100644
index 0000000000000000000000000000000000000000..2328a7b737752cd9380d55ae34938e7d3caafbab
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-8.js
@@ -0,0 +1,31 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+// This changes %SetIteratorPrototype%. No more tests should be run after this
+// in the same instance.
+var iterator = set.keys();
+iterator.__proto__[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([], [...set.keys()]);
+assertEquals([], [...set.values()]);
diff --git a/implementation-contributed/v8/mjsunit/es6/set-iterator-9.js b/implementation-contributed/v8/mjsunit/es6/set-iterator-9.js
new file mode 100644
index 0000000000000000000000000000000000000000..42cbf3077aaf367229ad7834e8882b9e5d253a06
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/es6/set-iterator-9.js
@@ -0,0 +1,31 @@
+
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --no-stress-opt
+
+// This tests the interaction between the MapIterator protector and SetIterator
+// protector.
+
+var map = new Map([[1,2], [2,3], [3,4]]);
+assertTrue(%MapIteratorProtector());
+
+var set = new Set([1,2,3]);
+assertTrue(%SetIteratorProtector());
+
+var iterator = set.keys();
+iterator[Symbol.iterator] = () => ({next: () => ({done: true})});
+
+assertFalse(%MapIteratorProtector());
+assertEquals([[1,2], [2,3], [3,4]], [...map]);
+assertEquals([[1,2], [2,3], [3,4]], [...map.entries()]);
+assertEquals([1,2,3], [...map.keys()]);
+assertEquals([2,3,4], [...map.values()]);
+
+assertFalse(%SetIteratorProtector());
+assertEquals([[1,1],[2,2],[3,3]], [...set.entries()]);
+assertEquals([1,2,3], [...set]);
+assertEquals([1,2,3], [...set.keys()]);
+assertEquals([1,2,3], [...set.values()]);
+assertEquals([], [...iterator]);
diff --git a/implementation-contributed/v8/mjsunit/harmony/modules-import-17.js b/implementation-contributed/v8/mjsunit/harmony/modules-import-17.js
new file mode 100644
index 0000000000000000000000000000000000000000..f73aa68f3bb41f4351de12e6e94f19474677b85c
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/modules-import-17.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony-namespace-exports
+
+var ns;
+import('modules-skip-13.js').then(x => ns = x);
+%RunMicrotasks();
+assertEquals(42, ns.default);
+assertEquals(ns, ns.self);
diff --git a/implementation-contributed/v8/mjsunit/harmony/modules-skip-13.js b/implementation-contributed/v8/mjsunit/harmony/modules-skip-13.js
new file mode 100644
index 0000000000000000000000000000000000000000..d823a283f8e2c37d5680bdcadd18a3bce8b3cc75
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/harmony/modules-skip-13.js
@@ -0,0 +1,6 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * as self from "./modules-skip-13.js";
+export default 42;
diff --git a/implementation-contributed/v8/mjsunit/mjsunit.status b/implementation-contributed/v8/mjsunit/mjsunit.status
index 7200f41ac6d592f58a4ee3bce0b4115bb819de5d..7f564ffe0160c5ff21a323854a5618d71171d60b 100644
--- a/implementation-contributed/v8/mjsunit/mjsunit.status
+++ b/implementation-contributed/v8/mjsunit/mjsunit.status
@@ -467,6 +467,9 @@
'regress/wasm/regress-694433': [SKIP],
'es6/typedarray': [PASS, NO_VARIANTS],
'regress/regress-752764': [PASS, NO_VARIANTS],
+
+ # BUG(v8:8294). Started flaking from seemingly unrelated commits, investigating.
+ 'object-seal': [SKIP],
}], # 'tsan == True'
##############################################################################
@@ -796,6 +799,9 @@
'es6/classes': [PASS, ['tsan', SKIP]],
'regress/regress-1122': [PASS, ['tsan', SKIP]],
+ # Too slow with gc_stress on arm64.
+ 'messages': [PASS, ['gc_stress and arch == arm64', SKIP]],
+
# Slow on arm64 simulator: https://crbug.com/v8/7783
'string-replace-gc': [PASS, ['arch == arm64 and simulator_run', SKIP]],
@@ -892,4 +898,44 @@
'wasm/asm-wasm-f64': [SKIP],
}], # arch == x64
+##############################################################################
+['arch == ia32 and embedded_builtins == True', {
+ # TODO(v8:6666): Fix arguments adaptor trampoline
+ 'wasm/compiled-module-serialization': [SKIP],
+ 'asm/embenchen/copy': [SKIP],
+ 'wasm/embenchen/corrections': [SKIP],
+ 'asm/embenchen/primes': [SKIP],
+ 'asm/embenchen/corrections': [SKIP],
+ 'wasm/embenchen/copy': [SKIP],
+ 'asm/embenchen/fannkuch': [SKIP],
+ 'asm/embenchen/memops': [SKIP],
+ 'asm/embenchen/fasta': [SKIP],
+ 'wasm/embenchen/fannkuch': [SKIP],
+ 'asm/embenchen/zlib': [SKIP],
+ 'wasm/embenchen/fasta': [SKIP],
+ 'wasm/embenchen/primes': [SKIP],
+ 'wasm/embenchen/box2d': [SKIP],
+ 'asm/embenchen/box2d': [SKIP],
+ 'wasm/embenchen/memops': [SKIP],
+ 'wasm/embenchen/zlib': [SKIP],
+ 'asm/embenchen/lua_binarytrees': [SKIP],
+ 'wasm/embenchen/lua_binarytrees': [SKIP],
+ 'asm/sqlite3/sqlite': [SKIP],
+ 'asm/sqlite3/sqlite-safe-heap': [SKIP],
+ 'asm/sqlite3/sqlite-pointer-masking': [SKIP],
+ 'asm/poppler/poppler': [SKIP],
+ 'regress/wasm/regress-808848': [SKIP],
+ 'regress/wasm/regress-834624': [SKIP],
+ 'regress/wasm/regress-843563': [SKIP],
+ 'wasm/anyref': [SKIP],
+ 'wasm/exceptions-shared': [SKIP],
+ 'wasm/errors': [SKIP],
+ 'wasm/ffi-error': [SKIP],
+ 'wasm/gc-frame': [SKIP],
+ 'wasm/import-function': [SKIP],
+ 'wasm/ffi': [SKIP],
+ 'wasm/test-wasm-module-builder': [SKIP],
+ 'wasm/stackwalk': [SKIP],
+}], # arch == ia32 and embedded_builtins == True
+
]
diff --git a/implementation-contributed/v8/mjsunit/modules-export-star-as1.js b/implementation-contributed/v8/mjsunit/modules-export-star-as1.js
new file mode 100644
index 0000000000000000000000000000000000000000..1696c1c84dee1567b44cd342d57541150c39781b
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-export-star-as1.js
@@ -0,0 +1,10 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+import {foo} from "./modules-skip-8.js";
+assertEquals(42, foo.default);
+assertEquals(1, foo.get_a());
diff --git a/implementation-contributed/v8/mjsunit/modules-export-star-as2.js b/implementation-contributed/v8/mjsunit/modules-export-star-as2.js
new file mode 100644
index 0000000000000000000000000000000000000000..57828ebd6706f03dd637643c5fd2c437e9124f94
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-export-star-as2.js
@@ -0,0 +1,19 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+export * as self from "./modules-export-star-as2.js";
+export * as self_again from "./modules-export-star-as2.js";
+import {self as myself} from "./modules-export-star-as2.js";
+import {self_again as myself_again} from "./modules-export-star-as2.js";
+
+assertEquals(["self", "self_again"], Object.keys(myself));
+assertEquals(myself, myself.self);
+assertEquals(myself_again, myself.self_again);
+assertEquals(myself, myself_again);
+
+assertThrows(_ => self, ReferenceError);
+assertThrows(_ => self_again, ReferenceError);
diff --git a/implementation-contributed/v8/mjsunit/modules-export-star-as3.js b/implementation-contributed/v8/mjsunit/modules-export-star-as3.js
new file mode 100644
index 0000000000000000000000000000000000000000..4077cbd9c6097098bd17b60a92ce1bd8832d019a
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-export-star-as3.js
@@ -0,0 +1,15 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+let self = 42;
+export * as self from "./modules-export-star-as3.js";
+import {self as myself} from "./modules-export-star-as3.js";
+assertEquals(["self"], Object.keys(myself));
+assertEquals(myself, myself.self);
+assertEquals(42, self);
+self++;
+assertEquals(43, self);
diff --git a/implementation-contributed/v8/mjsunit/modules-imports8.js b/implementation-contributed/v8/mjsunit/modules-imports8.js
new file mode 100644
index 0000000000000000000000000000000000000000..56ea60f4c36f397ded50a247ed0208db8b899475
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-imports8.js
@@ -0,0 +1,11 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// MODULE
+// Flags: --harmony-namespace-exports
+
+import {a, b} from "./modules-skip-9.js";
+assertSame(a, b);
+assertEquals(42, a.default);
+assertEquals(1, a.a);
diff --git a/implementation-contributed/v8/mjsunit/modules-skip-8.js b/implementation-contributed/v8/mjsunit/modules-skip-8.js
new file mode 100644
index 0000000000000000000000000000000000000000..376788e283b3eb8217e0d89ed24282df7aaa4402
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-skip-8.js
@@ -0,0 +1,5 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+export * as foo from "./modules-skip-1.js";
diff --git a/implementation-contributed/v8/mjsunit/modules-skip-9.js b/implementation-contributed/v8/mjsunit/modules-skip-9.js
new file mode 100644
index 0000000000000000000000000000000000000000..c0afcdf99ec1296962e1153aa94bf1127dfe110e
--- /dev/null
+++ b/implementation-contributed/v8/mjsunit/modules-skip-9.js
@@ -0,0 +1,7 @@
+// Copyright 2018 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+import * as b from "./modules-skip-1.js";
+export {b};
+export * as a from "./modules-skip-1.js";
diff --git a/implementation-contributed/v8/mjsunit/regress/regress-8237.js b/implementation-contributed/v8/mjsunit/regress/regress-8237.js
deleted file mode 100644
index c3abd17e8a9646abfcbc85da9a1bade94b4599a3..0000000000000000000000000000000000000000
--- a/implementation-contributed/v8/mjsunit/regress/regress-8237.js
+++ /dev/null
@@ -1,57 +0,0 @@
-// Copyright 2018 the V8 project authors. All rights reserved.
-// Use of this source code is governed by a BSD-style license that can be
-// found in the LICENSE file.
-
-// Flags: --allow-natives-syntax --no-always-opt
-// Files: test/mjsunit/code-coverage-utils.js
-
-%DebugToggleBlockCoverage(true);
-
-TestCoverage(
-"Repro for the bug",
-`
-function lib (n) { // 0000
- if (n >= 0) { // 0050
- if (n < 0) { // 0100
- return; // 0150
- } // 0200
- } else if (foo()) { // 0250
- } // 0300
-} // 0350
-function foo () { // 0400
- console.log('foo') // 0450
- return false // 0500
-} // 0550
-lib(1) // 0600
-`,
-[{"start":0,"end":649,"count":1},
-{"start":0,"end":351,"count":1},
-{"start":115,"end":205,"count":0},
-{"start":253,"end":303,"count":0},
-{"start":400,"end":551,"count":0}]
-);
-
-TestCoverage(
-"Variant with omitted brackets",
-`
-function lib (n) { // 0000
- if (n >= 0) { // 0050
- if (n < 0) // 0100
- return; // 0150
- } // 0200
- else if (foo()); // 0250
-} // 0300
-function foo () { // 0350
- console.log('foo') // 0400
- return false // 0450
-} // 0500
-lib(1) // 0550
-`,
-[{"start":0,"end":599,"count":1},
-{"start":0,"end":301,"count":1},
-{"start":156,"end":163,"count":0},
-{"start":203,"end":268,"count":0},
-{"start":350,"end":501,"count":0}]
-);
-
-%DebugToggleBlockCoverage(false);
diff --git a/implementation-contributed/v8/mjsunit/regress/wasm/regress-739768.js b/implementation-contributed/v8/mjsunit/regress/wasm/regress-739768.js
index bcf3ceeca235d182f1265202a14410f902777eca..52985c3297dd68fb2cb243287a55290922c2e64a 100644
--- a/implementation-contributed/v8/mjsunit/regress/wasm/regress-739768.js
+++ b/implementation-contributed/v8/mjsunit/regress/wasm/regress-739768.js
@@ -16,7 +16,7 @@ builder0.addFunction('main', kSig_i_i)
kExprCallIndirect, sig_index, kTableZero
]) // --
.exportAs('main');
-builder0.setFunctionTableBounds(3, 3);
+builder0.setTableBounds(3, 3);
builder0.addExportOfKind('table', kExternalTable);
let module0 = new WebAssembly.Module(builder0.toBuffer());
let instance0 = new WebAssembly.Instance(module0);
@@ -25,7 +25,7 @@ let builder1 = new WasmModuleBuilder();
builder1.setName('module_1');
builder1.addFunction('main', kSig_i_v).addBody([kExprUnreachable]);
builder1.addImportedTable('z', 'table');
-builder1.addFunctionTableInit(0, false, [0], true);
+builder1.addElementSegment(0, false, [0], true);
let module1 = new WebAssembly.Module(builder1.toBuffer());
let instance1 =
new WebAssembly.Instance(module1, {z: {table: instance0.exports.table}});
diff --git a/implementation-contributed/v8/mjsunit/regress/wasm/regress-803788.js b/implementation-contributed/v8/mjsunit/regress/wasm/regress-803788.js
index 8edec7c4645acaaeadaf9d2a356771e8a016db17..e7fa3aaa8fbc70f350161c2ae3302813007ae9c6 100644
--- a/implementation-contributed/v8/mjsunit/regress/wasm/regress-803788.js
+++ b/implementation-contributed/v8/mjsunit/regress/wasm/regress-803788.js
@@ -12,7 +12,7 @@ let q_table = builder.addImportedTable("q", "table")
let q_base = builder.addImportedGlobal("q", "base", kWasmI32);
let q_fun = builder.addImport("q", "fun", kSig_v_v);
builder.addType(kSig_i_ii);
-builder.addFunctionTableInit(q_base, true, [ q_fun ])
+builder.addElementSegment(q_base, true, [ q_fun ])
let module = new WebAssembly.Module(builder.toBuffer());
let table = new WebAssembly.Table({
element: "anyfunc",
diff --git a/implementation-contributed/v8/mjsunit/regress/wasm/regress-808980.js b/implementation-contributed/v8/mjsunit/regress/wasm/regress-808980.js
index 884572b895521d471a6f4ea9fa7a632606558080..ecf6476c372fb6a21464365033cb938520d6f4e7 100644
--- a/implementation-contributed/v8/mjsunit/regress/wasm/regress-808980.js
+++ b/implementation-contributed/v8/mjsunit/regress/wasm/regress-808980.js
@@ -17,7 +17,7 @@ builder.addFunction('main', kSig_i_ii).addBody([
sig_index1,
kTableZero
]).exportAs('main');
-builder.setFunctionTableBounds(kTableSize, kTableSize);
+builder.setTableBounds(kTableSize, kTableSize);
var m1_bytes = builder.toBuffer();
var m1 = new WebAssembly.Module(m1_bytes);
diff --git a/implementation-contributed/v8/mjsunit/regress/wasm/regress-817380.js b/implementation-contributed/v8/mjsunit/regress/wasm/regress-817380.js
index e6047ea231430233e01db995ed8ebb1b3d7814aa..2cf50892fc39701f1dcee26b8f85afd88bb8268f 100644
--- a/implementation-contributed/v8/mjsunit/regress/wasm/regress-817380.js
+++ b/implementation-contributed/v8/mjsunit/regress/wasm/regress-817380.js
@@ -20,6 +20,6 @@ const builder2 = new WasmModuleBuilder();
const mul_import = builder2.addImport('q', 'wasm_mul', kSig_i_ii);
builder2.addImportedTable('q', 'table');
const glob_import = builder2.addImportedGlobal('q', 'glob', kWasmI32);
-builder2.addFunctionTableInit(glob_import, true, [mul_import]);
+builder2.addElementSegment(glob_import, true, [mul_import]);
builder2.instantiate(
{q: {glob: 0, js_div: i => i, wasm_mul: mul, table: table}});
diff --git a/implementation-contributed/v8/mjsunit/regress/wasm/regress-834619.js b/implementation-contributed/v8/mjsunit/regress/wasm/regress-834619.js
index 5ddc9dd9c4d266d0adb9f8bd40053c51897343b2..378e38e03cf6d785ce1bc6f7455d70d2515c2aff 100644
--- a/implementation-contributed/v8/mjsunit/regress/wasm/regress-834619.js
+++ b/implementation-contributed/v8/mjsunit/regress/wasm/regress-834619.js
@@ -33,7 +33,7 @@ load("test/mjsunit/wasm/wasm-module-builder.js");
kExprCallIndirect, 0, kTableZero
])
.exportFunc();
- builder.addFunctionTableInit(0, false, [0, 1, 1, 0]);
+ builder.addElementSegment(0, false, [0, 1, 1, 0]);
return builder.instantiate({q: {f2: i1.exports.f2, f1: i1.exports.f1}});
})();
diff --git a/implementation-contributed/v8/test262/testcfg.py b/implementation-contributed/v8/test262/testcfg.py
index 105f6713f28106a1b8c20b86b38c1af4cb79e727..5c74cb734f8f2696f9d381374bd4f0cc35e11097 100644
--- a/implementation-contributed/v8/test262/testcfg.py
+++ b/implementation-contributed/v8/test262/testcfg.py
@@ -56,10 +56,10 @@ FEATURE_FLAGS = {
'Symbol.prototype.description': '--harmony-symbol-description',
'globalThis': '--harmony-global',
'well-formed-json-stringify': '--harmony-json-stringify',
+ 'export-star-as-namespace-from-module': '--harmony-namespace-exports',
}
SKIPPED_FEATURES = set(['Object.fromEntries',
- 'export-star-as-namespace-from-module',
'class-fields-private',
'class-static-fields-private',
'class-methods-private',