diff --git a/implementation-contributed/javascriptcore/stress/array-prototype-concat-of-long-spliced-arrays.js b/implementation-contributed/javascriptcore/stress/array-prototype-concat-of-long-spliced-arrays.js
new file mode 100644
index 0000000000000000000000000000000000000000..9f889923b4695b09c0ac438cc86e96497f2c8b93
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-prototype-concat-of-long-spliced-arrays.js
@@ -0,0 +1,36 @@
+function shouldEqual(actual, expected) {
+    if (actual != expected) {
+        throw "ERROR: expect " + expected + ", actual " + actual;
+    }
+}
+
+function test() {
+    var exception;
+    try {
+        var a = [];
+        a.length = 0x1fff00;
+
+        var b = a.splice(0, 0x100000); // Undecided array
+
+        var args = [];
+        args.length = 4094;
+        args.fill(b);
+
+        var q = [];
+        q.length = 0x1000;
+        q.fill(7);
+
+        var c = a.splice(0, 0xfffef); //Shorter undecided array
+
+        args[4094] = c;
+        args[4095] = q;
+
+        b.concat.apply(b, args);
+    } catch (e) {
+        exception = e;
+    }
+
+    shouldEqual(exception, "RangeError: Length exceeded the maximum array length");
+}
+
+test();
diff --git a/implementation-contributed/javascriptcore/stress/array-prototype-concat-of-long-spliced-arrays2.js b/implementation-contributed/javascriptcore/stress/array-prototype-concat-of-long-spliced-arrays2.js
new file mode 100644
index 0000000000000000000000000000000000000000..425baabd3452c375cc7e1ab1f8a70e5a62a30bfe
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/array-prototype-concat-of-long-spliced-arrays2.js
@@ -0,0 +1,26 @@
+function shouldEqual(actual, expected) {
+    if (actual != expected) {
+        throw "ERROR: expect " + expected + ", actual " + actual;
+    }
+}
+
+function test() {
+    var exception;
+    try {
+        var a = [];
+        a.length = 0x1fff00;
+
+        var b = a.splice(0, 0x100000); // Undecided array
+
+        var args = [];
+        args.length = 4096;
+        args.fill(b);
+
+        b.concat.apply(b, args);
+    } catch (e) {
+        exception = e;
+    }
+    shouldEqual(exception, "RangeError: Length exceeded the maximum array length");
+}
+
+test();
diff --git a/implementation-contributed/javascriptcore/stress/double-to-int32-NaN.js b/implementation-contributed/javascriptcore/stress/double-to-int32-NaN.js
new file mode 100644
index 0000000000000000000000000000000000000000..6d8af390f6ce7411bfa7d3b0d78a0eb48cf3ac51
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/double-to-int32-NaN.js
@@ -0,0 +1,22 @@
+function assert(b) {
+    if (!b)
+        throw new Error;
+}
+
+function foo(view) {
+    let x = view.getFloat64(0);
+    return [x, x | 0];
+}
+noInline(foo);
+
+let buffer = new ArrayBuffer(8);
+let view = new DataView(buffer);
+for (let i = 0; i < 1000000; ++i) {
+    for (let i = 0; i < 8; ++i) {
+        view.setInt8(i, Math.random() * 255);
+    }
+
+    let [a, b] = foo(view);
+    if (isNaN(a))
+        assert(b === 0);
+}
diff --git a/implementation-contributed/javascriptcore/stress/function-cache-with-parameters-end-position.js b/implementation-contributed/javascriptcore/stress/function-cache-with-parameters-end-position.js
deleted file mode 100644
index b0ff2214d0f9427acdf3030d1a4c9d7e7b920fa4..0000000000000000000000000000000000000000
--- a/implementation-contributed/javascriptcore/stress/function-cache-with-parameters-end-position.js
+++ /dev/null
@@ -1,40 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-
-function shouldThrow(func, errorMessage) {
-    var errorThrown = false;
-    var error = null;
-    try {
-        func();
-    } catch (e) {
-        errorThrown = true;
-        error = e;
-    }
-    if (!errorThrown)
-        throw new Error('not thrown');
-    if (String(error) !== errorMessage)
-        throw new Error(`bad error: ${String(error)}`);
-}
-
-for (var i = 0; i < 10; ++i) {
-    var f = Function('/*) {\n*/', 'return 42');
-    shouldBe(f.toString(),
-`function anonymous(/*) {
-*/) {
-return 42
-}`);
-}
-shouldThrow(() => Function('/*', '*/){\nreturn 42'), `SyntaxError: Parameters should match arguments offered as parameters in Function constructor.`);
-
-shouldThrow(() => Function('/*', '*/){\nreturn 43'), `SyntaxError: Parameters should match arguments offered as parameters in Function constructor.`);
-for (var i = 0; i < 10; ++i) {
-    var f = Function('/*) {\n*/', 'return 43');
-    shouldBe(f.toString(),
-`function anonymous(/*) {
-*/) {
-return 43
-}`);
-}
-
diff --git a/implementation-contributed/javascriptcore/stress/function-constructor-name.js b/implementation-contributed/javascriptcore/stress/function-constructor-name.js
deleted file mode 100644
index bf7e9459ca50fc96423f9b877a82d9b41fef38fa..0000000000000000000000000000000000000000
--- a/implementation-contributed/javascriptcore/stress/function-constructor-name.js
+++ /dev/null
@@ -1,36 +0,0 @@
-function shouldBe(actual, expected) {
-    if (actual !== expected)
-        throw new Error('bad value: ' + actual);
-}
-
-var GeneratorFunction = function*(){}.constructor;
-var AsyncFunction = async function(){}.constructor;
-var AsyncGeneratorFunction = async function*(){}.constructor;
-
-var f = Function(`return 42`);
-shouldBe(typeof anonymous, `undefined`);
-shouldBe(f.toString(),
-`function anonymous() {
-return 42
-}`);
-
-var gf = GeneratorFunction(`return 42`);
-shouldBe(typeof anonymous, `undefined`);
-shouldBe(gf.toString(),
-`function* anonymous() {
-return 42
-}`);
-
-var af = AsyncFunction(`return 42`);
-shouldBe(typeof anonymous, `undefined`);
-shouldBe(af.toString(),
-`async function anonymous() {
-return 42
-}`);
-
-var agf = AsyncGeneratorFunction(`return 42`);
-shouldBe(typeof anonymous, `undefined`);
-shouldBe(agf.toString(),
-`async function* anonymous() {
-return 42
-}`);
diff --git a/implementation-contributed/javascriptcore/stress/slice-array-storage-with-holes.js b/implementation-contributed/javascriptcore/stress/slice-array-storage-with-holes.js
new file mode 100644
index 0000000000000000000000000000000000000000..3d322fa417fd0de1b3cafebc69e732d3fb3c7533
--- /dev/null
+++ b/implementation-contributed/javascriptcore/stress/slice-array-storage-with-holes.js
@@ -0,0 +1,11 @@
+function main() {
+    let arr = [1];
+
+    arr.length = 0x100000;
+    arr.splice(0, 0x11);
+
+    arr.length = 0xfffffff0;
+    arr.splice(0xfffffff0, 0, 1);
+}
+
+main();