diff --git a/runtime/bin/dartutils.cc b/runtime/bin/dartutils.cc
index 657a457..1c1277b 100644
--- a/runtime/bin/dartutils.cc
+++ b/runtime/bin/dartutils.cc
@@ -10,12 +10,13 @@
 #include "platform/assert.h"
 #include "platform/globals.h"
 
-#include "bin/extensions.h"
+#include "bin/crypto.h"
 #include "bin/directory.h"
+#include "bin/extensions.h"
 #include "bin/file.h"
 #include "bin/io_buffer.h"
-#include "bin/utils.h"
 #include "bin/socket.h"
+#include "bin/utils.h"
 
 namespace dart {
 namespace bin {
@@ -243,6 +244,11 @@
 }
 
 
+bool DartUtils::EntropySource(uint8_t* buffer, intptr_t length) {
+  return Crypto::GetRandomBytes(length, buffer);
+}
+
+
 static Dart_Handle SingleArgDart_Invoke(Dart_Handle lib, const char* method,
                                         Dart_Handle arg) {
   const int kNumArgs = 1;
diff --git a/runtime/bin/dartutils.h b/runtime/bin/dartutils.h
index 375a9bc..476d813 100644
--- a/runtime/bin/dartutils.h
+++ b/runtime/bin/dartutils.h
@@ -115,6 +115,8 @@
   static void ReadFile(const uint8_t** data, intptr_t* file_len, void* stream);
   static void WriteFile(const void* buffer, intptr_t num_bytes, void* stream);
   static void CloseFile(void* stream);
+  static bool EntropySource(uint8_t* buffer, intptr_t length);
+
   static Dart_Handle ReadStringFromFile(const char* filename);
   static Dart_Handle ReadStringFromHttp(const char* filename);
   static Dart_Handle LibraryTagHandler(Dart_LibraryTag tag,
diff --git a/runtime/bin/gen_snapshot.cc b/runtime/bin/gen_snapshot.cc
index 2da2778..e502a0b 100644
--- a/runtime/bin/gen_snapshot.cc
+++ b/runtime/bin/gen_snapshot.cc
@@ -499,7 +499,8 @@
                        DartUtils::OpenFile,
                        DartUtils::ReadFile,
                        DartUtils::WriteFile,
-                       DartUtils::CloseFile)) {
+                       DartUtils::CloseFile,
+                       DartUtils::EntropySource)) {
     Log::PrintErr("VM initialization failed\n");
     return 255;
   }
diff --git a/runtime/bin/io_impl_sources.gypi b/runtime/bin/io_impl_sources.gypi
index 8887d10..d026609 100644
--- a/runtime/bin/io_impl_sources.gypi
+++ b/runtime/bin/io_impl_sources.gypi
@@ -7,6 +7,7 @@
 {
   'sources': [
     'crypto.cc',
+    'crypto.h',
     'crypto_android.cc',
     'crypto_linux.cc',
     'crypto_macos.cc',
diff --git a/runtime/bin/main.cc b/runtime/bin/main.cc
index 62af0f3..c696a9d 100644
--- a/runtime/bin/main.cc
+++ b/runtime/bin/main.cc
@@ -823,7 +823,8 @@
                        DartUtils::OpenFile,
                        DartUtils::ReadFile,
                        DartUtils::WriteFile,
-                       DartUtils::CloseFile)) {
+                       DartUtils::CloseFile,
+                       DartUtils::EntropySource)) {
     fprintf(stderr, "%s", "VM initialization failed\n");
     fflush(stderr);
     return kErrorExitCode;
diff --git a/runtime/bin/run_vm_tests.cc b/runtime/bin/run_vm_tests.cc
index 7ff4198..438a2cc 100644
--- a/runtime/bin/run_vm_tests.cc
+++ b/runtime/bin/run_vm_tests.cc
@@ -109,7 +109,8 @@
                                        dart::bin::DartUtils::OpenFile,
                                        dart::bin::DartUtils::ReadFile,
                                        dart::bin::DartUtils::WriteFile,
-                                       dart::bin::DartUtils::CloseFile);
+                                       dart::bin::DartUtils::CloseFile,
+                                       NULL);
   ASSERT(err_msg == NULL);
   // Apply the filter to all registered tests.
   TestCaseBase::RunAll();
diff --git a/runtime/include/dart_api.h b/runtime/include/dart_api.h
index c346ea4..805737c 100755
--- a/runtime/include/dart_api.h
+++ b/runtime/include/dart_api.h
@@ -724,6 +724,7 @@
 
 typedef void (*Dart_FileCloseCallback)(void* stream);
 
+typedef bool (*Dart_EntropySource)(uint8_t* buffer, intptr_t length);
 
 /**
  * Initializes the VM.
@@ -747,7 +748,8 @@
     Dart_FileOpenCallback file_open,
     Dart_FileReadCallback file_read,
     Dart_FileWriteCallback file_write,
-    Dart_FileCloseCallback file_close);
+    Dart_FileCloseCallback file_close,
+    Dart_EntropySource entropy_source);
 
 /**
  * Cleanup state in the VM before process termination.
diff --git a/runtime/lib/math_patch.dart b/runtime/lib/math_patch.dart
index 00cacdf..b1301e9 100644
--- a/runtime/lib/math_patch.dart
+++ b/runtime/lib/math_patch.dart
@@ -113,7 +113,7 @@
   void _nextState() native "Random_nextState";
 
   int nextInt(int max) {
-    // TODO(srdjan): Remove the 'limit' check once optimizing  comparison of
+    // TODO(srdjan): Remove the 'limit' check once optimizing comparison of
     // Smi-s with Mint constants.
     final limit = 0x3FFFFFFF;
     if (max <= 0 || ((max > limit) && (max > _POW2_32))) {
diff --git a/runtime/vm/assembler_ia32.cc b/runtime/vm/assembler_ia32.cc
index 8f6164f..6b6e659 100644
--- a/runtime/vm/assembler_ia32.cc
+++ b/runtime/vm/assembler_ia32.cc
@@ -83,6 +83,15 @@
 };
 
 
+int32_t Assembler::jit_cookie() {
+  if (jit_cookie_ == 0) {
+    jit_cookie_ = static_cast<int32_t>(
+        Isolate::Current()->random()->NextUInt32());
+  }
+  return jit_cookie_;
+}
+
+
 void Assembler::InitializeMemoryWithBreakpoints(uword data, intptr_t length) {
   memset(reinterpret_cast<void*>(data), Instr::kBreakPointInstruction, length);
 }
@@ -1949,9 +1958,9 @@
   if (Assembler::IsSafe(object)) {
     LoadObject(dst, object);
   } else {
-    movl(dst,
-         Immediate(reinterpret_cast<int32_t>(object.raw()) ^ jit_cookie_));
-    xorl(dst, Immediate(jit_cookie_));
+    int32_t cookie = jit_cookie();
+    movl(dst, Immediate(reinterpret_cast<int32_t>(object.raw()) ^ cookie));
+    xorl(dst, Immediate(cookie));
   }
 }
 
diff --git a/runtime/vm/assembler_ia32.h b/runtime/vm/assembler_ia32.h
index ae5a0cd..0afbb0f 100644
--- a/runtime/vm/assembler_ia32.h
+++ b/runtime/vm/assembler_ia32.h
@@ -311,8 +311,8 @@
       : buffer_(),
         object_pool_(GrowableObjectArray::Handle()),
         prologue_offset_(-1),
-        comments_(),
-        jit_cookie_(1017109444) {
+        jit_cookie_(0),
+        comments_() {
     // This mode is only needed and implemented for MIPS and ARM.
     ASSERT(!use_far_branches);
   }
@@ -798,10 +798,6 @@
   }
 
  private:
-  AssemblerBuffer buffer_;
-  GrowableObjectArray& object_pool_;  // Object pool is not used on ia32.
-  intptr_t prologue_offset_;
-
   class CodeComment : public ZoneAllocated {
    public:
     CodeComment(intptr_t pc_offset, const String& comment)
@@ -817,9 +813,6 @@
     DISALLOW_COPY_AND_ASSIGN(CodeComment);
   };
 
-  GrowableArray<CodeComment*> comments_;
-
-  int32_t jit_cookie_;
 
   inline void EmitUint8(uint8_t value);
   inline void EmitInt32(int32_t value);
@@ -845,6 +838,14 @@
                                   Register value,
                                   Label* no_update);
 
+  int32_t jit_cookie();
+
+  AssemblerBuffer buffer_;
+  GrowableObjectArray& object_pool_;  // Object pool is not used on ia32.
+  intptr_t prologue_offset_;
+  int32_t jit_cookie_;
+  GrowableArray<CodeComment*> comments_;
+
   DISALLOW_ALLOCATION();
   DISALLOW_COPY_AND_ASSIGN(Assembler);
 };
diff --git a/runtime/vm/ast.cc b/runtime/vm/ast.cc
index 257fb95..aab3c6b 100644
--- a/runtime/vm/ast.cc
+++ b/runtime/vm/ast.cc
@@ -255,6 +255,17 @@
 
 bool BinaryOpNode::IsPotentiallyConst() const {
   switch (kind_) {
+    case Token::kOR:
+    case Token::kAND:
+      if (this->left()->IsLiteralNode() &&
+          this->left()->AsLiteralNode()->literal().IsNull()) {
+        return false;
+      }
+      if (this->right()->IsLiteralNode() &&
+          this->right()->AsLiteralNode()->literal().IsNull()) {
+        return false;
+      }
+      // Fall-through intentional.
     case Token::kADD:
     case Token::kSUB:
     case Token::kMUL:
@@ -266,8 +277,6 @@
     case Token::kBIT_AND:
     case Token::kSHL:
     case Token::kSHR:
-    case Token::kOR:
-    case Token::kAND:
       return this->left()->IsPotentiallyConst() &&
           this->right()->IsPotentiallyConst();
     default:
@@ -355,6 +364,10 @@
 
 
 bool UnaryOpNode::IsPotentiallyConst() const {
+  if (this->operand()->IsLiteralNode() &&
+      this->operand()->AsLiteralNode()->literal().IsNull()) {
+    return false;
+  }
   return this->operand()->IsPotentiallyConst();
 }
 
diff --git a/runtime/vm/code_generator.cc b/runtime/vm/code_generator.cc
index ae577df..5de912a 100644
--- a/runtime/vm/code_generator.cc
+++ b/runtime/vm/code_generator.cc
@@ -545,6 +545,9 @@
   const SubtypeTestCache& cache =
       SubtypeTestCache::CheckedHandle(arguments.ArgAt(4));
   ASSERT(type.IsFinalized());
+  ASSERT(!type.IsDynamicType());  // No need to check assignment.
+  ASSERT(!type.IsMalformed());  // Already checked in code generator.
+  ASSERT(!type.IsMalbounded());  // Already checked in code generator.
   Error& bound_error = Error::Handle();
   const Bool& result =
       Bool::Get(instance.IsInstanceOf(type,
diff --git a/runtime/vm/dart.cc b/runtime/vm/dart.cc
index e81438f..92bba64 100644
--- a/runtime/vm/dart.cc
+++ b/runtime/vm/dart.cc
@@ -81,12 +81,14 @@
                            Dart_FileOpenCallback file_open,
                            Dart_FileReadCallback file_read,
                            Dart_FileWriteCallback file_write,
-                           Dart_FileCloseCallback file_close) {
+                           Dart_FileCloseCallback file_close,
+                           Dart_EntropySource entropy_source) {
   // TODO(iposva): Fix race condition here.
   if (vm_isolate_ != NULL || !Flags::Initialized()) {
     return "VM already initialized.";
   }
   Isolate::SetFileCallbacks(file_open, file_read, file_write, file_close);
+  Isolate::SetEntropySourceCallback(entropy_source);
   OS::InitOnce();
   VirtualMemory::InitOnce();
   Isolate::InitOnce();
diff --git a/runtime/vm/dart.h b/runtime/vm/dart.h
index edb18ad..135c6b0 100644
--- a/runtime/vm/dart.h
+++ b/runtime/vm/dart.h
@@ -27,7 +27,8 @@
       Dart_FileOpenCallback file_open,
       Dart_FileReadCallback file_read,
       Dart_FileWriteCallback file_write,
-      Dart_FileCloseCallback file_close);
+      Dart_FileCloseCallback file_close,
+      Dart_EntropySource entropy_source);
   static const char* Cleanup();
 
   static Isolate* CreateIsolate(const char* name_prefix);
diff --git a/runtime/vm/dart_api_impl.cc b/runtime/vm/dart_api_impl.cc
index 5faea45..f22df2c 100644
--- a/runtime/vm/dart_api_impl.cc
+++ b/runtime/vm/dart_api_impl.cc
@@ -733,10 +733,11 @@
     Dart_FileOpenCallback file_open,
     Dart_FileReadCallback file_read,
     Dart_FileWriteCallback file_write,
-    Dart_FileCloseCallback file_close) {
+    Dart_FileCloseCallback file_close,
+    Dart_EntropySource entropy_source) {
   const char* err_msg = Dart::InitOnce(create, interrupt, unhandled, shutdown,
                                        file_open, file_read, file_write,
-                                       file_close);
+                                       file_close, entropy_source);
   if (err_msg != NULL) {
     OS::PrintErr("Dart_Initialize: %s\n", err_msg);
     return false;
diff --git a/runtime/vm/flow_graph_type_propagator.cc b/runtime/vm/flow_graph_type_propagator.cc
index 9c4a1f4..d259022 100644
--- a/runtime/vm/flow_graph_type_propagator.cc
+++ b/runtime/vm/flow_graph_type_propagator.cc
@@ -415,18 +415,16 @@
     cid_ = kDynamicCid;
   }
 
-  Error& malformed_error = Error::Handle();
-  if (ToAbstractType()->IsMoreSpecificThan(*other->ToAbstractType(),
-                                           &malformed_error)) {
-    type_ = other->ToAbstractType();
-  } else if (other->ToAbstractType()->IsMoreSpecificThan(*ToAbstractType(),
-                                                         &malformed_error)) {
-    // Nothing to do.
+  const AbstractType* compile_type = ToAbstractType();
+  const AbstractType* other_compile_type = other->ToAbstractType();
+  if (compile_type->IsMoreSpecificThan(*other_compile_type, NULL)) {
+    type_ = other_compile_type;
+  } else if (other_compile_type->IsMoreSpecificThan(*compile_type, NULL)) {
+  // Nothing to do.
   } else {
-    // Can't unify.
-    type_ = &Type::ZoneHandle(Type::DynamicType());
+  // Can't unify.
+  type_ = &Type::ZoneHandle(Type::DynamicType());
   }
-  ASSERT(malformed_error.IsNull());
 }
 
 
@@ -615,14 +613,13 @@
     return false;
   }
 
-  Error& malformed_error = Error::Handle();
-  *is_instance = compile_type.IsMoreSpecificThan(type, &malformed_error);
-  return malformed_error.IsNull() && *is_instance;
+  *is_instance = compile_type.IsMoreSpecificThan(type, NULL);
+  return *is_instance;
 }
 
 
 bool CompileType::IsMoreSpecificThan(const AbstractType& other) {
-  if (IsNone() || other.IsMalformed()) {
+  if (IsNone()) {
     return false;
   }
 
@@ -631,10 +628,7 @@
     return IsNull();
   }
 
-  Error& malformed_error = Error::Handle();
-  const bool is_more_specific =
-      ToAbstractType()->IsMoreSpecificThan(other, &malformed_error);
-  return malformed_error.IsNull() && is_more_specific;
+  return ToAbstractType()->IsMoreSpecificThan(other, NULL);
 }
 
 
diff --git a/runtime/vm/isolate.cc b/runtime/vm/isolate.cc
index 37b6dbe..b89db64 100644
--- a/runtime/vm/isolate.cc
+++ b/runtime/vm/isolate.cc
@@ -290,6 +290,7 @@
       stub_code_(NULL),
       debugger_(NULL),
       single_step_(false),
+      random_(),
       simulator_(NULL),
       long_jump_base_(NULL),
       timer_list_(),
@@ -726,6 +727,7 @@
 Dart_FileReadCallback Isolate::file_read_callback_ = NULL;
 Dart_FileWriteCallback Isolate::file_write_callback_ = NULL;
 Dart_FileCloseCallback Isolate::file_close_callback_ = NULL;
+Dart_EntropySource Isolate::entropy_source_callback_ = NULL;
 Dart_IsolateInterruptCallback Isolate::vmstats_callback_ = NULL;
 
 
diff --git a/runtime/vm/isolate.h b/runtime/vm/isolate.h
index 35e6613..a01638d 100644
--- a/runtime/vm/isolate.h
+++ b/runtime/vm/isolate.h
@@ -13,6 +13,7 @@
 #include "vm/gc_callbacks.h"
 #include "vm/handles.h"
 #include "vm/megamorphic_cache_table.h"
+#include "vm/random.h"
 #include "vm/store_buffer.h"
 #include "vm/timer.h"
 
@@ -273,6 +274,8 @@
     return OFFSET_OF(Isolate, single_step_);
   }
 
+  Random* random() { return &random_; }
+
   Simulator* simulator() const { return simulator_; }
   void set_simulator(Simulator* value) { simulator_ = value; }
 
@@ -343,6 +346,13 @@
     return file_close_callback_;
   }
 
+  static void SetEntropySourceCallback(Dart_EntropySource entropy_source) {
+    entropy_source_callback_ = entropy_source;
+  }
+  static Dart_EntropySource entropy_source_callback() {
+    return entropy_source_callback_;
+  }
+
   void set_object_id_ring(ObjectIdRing* ring) {
     object_id_ring_ = ring;
   }
@@ -388,6 +398,7 @@
   template<class T> T* AllocateReusableHandle();
 
   static ThreadLocalKey isolate_key;
+
   StoreBuffer store_buffer_;
   ClassTable class_table_;
   MegamorphicCacheTable megamorphic_cache_table_;
@@ -406,6 +417,7 @@
   StubCode* stub_code_;
   Debugger* debugger_;
   bool single_step_;
+  Random random_;
   Simulator* simulator_;
   LongJump* long_jump_base_;
   TimerList timer_list_;
@@ -445,6 +457,7 @@
   static Dart_FileReadCallback file_read_callback_;
   static Dart_FileWriteCallback file_write_callback_;
   static Dart_FileCloseCallback file_close_callback_;
+  static Dart_EntropySource entropy_source_callback_;
   static Dart_IsolateInterruptCallback vmstats_callback_;
 
   friend class ReusableHandleScope;
diff --git a/runtime/vm/object.cc b/runtime/vm/object.cc
index b097151..8ba182a 100644
--- a/runtime/vm/object.cc
+++ b/runtime/vm/object.cc
@@ -11461,8 +11461,13 @@
                             Error* bound_error) const {
   ASSERT(IsResolved());
   ASSERT(other.IsResolved());
-  ASSERT(!IsMalformed());
-  ASSERT(!other.IsMalformed());
+  if (IsMalformed() || other.IsMalformed()) {
+    // Malformed types involved in subtype tests should be handled specially
+    // by the caller. Malformed types should only be encountered here in a
+    // more specific than test.
+    ASSERT(test_kind == kIsMoreSpecificThan);
+    return false;
+  }
   // In case the type checked in a type test is malbounded, the code generator
   // may compile a throw instead of a run time call performing the type check.
   // However, in checked mode, a function type may include malbounded result
diff --git a/runtime/vm/parser.cc b/runtime/vm/parser.cc
index bf8ccaa..0fff78e 100644
--- a/runtime/vm/parser.cc
+++ b/runtime/vm/parser.cc
@@ -6932,9 +6932,12 @@
     SequenceNode* catch_handler = CloseBlock();
     ExpectToken(Token::kRBRACE);
 
-    if (!exception_param.type->IsDynamicType()) {  // Has a type specification.
-      // Now form an 'if type check' as an exception type exists in
-      // the catch specifier.
+    const bool is_bad_type = exception_param.type->IsMalformed() ||
+                             exception_param.type->IsMalbounded();
+    if (!is_bad_type && !exception_param.type->IsDynamicType()) {
+      // Has a type specification that is not malformed or malbounded.
+      // Now form an 'if type check' as an exception type exists in the
+      // catch specifier.
       if (!exception_param.type->IsInstantiated() &&
           (current_block_->scope->function_level() > 0)) {
         // Make sure that the instantiator is captured.
@@ -6961,6 +6964,11 @@
         handler_types.Add(*exception_param.type);
       }
     } else {
+      if (is_bad_type) {
+        current_block_->statements->Add(ThrowTypeError(catch_pos,
+                                                       *exception_param.type));
+        // We still add the dead code below to satisfy the code generator.
+      }
       // No exception type exists in the catch specifier so execute the
       // catch handler code unconditionally.
       current_block_->statements->Add(catch_handler);
@@ -8643,36 +8651,24 @@
           // referenced by a static member.
           if (ParsingStaticMember()) {
             ASSERT(scope_class.raw() == current_class().raw());
-            if ((finalization == ClassFinalizer::kCanonicalizeWellFormed) ||
-                FLAG_error_on_bad_type) {
-              *type = ClassFinalizer::NewFinalizedMalformedType(
-                  Error::Handle(),  // No previous error.
-                  script_,
-                  type->token_pos(),
-                  "type parameter '%s' cannot be referenced "
-                  "from static member",
-                  String::Handle(type_parameter.name()).ToCString());
-            } else {
-              // Map the malformed type to dynamic and ignore type arguments.
-              *type = Type::DynamicType();
-            }
+            *type = ClassFinalizer::NewFinalizedMalformedType(
+                Error::Handle(),  // No previous error.
+                script_,
+                type->token_pos(),
+                "type parameter '%s' cannot be referenced "
+                "from static member",
+                String::Handle(type_parameter.name()).ToCString());
             return;
           }
           // A type parameter cannot be parameterized, so make the type
           // malformed if type arguments have previously been parsed.
           if (!AbstractTypeArguments::Handle(type->arguments()).IsNull()) {
-            if ((finalization == ClassFinalizer::kCanonicalizeWellFormed) ||
-                FLAG_error_on_bad_type) {
-              *type = ClassFinalizer::NewFinalizedMalformedType(
-                  Error::Handle(),  // No previous error.
-                  script_,
-                  type_parameter.token_pos(),
-                  "type parameter '%s' cannot be parameterized",
-                  String::Handle(type_parameter.name()).ToCString());
-            } else {
-              // Map the malformed type to dynamic and ignore type arguments.
-              *type = Type::DynamicType();
-            }
+            *type = ClassFinalizer::NewFinalizedMalformedType(
+                Error::Handle(),  // No previous error.
+                script_,
+                type_parameter.token_pos(),
+                "type parameter '%s' cannot be parameterized",
+                String::Handle(type_parameter.name()).ToCString());
             return;
           }
           *type = type_parameter.raw();
@@ -8699,18 +8695,12 @@
       // Replace unresolved class with resolved type class.
       parameterized_type.set_type_class(resolved_type_class);
     } else if (finalization >= ClassFinalizer::kCanonicalize) {
-      if ((finalization == ClassFinalizer::kCanonicalizeWellFormed) ||
-          FLAG_error_on_bad_type) {
-        ClassFinalizer::FinalizeMalformedType(
-            Error::Handle(),  // No previous error.
-            script_,
-            parameterized_type,
-            "type '%s' is not loaded",
-            String::Handle(parameterized_type.UserVisibleName()).ToCString());
-      } else {
-        // Map the malformed type to dynamic and ignore type arguments.
-        *type = Type::DynamicType();
-      }
+      ClassFinalizer::FinalizeMalformedType(
+          Error::Handle(),  // No previous error.
+          script_,
+          parameterized_type,
+          "type '%s' is not loaded",
+          String::Handle(parameterized_type.UserVisibleName()).ToCString());
       return;
     }
   }
@@ -9314,15 +9304,12 @@
         ResolveIdentInLocalScope(type_name.ident_pos, *type_name.ident, NULL)) {
       // The type is malformed. Skip over its type arguments.
       ParseTypeArguments(ClassFinalizer::kIgnore);
-      if (finalization == ClassFinalizer::kCanonicalizeWellFormed) {
-        return ClassFinalizer::NewFinalizedMalformedType(
-            Error::Handle(),  // No previous error.
-            script_,
-            type_name.ident_pos,
-            "using '%s' in this context is invalid",
-            type_name.ident->ToCString());
-      }
-      return Type::DynamicType();
+      return ClassFinalizer::NewFinalizedMalformedType(
+          Error::Handle(),  // No previous error.
+          script_,
+          type_name.ident_pos,
+          "using '%s' in this context is invalid",
+          type_name.ident->ToCString());
     }
   }
   Object& type_class = Object::Handle(isolate());
diff --git a/runtime/vm/random.cc b/runtime/vm/random.cc
new file mode 100644
index 0000000..18703d0
--- /dev/null
+++ b/runtime/vm/random.cc
@@ -0,0 +1,59 @@
+// Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+#include "vm/random.h"
+#include "vm/flags.h"
+#include "vm/isolate.h"
+
+namespace dart {
+
+DEFINE_FLAG(int, random_seed, 0, "Override the random seed for debugging.");
+
+Random::Random() {
+  uint64_t seed = FLAG_random_seed;
+  if (seed == 0) {
+    Dart_EntropySource callback = Isolate::entropy_source_callback();
+    if (callback != NULL) {
+      if (!callback(reinterpret_cast<uint8_t*>(&seed), sizeof(seed))) {
+        // Callback failed. Reset the seed to 0.
+        seed = 0;
+      }
+    }
+  }
+  if (seed == 0) {
+    // We did not get a seed so far. As a fallback we do use the current time.
+    seed = OS::GetCurrentTimeMicros();
+  }
+  // Crank the next state a couple of times.
+  _state = seed;
+  NextState();
+  NextState();
+  NextState();
+  NextState();
+}
+
+Random::~Random() {
+  // Nothing to be done here.
+}
+
+// The algorithm used here is Multiply with Carry (MWC) with a Base b = 2^32.
+// http://en.wikipedia.org/wiki/Multiply-with-carry
+// The constant A is selected from "Numerical Recipes 3rd Edition" p.348 B1.
+void Random::NextState() {
+  const uint64_t MASK_32 = 0xffffffff;
+  const uint64_t A = 0xffffda61;
+
+  uint64_t state_lo = _state & MASK_32;
+  uint64_t state_hi = (_state >> 32) & MASK_32;
+  _state = (A * state_lo) + state_hi;
+}
+
+
+uint32_t Random::NextUInt32() {
+  const uint64_t MASK_32 = 0xffffffff;
+  NextState();
+  return static_cast<uint32_t>(_state & MASK_32);
+}
+
+}  // namespace dart
diff --git a/runtime/vm/random.h b/runtime/vm/random.h
new file mode 100644
index 0000000..c1c69d6
--- /dev/null
+++ b/runtime/vm/random.h
@@ -0,0 +1,31 @@
+// Copyright (c) 2013, the Dart project authors.  Please see the AUTHORS file
+// for details. All rights reserved. Use of this source code is governed by a
+// BSD-style license that can be found in the LICENSE file.
+
+#ifndef VM_RANDOM_H_
+#define VM_RANDOM_H_
+
+#include "vm/globals.h"
+#include "vm/allocation.h"
+
+namespace dart {
+
+class Random : public ValueObject {
+ public:
+  Random();
+  ~Random();
+
+  uint32_t NextUInt32();
+
+ private:
+  void NextState();
+
+  uint64_t _state;
+
+  DISALLOW_ALLOCATION();
+  DISALLOW_COPY_AND_ASSIGN(Random);
+};
+
+}  // namespace dart
+
+#endif  // VM_RANDOM_H_
diff --git a/runtime/vm/vm_sources.gypi b/runtime/vm/vm_sources.gypi
index e1fa84f..1c3a8bb 100644
--- a/runtime/vm/vm_sources.gypi
+++ b/runtime/vm/vm_sources.gypi
@@ -269,6 +269,8 @@
     'port.cc',
     'port.h',
     'port_test.cc',
+    'random.cc',
+    'random.h',
     'raw_object.cc',
     'raw_object.h',
     'raw_object_snapshot.cc',
diff --git a/sdk/lib/html/dart2js/html_dart2js.dart b/sdk/lib/html/dart2js/html_dart2js.dart
index 0987614..3f455e92 100644
--- a/sdk/lib/html/dart2js/html_dart2js.dart
+++ b/sdk/lib/html/dart2js/html_dart2js.dart
@@ -10993,8 +10993,8 @@
   String getAttributeNS(String namespaceURI, String localName) native;
 
   /**
-   * The smallest bounding rectangle that encompasses this element's padding,
-   * scrollbar, and border.
+   * Returns the smallest bounding rectangle that encompasses this element's
+   * padding, scrollbar, and border.
    *
    * ## Other resources
    *
@@ -11002,14 +11002,16 @@
    * (https://developer.mozilla.org/en-US/docs/Web/API/Element.getBoundingClientRect)
    * from MDN.
    * * [The getBoundingClientRect() method]
-   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods) from W3C.
+   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods)
+   * from W3C.
    */
   @DomName('Element.getBoundingClientRect')
   @DocsEditable()
   Rectangle getBoundingClientRect() native;
 
   /**
-   * A list of bounding rectangles for each box associated with this element.
+   * Returns a list of bounding rectangles for each box associated with this
+   * element.
    *
    * ## Other resources
    *
@@ -11017,7 +11019,8 @@
    * (https://developer.mozilla.org/en-US/docs/Web/API/Element.getClientRects)
    * from MDN.
    * * [The getClientRects() method]
-   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods) from W3C.
+   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods)
+   * from W3C.
    */
   @DomName('Element.getClientRects')
   @DocsEditable()
@@ -11025,6 +11028,16 @@
   @Creates('_ClientRectList')
   List<Rectangle> getClientRects() native;
 
+  /**
+   * Returns a list of shadow DOM insertion points to which this element is
+   * distributed.
+   *
+   * ## Other resources
+   *
+   * * [Shadow DOM specification]
+   * (https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html)
+   * from W3C.
+   */
   @DomName('Element.getDestinationInsertionPoints')
   @DocsEditable()
   @Experimental() // untriaged
@@ -11032,6 +11045,17 @@
   @Creates('NodeList')
   List<Node> getDestinationInsertionPoints() native;
 
+  /**
+   * Returns a list of nodes with the given class name inside this element.
+   *
+   * ## Other resources
+   *
+   * * [getElementsByClassName]
+   * (https://developer.mozilla.org/en-US/docs/Web/API/document.getElementsByClassName)
+   * from MDN.
+   * * [DOM specification]
+   * (http://www.w3.org/TR/domcore/) from W3C.
+   */
   @DomName('Element.getElementsByClassName')
   @DocsEditable()
   @Returns('NodeList')
@@ -29733,32 +29757,43 @@
 
 
 /**
- * An object that can be drawn to a [CanvasRenderingContext2D] object with
- * [CanvasRenderingContext2D.drawImage],
- * [CanvasRenderingContext2D.drawImageToRect],
- * [CanvasRenderingContext2D.drawImageScaled], or
- * [CanvasRenderingContext2D.drawImageScaledFromSource].
+ * An object that can be drawn to a 2D canvas rendering context.
  *
- * If the CanvasImageSource is an [ImageElement] then the element's image is
- * used. If the [ImageElement] is an animated image, then the poster frame is
- * used. If there is no poster frame, then the first frame of animation is used.
+ * This object is either an [ImageElement], [VideoElement], or
+ * [CanvasElement].
  *
- * If the CanvasImageSource is a [VideoElement] then the frame at the current
- * playback position is used as the image.
+ * The image drawn to the canvas differs by implementation:
  *
- * If the CanvasImageSource is a [CanvasElement] then the element's bitmap is
- * used.
+ * * If this object is an [ImageElement], then this element's image is
+ * drawn to the canvas. If this element is an animated image, then this
+ * element's poster frame is drawn. If this element has no poster frame, then
+ * the first frame of animation is drawn.
  *
- * ** Note: ** Currently, all versions of Internet Explorer do not support
- * drawing a VideoElement to a canvas. Also, you may experience problems drawing
+ * * If this object is a [VideoElement], then the frame at this element's current
+ * playback position is drawn to the canvas.
+ *
+ * * If this object is a [CanvasElement], then this element's bitmap is drawn to
+ * the canvas.
+ *
+ * **Note:** Currently all versions of Internet Explorer do not support
+ * drawing a video element to a canvas. You may also encounter problems drawing
  * a video to a canvas in Firefox if the source of the video is a data URL.
  *
- * See also:
+ * ## See also
  *
- *  * [CanvasImageSource](http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#image-sources-for-2d-rendering-contexts)
- * from the WHATWG.
- *  * [drawImage](http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-drawimage)
- * from the WHATWG.
+ * * [CanvasRenderingContext2D.drawImage]
+ * * [CanvasRenderingContext2D.drawImageToRect]
+ * * [CanvasRenderingContext2D.drawImageScaled]
+ * * [CanvasRenderingContext2D.drawImageScaledFromSource]
+ *
+ * ## Other resources
+ *
+ * * [Image sources for 2D rendering contexts]
+ * (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#image-sources-for-2d-rendering-contexts)
+ * from WHATWG.
+ * * [Drawing images]
+ * (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-drawimage)
+ * from WHATWG.
  */
 abstract class CanvasImageSource {}
 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
diff --git a/sdk/lib/html/dartium/html_dartium.dart b/sdk/lib/html/dartium/html_dartium.dart
index bb278e1a..7cd038f 100644
--- a/sdk/lib/html/dartium/html_dartium.dart
+++ b/sdk/lib/html/dartium/html_dartium.dart
@@ -11155,8 +11155,8 @@
   String getAttributeNS(String namespaceURI, String localName) native "Element_getAttributeNS_Callback";
 
   /**
-   * The smallest bounding rectangle that encompasses this element's padding,
-   * scrollbar, and border.
+   * Returns the smallest bounding rectangle that encompasses this element's
+   * padding, scrollbar, and border.
    *
    * ## Other resources
    *
@@ -11164,14 +11164,16 @@
    * (https://developer.mozilla.org/en-US/docs/Web/API/Element.getBoundingClientRect)
    * from MDN.
    * * [The getBoundingClientRect() method]
-   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods) from W3C.
+   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods)
+   * from W3C.
    */
   @DomName('Element.getBoundingClientRect')
   @DocsEditable()
   Rectangle getBoundingClientRect() native "Element_getBoundingClientRect_Callback";
 
   /**
-   * A list of bounding rectangles for each box associated with this element.
+   * Returns a list of bounding rectangles for each box associated with this
+   * element.
    *
    * ## Other resources
    *
@@ -11179,17 +11181,39 @@
    * (https://developer.mozilla.org/en-US/docs/Web/API/Element.getClientRects)
    * from MDN.
    * * [The getClientRects() method]
-   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods) from W3C.
+   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods)
+   * from W3C.
    */
   @DomName('Element.getClientRects')
   @DocsEditable()
   List<Rectangle> getClientRects() native "Element_getClientRects_Callback";
 
+  /**
+   * Returns a list of shadow DOM insertion points to which this element is
+   * distributed.
+   *
+   * ## Other resources
+   *
+   * * [Shadow DOM specification]
+   * (https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html)
+   * from W3C.
+   */
   @DomName('Element.getDestinationInsertionPoints')
   @DocsEditable()
   @Experimental() // untriaged
   List<Node> getDestinationInsertionPoints() native "Element_getDestinationInsertionPoints_Callback";
 
+  /**
+   * Returns a list of nodes with the given class name inside this element.
+   *
+   * ## Other resources
+   *
+   * * [getElementsByClassName]
+   * (https://developer.mozilla.org/en-US/docs/Web/API/document.getElementsByClassName)
+   * from MDN.
+   * * [DOM specification]
+   * (http://www.w3.org/TR/domcore/) from W3C.
+   */
   @DomName('Element.getElementsByClassName')
   @DocsEditable()
   List<Node> getElementsByClassName(String name) native "Element_getElementsByClassName_Callback";
@@ -31630,32 +31654,43 @@
 
 
 /**
- * An object that can be drawn to a [CanvasRenderingContext2D] object with
- * [CanvasRenderingContext2D.drawImage],
- * [CanvasRenderingContext2D.drawImageToRect],
- * [CanvasRenderingContext2D.drawImageScaled], or
- * [CanvasRenderingContext2D.drawImageScaledFromSource].
+ * An object that can be drawn to a 2D canvas rendering context.
  *
- * If the CanvasImageSource is an [ImageElement] then the element's image is
- * used. If the [ImageElement] is an animated image, then the poster frame is
- * used. If there is no poster frame, then the first frame of animation is used.
+ * This object is either an [ImageElement], [VideoElement], or
+ * [CanvasElement].
  *
- * If the CanvasImageSource is a [VideoElement] then the frame at the current
- * playback position is used as the image.
+ * The image drawn to the canvas differs by implementation:
  *
- * If the CanvasImageSource is a [CanvasElement] then the element's bitmap is
- * used.
+ * * If this object is an [ImageElement], then this element's image is
+ * drawn to the canvas. If this element is an animated image, then this
+ * element's poster frame is drawn. If this element has no poster frame, then
+ * the first frame of animation is drawn.
  *
- * ** Note: ** Currently, all versions of Internet Explorer do not support
- * drawing a VideoElement to a canvas. Also, you may experience problems drawing
+ * * If this object is a [VideoElement], then the frame at this element's current
+ * playback position is drawn to the canvas.
+ *
+ * * If this object is a [CanvasElement], then this element's bitmap is drawn to
+ * the canvas.
+ *
+ * **Note:** Currently all versions of Internet Explorer do not support
+ * drawing a video element to a canvas. You may also encounter problems drawing
  * a video to a canvas in Firefox if the source of the video is a data URL.
  *
- * See also:
+ * ## See also
  *
- *  * [CanvasImageSource](http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#image-sources-for-2d-rendering-contexts)
- * from the WHATWG.
- *  * [drawImage](http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-drawimage)
- * from the WHATWG.
+ * * [CanvasRenderingContext2D.drawImage]
+ * * [CanvasRenderingContext2D.drawImageToRect]
+ * * [CanvasRenderingContext2D.drawImageScaled]
+ * * [CanvasRenderingContext2D.drawImageScaledFromSource]
+ *
+ * ## Other resources
+ *
+ * * [Image sources for 2D rendering contexts]
+ * (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#image-sources-for-2d-rendering-contexts)
+ * from WHATWG.
+ * * [Drawing images]
+ * (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-drawimage)
+ * from WHATWG.
  */
 abstract class CanvasImageSource {}
 // Copyright (c) 2012, the Dart project authors.  Please see the AUTHORS file
diff --git a/tests/co19/co19-dart2dart.status b/tests/co19/co19-dart2dart.status
index 4a38fb1..0045ac0 100644
--- a/tests/co19/co19-dart2dart.status
+++ b/tests/co19/co19-dart2dart.status
@@ -10,6 +10,14 @@
 Language/07_Classes/07_Classes_A13_t08: Fail # Missing CT error on member with same name a type parameter
 Language/07_Classes/07_Classes_A13_t09: Fail # Missing CT error on member with same name a type parameter
 
+Language/10_Generics/10_Generics_A05_t01: Fail # Issue 463
+Language/14_Libraries_and_Scripts/1_Imports_A03_t05: Fail # Issue 463
+Language/15_Types/1_Static_Types_A03_t01: Fail # Issue 463
+Language/12_Expressions/32_Type_Test_A04_t01: Fail # Issue 463
+Language/12_Expressions/32_Type_Test_A04_t02: Fail # Issue 463
+Language/12_Expressions/33_Type_Cast_A03_t01: Fail # Issue 463
+Language/12_Expressions/33_Type_Cast_A03_t03: Fail # Issue 463
+
 Language/13_Statements/04_Local_Function_Declaration_A04_t01: Fail, MissingCompileTimeError # co19-roll r607: Please triage this failure
 
 LibTest/async/Stream/Stream.periodic_A01_t01: Pass, Fail # Issue 12562.
@@ -99,7 +107,6 @@
 LibTest/math/atan_A01_t01: Fail, OK # co19 issue 44
 
 [ $compiler == dart2dart ]
-Language/03_Overview/2_Privacy_A01_t06: Fail # co19 issue 463
 LibTest/core/double/ceil_A01_t03: Fail # truncate/ceil/floor/round returns ints, issue 389
 LibTest/core/double/ceil_A01_t04: Fail # truncate/ceil/floor/round returns ints, issue 389
 LibTest/core/double/floor_A01_t03: Fail # truncate/ceil/floor/round returns ints, issue 389
diff --git a/tests/co19/co19-runtime.status b/tests/co19/co19-runtime.status
index fb04972..bb615bd 100644
--- a/tests/co19/co19-runtime.status
+++ b/tests/co19/co19-runtime.status
@@ -4,7 +4,7 @@
 
 
 [ $compiler == none && ($runtime == vm || $runtime == dartium) && $unchecked]
-Language/12_Expressions/01_Constants_A16_t04: fail # Issue 392, passes in checked mode b/c of type check
+
 
 [ $compiler == none && ($runtime == vm || $runtime == dartium) ]
 Language/13_Statements/03_Variable_Declaration_A04_t01: Fail, MissingCompileTimeError # Issue 7052
@@ -27,7 +27,13 @@
 LibTest/core/RegExp/firstMatch_A01_t01: Fail # Issue 12508
 LibTest/core/int/toRadixString_A01_t01: Fail # co19 issue 492
 
-Language/03_Overview/2_Privacy_A01_t06: Fail # Issue 463
+Language/10_Generics/10_Generics_A05_t01: Fail # Issue 463
+Language/14_Libraries_and_Scripts/1_Imports_A03_t05: Fail # Issue 463
+Language/15_Types/1_Static_Types_A03_t01: Fail # Issue 463
+Language/12_Expressions/33_Type_Cast_A03_t01: Fail # Issue 463
+Language/12_Expressions/33_Type_Cast_A03_t03: Fail # Issue 463
+Language/12_Expressions/32_Type_Test_A04_t01: Fail # Issue 463
+Language/12_Expressions/32_Type_Test_A04_t02: Fail # Issue 463
 
 LibTest/async/Timer/Timer.periodic_A02_t01: Pass, Fail # co19 issue 537
 
@@ -105,6 +111,10 @@
 LibTest/core/Uri/Uri_A06_t03: Pass, Timeout # co19-roll r576: Please triage this failure
 
 [ $compiler == none && $checked && ($runtime == vm || $runtime == dartium) ]
+Language/10_Generics/10_Generics_A05_t02: Fail # Issue 463
+Language/15_Types/1_Static_Types_A03_t02: Fail # Issue 463
+Language/15_Types/1_Static_Types_A03_t03: Fail # Issue 463
+Language/15_Types/1_Static_Types_A03_t04: Fail # Issue 463
 Language/14_Libraries_and_Scripts/1_Imports_A03_t31: Fail # Issue 14006, discussion on-going
 LibTest/typed_data/Float32x4List/elementAt_A01_t01: Fail # Dart issue 12861
 LibTest/typed_data/Float32x4List/fillRange_A01_t01: Fail # Dart issue 12861
diff --git a/tests/compiler/dart2js/mirror_helper_unique_minification_test.dart b/tests/compiler/dart2js/mirror_helper_unique_minification_test.dart
index fd0c83f..e72f98a 100644
--- a/tests/compiler/dart2js/mirror_helper_unique_minification_test.dart
+++ b/tests/compiler/dart2js/mirror_helper_unique_minification_test.dart
@@ -15,7 +15,11 @@
 import
     '../../../sdk/lib/_internal/compiler/implementation/tree/tree.dart'
 show
-    Node;
+    Node, Identifier;
+import
+    '../../../sdk/lib/_internal/compiler/implementation/mirror_renamer/mirror_renamer.dart'
+show
+    MirrorRenamer;
 
 main() {
   testUniqueMinification();
diff --git a/tests/compiler/dart2js/union_type_test.dart b/tests/compiler/dart2js/union_type_test.dart
index 7cc13ba..984880f 100644
--- a/tests/compiler/dart2js/union_type_test.dart
+++ b/tests/compiler/dart2js/union_type_test.dart
@@ -10,7 +10,7 @@
 import "../../../sdk/lib/_internal/compiler/implementation/dart_types.dart";
 
 main() {
-  Compiler compiler = new MockCompiler();
+  MockCompiler compiler = new MockCompiler();
   compiler.intClass.ensureResolved(compiler);
   compiler.stringClass.ensureResolved(compiler);
 
diff --git a/tests/html/custom/created_callback_test.dart b/tests/html/custom/created_callback_test.dart
index 3faa981..49845c1 100644
--- a/tests/html/custom/created_callback_test.dart
+++ b/tests/html/custom/created_callback_test.dart
@@ -215,7 +215,7 @@
     var child = upgradingContext.firstChild;
 
     expect(child.foo, 666);
-    expect(upgradingContextChild is HTMLElement, isTrue);
+    expect(upgradingContextChild is HtmlElement, isFalse);
     expect(upgradingContextChild is AccessWhileUpgradingElement, isFalse,
         reason: 'Elements accessed while upgrading should not be upgraded.');
   }
diff --git a/tests/html/html.status b/tests/html/html.status
index aca5635..0792441 100644
--- a/tests/html/html.status
+++ b/tests/html/html.status
@@ -409,7 +409,6 @@
 
 [ $compiler == dartanalyzer || $compiler == dart2analyzer ]
 audiocontext_test: StaticWarning
-custom/created_callback_test: StaticWarning
 custom/document_register_basic_test: StaticWarning
 datalistelement_test: StaticWarning
 documentfragment_test: StaticWarning
diff --git a/tests/language/class_override_test.dart b/tests/language/class_override_test.dart
index 214a08d..190604b 100644
--- a/tests/language/class_override_test.dart
+++ b/tests/language/class_override_test.dart
@@ -17,7 +17,7 @@
   B instance = new B();
   try {
     instance.foo();
-  } on NoSuchMethodEror catch (error) {  /// 00: continued
+  } on NoSuchMethodError catch (error) {  /// 00: continued
   } finally {
   }
   print("Success");
diff --git a/tests/language/language.status b/tests/language/language.status
index 7c6ac29..9597d5f 100644
--- a/tests/language/language.status
+++ b/tests/language/language.status
@@ -10,12 +10,6 @@
 mixin_super_constructor_positionals_test: Fail # Issue 12631
 built_in_identifier_prefix_test: Fail # Issue 6970
 f_bounded_equality_test: RuntimeError # Issue 14000
-instanceof3_test: Fail # Issue 14768
-is_not_class2_test: Fail # Issue 14768
-isnot_malformed_type_test: Fail # Issue 14768
-library_ambiguous_test/04: Fail # Issue 14768
-malformed2_test/00: Fail # Issue 14768
-on_catch_malformed_type_test: Fail # Issue 14768
 
 # These bugs refer currently ongoing language discussions.
 constructor_initializer_test/none: Fail # Issue 12633
@@ -33,13 +27,6 @@
 [ $compiler == none && $checked ]
 type_variable_bounds4_test/01: Fail # Issue 14006
 
-type_parameter_test/01: Fail # Issue 14768
-type_parameter_test/02: Fail # Issue 14768
-type_parameter_test/03: Fail # Issue 14768
-type_parameter_test/04: Fail # Issue 14768
-type_parameter_test/05: Fail # Issue 14768
-type_parameter_test/06: Fail # Issue 14768
-
 [ $compiler == none && $unchecked ]
 # Only checked mode reports an error on type assignment
 # problems in compile time constants.
diff --git a/tests/language/language_dart2js.status b/tests/language/language_dart2js.status
index a96f2e3..7e671f6 100644
--- a/tests/language/language_dart2js.status
+++ b/tests/language/language_dart2js.status
@@ -195,13 +195,6 @@
 factory3_test: Fail # Issue 13077
 type_checks_in_factory_method_test: Fail # Issue 12747
 
-instanceof3_test: Fail # Issue 14768
-is_not_class2_test: Fail # Issue 14768
-isnot_malformed_type_test: Fail # Issue 14768
-library_ambiguous_test/04: Fail # Issue 14768
-malformed2_test/00: Fail # Issue 14768
-on_catch_malformed_type_test: Fail # Issue 14768
-
 # Mixins fail on the VM.
 mixin_forwarding_constructor2_test: Fail # Issue 13641
 
@@ -291,13 +284,6 @@
 malbounded_type_test_test/01: Fail # Issue 14131
 malbounded_instantiation_test/01: Fail # Issue 14132
 
-type_parameter_test/01: Fail # Issue 14768
-type_parameter_test/02: Fail # Issue 14768
-type_parameter_test/03: Fail # Issue 14768
-type_parameter_test/04: Fail # Issue 14768
-type_parameter_test/05: Fail # Issue 14768
-type_parameter_test/06: Fail # Issue 14768
-
 [ $compiler == dart2dart && $minified ]
 super_getter_setter_test: Fail # Issue 11065.
 f_bounded_quantification4_test: Fail # Issue 12605.
diff --git a/tests/language/malformed_test.dart b/tests/language/malformed_test.dart
index 8f15dff..2364696 100644
--- a/tests/language/malformed_test.dart
+++ b/tests/language/malformed_test.dart
@@ -9,10 +9,10 @@
 import 'package:expect/expect.dart' as prefix;  // Define 'prefix'.
 
 checkIsUnresolved(var v) {
-  Expect.isTrue(v is Unresolved);
-  Expect.isTrue(v is Unresolved<int>);
-  Expect.isTrue(v is prefix.Unresolved);
-  Expect.isTrue(v is prefix.Unresolved<int>);
+  Expect.throws(() => v is Unresolved, (e) => e is TypeError);
+  Expect.throws(() => v is Unresolved<int>, (e) => e is TypeError);
+  Expect.throws(() => v is prefix.Unresolved, (e) => e is TypeError);
+  Expect.throws(() => v is prefix.Unresolved<int>, (e) => e is TypeError);
 }
 
 checkIsListUnresolved(bool expect, var v) {
@@ -29,10 +29,10 @@
 }
 
 checkAsUnresolved(var v) {
-  Expect.equals(v, v as Unresolved);
-  Expect.equals(v, v as Unresolved<int>);
-  Expect.equals(v, v as prefix.Unresolved);
-  Expect.equals(v, v as prefix.Unresolved<int>);
+  Expect.throws(() => v as Unresolved, (e) => e is TypeError);
+  Expect.throws(() => v as Unresolved<int>, (e) => e is TypeError);
+  Expect.throws(() => v as prefix.Unresolved, (e) => e is TypeError);
+  Expect.throws(() => v as prefix.Unresolved<int>, (e) => e is TypeError);
 }
 
 checkAsListUnresolved(bool expect, var v) {
@@ -125,24 +125,40 @@
   Expect.throws(() => new undeclared_prefix.Unresolved<int>(), (e) => true);  /// 05: compile-time error
 
   try {
-    throw 'foo';
-  } on Unresolved catch (e) {
-    // Equivalent to 'on dynamic', catches 'foo'.
+    try {
+      throw 'foo';
+    } on Unresolved catch (e) {
+      Expect.fail("This code shouldn't be executed");
+    }
+    Expect.fail("This code shouldn't be executed");
+  } on TypeError catch (e) {
   }
   try {
-    throw 'foo';
-  } on Unresolved<int> catch (e) {
-    // Equivalent to 'on dynamic', catches 'foo'.
+    try {
+      throw 'foo';
+    } on Unresolved<int> catch (e) {
+      Expect.fail("This code shouldn't be executed");
+    }
+    Expect.fail("This code shouldn't be executed");
+  } on TypeError catch (e) {
   }
   try {
-    throw 'foo';
-  } on prefix.Unresolved catch (e) {
-    // Equivalent to 'on dynamic', catches 'foo'.
+    try {
+      throw 'foo';
+    } on prefix.Unresolved catch (e) {
+      Expect.fail("This code shouldn't be executed");
+    }
+    Expect.fail("This code shouldn't be executed");
+  } on TypeError catch (e) {
   }
   try {
-    throw 'foo';
-  } on prefix.Unresolved<int> catch (e) {
-    // Equivalent to 'on dynamic', catches 'foo'.
+    try {
+      throw 'foo';
+    } on prefix.Unresolved<int> catch (e) {
+      Expect.fail("This code shouldn't be executed");
+    }
+    Expect.fail("This code shouldn't be executed");
+  } on TypeError catch (e) {
   }
   try {
     throw 'foo';
diff --git a/tests/standalone/io/skipping_dart2js_compilations_test.dart b/tests/standalone/io/skipping_dart2js_compilations_test.dart
index 06efd12..95ae623 100644
--- a/tests/standalone/io/skipping_dart2js_compilations_test.dart
+++ b/tests/standalone/io/skipping_dart2js_compilations_test.dart
@@ -132,7 +132,7 @@
 
   CommandCompletedHandler(FileUtils this.fileUtils, bool this._shouldHaveRun);
 
-  void processCompletedTest(CommandOutput output) {
+  void processCompletedTest(runner.CommandOutput output) {
     Expect.isTrue(output.exitCode == 0);
     Expect.isTrue(output.stderr.length == 0);
     if (_shouldHaveRun) {
@@ -212,7 +212,7 @@
       var completedHandler = new CommandCompletedHandler(fileUtils, shouldRun);
       var command = makeCompilationCommand(name, fileUtils);
       var process = new runner.RunningProcess(command, 60);
-      return process.run().then((CommandOutput output) {
+      return process.run().then((runner.CommandOutput output) {
         completedHandler.processCompletedTest(output);
       });
     }
diff --git a/tools/VERSION b/tools/VERSION
index cfe7916..fc4cf76 100644
--- a/tools/VERSION
+++ b/tools/VERSION
@@ -1,4 +1,4 @@
 MAJOR 0
 MINOR 8
 BUILD 10
-PATCH 5
+PATCH 6
diff --git a/tools/dom/docs/docs.json b/tools/dom/docs/docs.json
index 905fdcb..43706bc 100644
--- a/tools/dom/docs/docs.json
+++ b/tools/dom/docs/docs.json
@@ -707,8 +707,8 @@
         ],
         "getBoundingClientRect": [
           "/**",
-          "   * The smallest bounding rectangle that encompasses this element's padding,",
-          "   * scrollbar, and border.",
+          "   * Returns the smallest bounding rectangle that encompasses this element's",
+          "   * padding, scrollbar, and border.",
           "   *",
           "   * ## Other resources",
           "   *",
@@ -716,12 +716,14 @@
           "   * (https://developer.mozilla.org/en-US/docs/Web/API/Element.getBoundingClientRect)",
           "   * from MDN.",
           "   * * [The getBoundingClientRect() method]",
-          "   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods) from W3C.",
+          "   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods)",
+          "   * from W3C.",
           "   */"
         ],
         "getClientRects": [
           "/**",
-          "   * A list of bounding rectangles for each box associated with this element.",
+          "   * Returns a list of bounding rectangles for each box associated with this",
+          "   * element.",
           "   *",
           "   * ## Other resources",
           "   *",
@@ -729,7 +731,33 @@
           "   * (https://developer.mozilla.org/en-US/docs/Web/API/Element.getClientRects)",
           "   * from MDN.",
           "   * * [The getClientRects() method]",
-          "   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods) from W3C.",
+          "   * (http://www.w3.org/TR/cssom-view/#the-getclientrects-and-getboundingclientrect-methods)",
+          "   * from W3C.",
+          "   */"
+        ],
+        "getDestinationInsertionPoints": [
+          "/**",
+          "   * Returns a list of shadow DOM insertion points to which this element is",
+          "   * distributed.",
+          "   *",
+          "   * ## Other resources",
+          "   *",
+          "   * * [Shadow DOM specification]",
+          "   * (https://dvcs.w3.org/hg/webcomponents/raw-file/tip/spec/shadow/index.html)",
+          "   * from W3C.",
+          "   */"
+        ],
+        "getElementsByClassName": [
+          "/**",
+          "   * Returns a list of nodes with the given class name inside this element.",
+          "   *",
+          "   * ## Other resources",
+          "   *",
+          "   * * [getElementsByClassName]",
+          "   * (https://developer.mozilla.org/en-US/docs/Web/API/document.getElementsByClassName)",
+          "   * from MDN.",
+          "   * * [DOM specification]",
+          "   * (http://www.w3.org/TR/domcore/) from W3C.",
           "   */"
         ],
         "hidden": [
diff --git a/tools/dom/src/CanvasImageSource.dart b/tools/dom/src/CanvasImageSource.dart
index 69165cf..b6a770c 100644
--- a/tools/dom/src/CanvasImageSource.dart
+++ b/tools/dom/src/CanvasImageSource.dart
@@ -5,31 +5,42 @@
 part of html;
 
 /**
- * An object that can be drawn to a [CanvasRenderingContext2D] object with
- * [CanvasRenderingContext2D.drawImage],
- * [CanvasRenderingContext2D.drawImageToRect],
- * [CanvasRenderingContext2D.drawImageScaled], or
- * [CanvasRenderingContext2D.drawImageScaledFromSource].
+ * An object that can be drawn to a 2D canvas rendering context.
  *
- * If the CanvasImageSource is an [ImageElement] then the element's image is
- * used. If the [ImageElement] is an animated image, then the poster frame is
- * used. If there is no poster frame, then the first frame of animation is used.
+ * This object is either an [ImageElement], [VideoElement], or
+ * [CanvasElement].
  *
- * If the CanvasImageSource is a [VideoElement] then the frame at the current
- * playback position is used as the image.
+ * The image drawn to the canvas differs by implementation:
  *
- * If the CanvasImageSource is a [CanvasElement] then the element's bitmap is
- * used.
+ * * If this object is an [ImageElement], then this element's image is
+ * drawn to the canvas. If this element is an animated image, then this
+ * element's poster frame is drawn. If this element has no poster frame, then
+ * the first frame of animation is drawn.
  *
- * ** Note: ** Currently, all versions of Internet Explorer do not support
- * drawing a VideoElement to a canvas. Also, you may experience problems drawing
+ * * If this object is a [VideoElement], then the frame at this element's current
+ * playback position is drawn to the canvas.
+ *
+ * * If this object is a [CanvasElement], then this element's bitmap is drawn to
+ * the canvas.
+ *
+ * **Note:** Currently all versions of Internet Explorer do not support
+ * drawing a video element to a canvas. You may also encounter problems drawing
  * a video to a canvas in Firefox if the source of the video is a data URL.
  *
- * See also:
+ * ## See also
  *
- *  * [CanvasImageSource](http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#image-sources-for-2d-rendering-contexts)
- * from the WHATWG.
- *  * [drawImage](http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-drawimage)
- * from the WHATWG.
+ * * [CanvasRenderingContext2D.drawImage]
+ * * [CanvasRenderingContext2D.drawImageToRect]
+ * * [CanvasRenderingContext2D.drawImageScaled]
+ * * [CanvasRenderingContext2D.drawImageScaledFromSource]
+ *
+ * ## Other resources
+ *
+ * * [Image sources for 2D rendering contexts]
+ * (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#image-sources-for-2d-rendering-contexts)
+ * from WHATWG.
+ * * [Drawing images]
+ * (http://www.whatwg.org/specs/web-apps/current-work/multipage/the-canvas-element.html#dom-context-2d-drawimage)
+ * from WHATWG.
  */
 abstract class CanvasImageSource {}