diff --git a/ecmascript/base/typed_array_helper.cpp b/ecmascript/base/typed_array_helper.cpp
index cac26efd049296ff33dfd84888769b6c8592013d..0d6f5620f61c6c30206ca290547af698066a0f13 100644
--- a/ecmascript/base/typed_array_helper.cpp
+++ b/ecmascript/base/typed_array_helper.cpp
@@ -1162,6 +1162,8 @@ bool TypedArrayHelper::IsNativeArrayIterator(JSThread *thread,
     if (iterNext->IsJSFunction()) {
         nextMethod = Method::Cast(
             JSHandle<JSFunction>::Cast(iterNext)->GetMethod().GetTaggedObject());
+    } else {
+        return false;
     }
     // Array and TypedArray use the same JSArrayIterator.
     return nextMethod->GetNativePointer() == reinterpret_cast<void*>(JSArrayIterator::Next);
diff --git a/ecmascript/compiler/builtins/builtins_typedarray_stub_builder.cpp b/ecmascript/compiler/builtins/builtins_typedarray_stub_builder.cpp
index 8e46ee42c2b40b645e66a7cba9c585edc9044a39..6b3d51822baa28292e07b51e77a65b7a30e2436d 100644
--- a/ecmascript/compiler/builtins/builtins_typedarray_stub_builder.cpp
+++ b/ecmascript/compiler/builtins/builtins_typedarray_stub_builder.cpp
@@ -370,8 +370,16 @@ GateRef BuiltinsTypedArrayStubBuilder::GetValueFromBuffer(GateRef buffer, GateRe
             {
                 GateRef byteIndex = Int32Add(Int32Mul(index, Int32(base::ElementSize::EIGHT)), offset);
                 GateRef block = GetDataPointFromBuffer(buffer);
-                GateRef re = Load(VariableType::INT64(), block, byteIndex);
-                result = DoubleToTaggedDoublePtr(CastInt64ToFloat64(re));
+                GateRef tmpResult = CastInt64ToFloat64(Load(VariableType::INT64(), block, byteIndex));
+
+                Label tmpResultIsNumber(env);
+                Label tmpResultIsNan(env);
+                BRANCH(env->GetBuilder()->DoubleIsImpureNaN(tmpResult), &tmpResultIsNan, &tmpResultIsNumber);
+                Bind(&tmpResultIsNan);
+                result = DoubleToTaggedDoublePtr(Double(base::NAN_VALUE));
+                Jump(&exit);
+                Bind(&tmpResultIsNumber);
+                result = DoubleToTaggedDoublePtr(tmpResult);
                 Jump(&exit);
             }
         }
diff --git a/ecmascript/compiler/builtins/linked_hashtable_stub_builder.cpp b/ecmascript/compiler/builtins/linked_hashtable_stub_builder.cpp
index 018397073fffbe752783cc3c9a2db3d32e5b2ad6..a33fe91b04508388ccd440df1d97ca5438cb76ee 100644
--- a/ecmascript/compiler/builtins/linked_hashtable_stub_builder.cpp
+++ b/ecmascript/compiler/builtins/linked_hashtable_stub_builder.cpp
@@ -309,8 +309,15 @@ GateRef LinkedHashTableStubBuilder<LinkedHashTableType, LinkedHashTableObject>::
     Label loopEnd(env);
     Label next(env);
     Label loopExit(env);
+    Label noNumberOfDeletedElements(env);
+
+    BRANCH(Int32Equal(GetNumberOfDeletedElements(linkedTable), Int32(-1)), &noNumberOfDeletedElements, &loopHead);
+    Bind(&noNumberOfDeletedElements);
+    {
+        res = entry;
+        Jump(&exit);
+    }
 
-    Jump(&loopHead);
     LoopBegin(&loopHead);
     {
         BRANCH(Int32GreaterThanOrEqual(*currentEntry, Int32(0)), &next, &loopExit);
diff --git a/ecmascript/compiler/stub_builder.cpp b/ecmascript/compiler/stub_builder.cpp
index 92a62c8fa56a11e0247cfb5d5c5e0c9dd0770d52..05b59d52060b862cb139e419b7c6ae8880571bf4 100644
--- a/ecmascript/compiler/stub_builder.cpp
+++ b/ecmascript/compiler/stub_builder.cpp
@@ -8524,7 +8524,7 @@ GateRef StubBuilder::GetIterator(GateRef glue, GateRef obj, ProfileOperation cal
     Label exit(env);
     env->SubCfgEntry(&entryPass);
     DEFVARIABLE(result, VariableType::JS_ANY(), Exception());
-    DEFVARIABLE(taggedId, VariableType::INT32(), Int32(0));
+    DEFVARIABLE(taggedId, VariableType::INT32(), Int32(GET_MESSAGE_STRING_ID(ObjIsNotCallable)));
 
     Label isPendingException(env);
     Label noPendingException(env);
@@ -8555,14 +8555,18 @@ GateRef StubBuilder::GetIterator(GateRef glue, GateRef obj, ProfileOperation cal
         if (env->IsBaselineBuiltin()) {
             callBuilder.JSCallDispatchForBaseline(&callExit);
             Bind(&callExit);
+            Jump(&exit);
         } else {
             result = callBuilder.JSCallDispatch();
+            Label modifyErrorInfo(env);
+            BRANCH(TaggedIsHeapObject(*result), &exit, &modifyErrorInfo);
+            Bind(&modifyErrorInfo);
+            taggedId = Int32(GET_MESSAGE_STRING_ID(IterNotObject));
+            Jump(&throwError);
         }
-        Jump(&exit);
     }
     Bind(&throwError);
     {
-        taggedId = Int32(GET_MESSAGE_STRING_ID(ObjIsNotCallable));
         CallRuntime(glue, RTSTUB_ID(ThrowTypeError), { IntToTaggedInt(*taggedId) });
         result = Exception();
         Jump(&exit);
diff --git a/ecmascript/js_date_time_format.cpp b/ecmascript/js_date_time_format.cpp
index 41c930fe348f2a4bda880f45292eeb0df6e53ea8..ad7548239530e80e36acd9dffd7e66e04a3fd10c 100644
--- a/ecmascript/js_date_time_format.cpp
+++ b/ecmascript/js_date_time_format.cpp
@@ -1654,31 +1654,23 @@ std::string JSDateTimeFormat::ToTitleCaseFunction(const std::string &input)
     return result;
 }
 
-bool JSDateTimeFormat::IsValidTimeZoneInput(const std::string &input)
-{
-    std::regex r("[a-zA-Z_\\-/]*");
-    bool isValid = regex_match(input, r);
-    return isValid;
-}
-
 std::string JSDateTimeFormat::ToTitleCaseTimezonePosition(const std::string &input)
 {
-    if (!IsValidTimeZoneInput(input)) {
-        return std::string();
-    }
     std::vector<std::string> titleEntry;
     std::vector<std::string> charEntry;
-    int32_t leftPosition = 0;
-    int32_t titleLength = 0;
-    for (int32_t i = 0; i < static_cast<int>(input.length()); i++) {
+    uint32_t leftPosition = 0;
+    uint32_t titleLength = 0;
+    for (size_t i = 0; i < input.length(); i++) {
         if (input[i] == '_' || input[i] == '-' || input[i] == '/') {
             std::string s(1, input[i]);
             charEntry.emplace_back(s);
             titleLength = i - leftPosition;
             titleEntry.emplace_back(input.substr(leftPosition, titleLength));
             leftPosition = i + 1;
-        } else {
+        } else if (JSLocale::IsAsciiAlpha(input[i]) || input[i] == '\\') {
             continue;
+        } else {
+            return std::string();
         }
     }
     ASSERT(input.length() >= static_cast<size_t>(leftPosition));
diff --git a/ecmascript/js_date_time_format.h b/ecmascript/js_date_time_format.h
index 7bc5655fe93c55165da53bd82cd28f0e800936ca..b75dc9e13336737b149939a37182248c9b31c593 100644
--- a/ecmascript/js_date_time_format.h
+++ b/ecmascript/js_date_time_format.h
@@ -214,8 +214,6 @@ private:
 
     static std::string ToTitleCaseFunction(const std::string &input);
 
-    static bool IsValidTimeZoneInput(const std::string &input);
-
     static JSHandle<EcmaString> ToValueString(JSThread *thread, Value value);
 
     static icu::FormattedDateInterval ConstructDTFRange(JSThread *thread, const JSHandle<JSDateTimeFormat> &dtf,
diff --git a/ecmascript/js_for_in_iterator.cpp b/ecmascript/js_for_in_iterator.cpp
index e06af8b2f87b2991294146c6e828ef743d2edab8..f940f68032a324f80b1ad98e995e2a3e0f8f96ca 100644
--- a/ecmascript/js_for_in_iterator.cpp
+++ b/ecmascript/js_for_in_iterator.cpp
@@ -120,6 +120,7 @@ JSTaggedValue JSForInIterator::NextInternalSlowpath(JSThread *thread, const JSHa
             break;
         }
         has = HasProperty(thread, receiverHandle, keyHandle);
+        RETURN_EXCEPTION_IF_ABRUPT_COMPLETION(thread);
         if (has) {
             break;
         }
diff --git a/ecmascript/message_string.h b/ecmascript/message_string.h
index 062d7a4e893986a274397deb679bc88e83e07728..33d67d4dbc3d7c5089b49e9bf8ded535d5e0003c 100644
--- a/ecmascript/message_string.h
+++ b/ecmascript/message_string.h
@@ -66,7 +66,8 @@ namespace panda::ecmascript {
     V(DefineFieldField, "DefineField: obj is not Object")                                    \
     V(IsNotPropertyKey, "key is not a property key")                                         \
     V(CreateDataPropertyFailed, "failed to create data property")                            \
-    V(ValueIsNonSObject, "value is not a shared object")
+    V(ValueIsNonSObject, "value is not a shared object")                                     \
+    V(IterNotObject, "JSIterator::GetIterator: iter is not object")
 
 #define DEBUG_CHECK_MESSAGE_STRING_LIST(V)                                                   \
     V(IsCallable)                                                                            \
diff --git a/ecmascript/stubs/runtime_stubs-inl.h b/ecmascript/stubs/runtime_stubs-inl.h
index 639075b4c8e86e5ae62299f14994ce414e38c21b..0256374493e5e6aa55d0322a84aefc719711e65a 100644
--- a/ecmascript/stubs/runtime_stubs-inl.h
+++ b/ecmascript/stubs/runtime_stubs-inl.h
@@ -2839,6 +2839,7 @@ JSTaggedValue RuntimeStubs::RuntimeOptConstructProxy(JSThread *thread, JSHandle<
                                                      JSHandle<JSTaggedValue> newTgt, JSHandle<JSTaggedValue> preArgs,
                                                      JSHandle<TaggedArray> args)
 {
+    STACK_LIMIT_CHECK(thread, JSTaggedValue::Exception());
     // step 1 ~ 4 get ProxyHandler and ProxyTarget
     JSHandle<JSTaggedValue> handler(thread, ctor->GetHandler());
     if (handler->IsNull()) {
diff --git a/test/moduletest/BUILD.gn b/test/moduletest/BUILD.gn
index 76a8f9e27752ec482ceff94fa0f0ef90a19a48b0..279b3a8bb65bf8390a59c513359294c5df6828eb 100644
--- a/test/moduletest/BUILD.gn
+++ b/test/moduletest/BUILD.gn
@@ -85,6 +85,7 @@ group("ark_js_moduletest") {
     "funcprotochangeobjectandnew",
     "functionapply",
     "generator",
+    "getdeletedelementsat",
     "getpropertybyindex",
     "getunmappedargs",
     "global",
@@ -114,6 +115,7 @@ group("ark_js_moduletest") {
     "multiprotoic",
     "negintmin",
     "newobjdynrange",
+    "nextinternalslowpath",
     "object",
     "objectcloneproperties",
     "objectgetownproperty",
@@ -158,6 +160,7 @@ group("ark_js_moduletest") {
     "typedarrayfill",
     "typedarrayfindlast",
     "typedarrayfrom",
+    "typedarrayiterator",
     "typedarraynan",
     "typedarraysort",
     "typedarraysubarray",
@@ -221,7 +224,10 @@ group("ark_js_moduletest") {
 
 group("ark_js_assert_moduletest") {
   testonly = true
-  assert_test_list = [ "addpropertybyname" ]
+  assert_test_list = [
+    "addpropertybyname",
+    "getvaluefrombuffer",
+  ]
 
   deps = []
   foreach(test, assert_test_list) {
@@ -236,6 +242,7 @@ group("ark_js_assert_moduletest") {
       "hugearray",
       "hugeictest",
       "multiconstpoolarray",
+      "proxyrelease",
     ]
 
     foreach(test, release_test_assert_list) {
@@ -312,6 +319,7 @@ group("ark_asm_test") {
     "funcprotochangeobjectandnew",
     "functionapply",
     "generator",
+    "getdeletedelementsat",
     "getunmappedargs",
     "global",
     "globalaccessor",
@@ -334,6 +342,7 @@ group("ark_asm_test") {
     "multiprotoic",
     "negintmin",
     "newobjdynrange",
+    "nextinternalslowpath",
     "number",
     "objectcloneproperties",
     "objectdefineproperties",
@@ -364,6 +373,7 @@ group("ark_asm_test") {
     "typedarrayfill",
     "typedarrayfindlast",
     "typedarrayfrom",
+    "typedarrayiterator",
     "typedarraynan",
     "typedarraysort",
     "typedarraytosorted",
@@ -390,6 +400,7 @@ group("ark_asm_test") {
     "sharedJSON",
     "sharedic",
     "sendable",
+    "getiterator",
   ]
 
   deps = []
@@ -423,7 +434,10 @@ group("ark_asm_test") {
 
 group("ark_asm_assert_test") {
   testonly = true
-  assert_test_list = [ "addpropertybyname" ]
+  assert_test_list = [
+    "addpropertybyname",
+    "getvaluefrombuffer",
+  ]
   deps = []
 
   foreach(test, assert_test_list) {
@@ -438,6 +452,7 @@ group("ark_asm_assert_test") {
       "hugearray",
       "hugeictest",
       "multiconstpoolarray",
+      "proxyrelease",
     ]
 
     foreach(test, release_test_assert_list) {
@@ -500,6 +515,7 @@ group("ark_asm_single_step_test") {
     "funcprotochangeobjectandnew",
     "functionapply",
     "generator",
+    "getdeletedelementsat",
     "getunmappedargs",
     "global",
     "globalaccessor",
@@ -519,6 +535,7 @@ group("ark_asm_single_step_test") {
     "multiprotoic",
     "negintmin",
     "newobjdynrange",
+    "nextinternalslowpath",
     "objectcloneproperties",
     "objecthasownproperty",
     "objectkeys",
@@ -545,6 +562,7 @@ group("ark_asm_single_step_test") {
     "typedarrayfill",
     "typedarrayfindlast",
     "typedarrayfrom",
+    "typedarrayiterator",
     "typedarraynan",
     "typedarraysort",
     "typedarraytosorted",
@@ -601,7 +619,10 @@ group("ark_asm_single_step_test") {
 
 group("ark_asm_single_step_assert_test") {
   testonly = true
-  assert_test_list = [ "addpropertybyname" ]
+  assert_test_list = [
+    "addpropertybyname",
+    "getvaluefrombuffer",
+  ]
 
   deps = []
   foreach(test, assert_test_list) {
@@ -611,7 +632,10 @@ group("ark_asm_single_step_assert_test") {
     }
   }
   if (!is_debug) {
-    release_test_assert_list = [ "multiconstpoolarray" ]
+    release_test_assert_list = [
+      "multiconstpoolarray",
+      "proxyrelease",
+    ]
 
     foreach(test, release_test_assert_list) {
       deps += [
diff --git a/test/moduletest/datetimezone/datetimezone.js b/test/moduletest/datetimezone/datetimezone.js
index 85223757b11a0f52db19222e2adfd9c4ac92a454..e589c66e01539617cae11492fc70d9966c71c54b 100755
--- a/test/moduletest/datetimezone/datetimezone.js
+++ b/test/moduletest/datetimezone/datetimezone.js
@@ -16,4 +16,11 @@ try {
     new Intl.DateTimeFormat("en" , { timeZone: "US/Alaska0" });
 } catch (e) {
     print(e instanceof RangeError);
-}
\ No newline at end of file
+}
+
+// This case aims to check stack overflow while timeZone is a long string
+try {
+    new Intl.DateTimeFormat("en", {timeZone: Array(0x8000).join("a")});
+} catch (e) {
+    print(e);
+}
diff --git a/test/moduletest/datetimezone/expect_output.txt b/test/moduletest/datetimezone/expect_output.txt
index ce415d321ab7b920f7a85495b54d7f2a762720f0..355befa0227b877cbcd268a4017d692fcdf049b0 100755
--- a/test/moduletest/datetimezone/expect_output.txt
+++ b/test/moduletest/datetimezone/expect_output.txt
@@ -12,3 +12,4 @@
 # limitations under the License.
 
 true
+RangeError: invalid timeZone
diff --git a/test/moduletest/getdeletedelementsat/BUILD.gn b/test/moduletest/getdeletedelementsat/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..1e8c7000a94df462140c530d8bf88225df08a524
--- /dev/null
+++ b/test/moduletest/getdeletedelementsat/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_moduletest_action("getdeletedelementsat") {
+  deps = []
+}
diff --git a/test/moduletest/getdeletedelementsat/expect_output.txt b/test/moduletest/getdeletedelementsat/expect_output.txt
new file mode 100644
index 0000000000000000000000000000000000000000..48c2f6e60af0cb8c678bcf17de0f7d2be063ca8a
--- /dev/null
+++ b/test/moduletest/getdeletedelementsat/expect_output.txt
@@ -0,0 +1,14 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+Test runs successfully!
diff --git a/test/moduletest/getdeletedelementsat/getdeletedelementsat.js b/test/moduletest/getdeletedelementsat/getdeletedelementsat.js
new file mode 100644
index 0000000000000000000000000000000000000000..bdbfed988cce40fed3cb60da16a02e144e96ed29
--- /dev/null
+++ b/test/moduletest/getdeletedelementsat/getdeletedelementsat.js
@@ -0,0 +1,33 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @tc.name:getdeletedelementsat
+ * @tc.desc:test GetDeletedElementsAt
+ * @tc.type: FUNC
+ * @tc.require: issueIBFP2E
+ */
+
+// This case aims to check return value of GetDeletedElementsAt
+{
+    let map1 = new Map();
+    map1.set(0, 1);
+    map1.set(1, 2);
+    map1.set(2, 3);
+    map1.set(3, 4);
+    map1.delete(0);
+    map1.forEach(function () { map1.clear() });
+    print("Test runs successfully!");
+}
diff --git a/test/moduletest/getiterator/BUILD.gn b/test/moduletest/getiterator/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..c6073310882f1b0941b6ea1ec542e4b92c2881ba
--- /dev/null
+++ b/test/moduletest/getiterator/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_moduletest_action("getiterator") {
+  deps = []
+}
diff --git a/test/moduletest/getiterator/expect_output.txt b/test/moduletest/getiterator/expect_output.txt
new file mode 100644
index 0000000000000000000000000000000000000000..65a51cc345138b4712174f1f129e353692a880dd
--- /dev/null
+++ b/test/moduletest/getiterator/expect_output.txt
@@ -0,0 +1,14 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+TypeError: JSIterator::GetIterator: iter is not object
diff --git a/test/moduletest/getiterator/getiterator.js b/test/moduletest/getiterator/getiterator.js
new file mode 100644
index 0000000000000000000000000000000000000000..8b625d6ef95013d6777f6adc26347436c2d9ec20
--- /dev/null
+++ b/test/moduletest/getiterator/getiterator.js
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @tc.name:getiterator
+ * @tc.desc:test StubBuilder::GetIterator
+ * @tc.type: FUNC
+ * @tc.require: issueIBDZ1R
+ */
+
+// This case aims to test the logic which check the undefined result of GetIterator.
+{
+    class c2 extends Object {}
+    Array.prototype[Symbol.iterator] = function () {};
+    try {
+        let myC2 = new c2();
+    } catch (error) {
+        print(error);
+    }
+}
diff --git a/test/moduletest/getvaluefrombuffer/BUILD.gn b/test/moduletest/getvaluefrombuffer/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..f351f2e1698797d70324ed2d472210e0882de738
--- /dev/null
+++ b/test/moduletest/getvaluefrombuffer/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_moduletest_assert_action("getvaluefrombuffer") {
+  deps = []
+}
diff --git a/test/moduletest/getvaluefrombuffer/getvaluefrombuffer.js b/test/moduletest/getvaluefrombuffer/getvaluefrombuffer.js
new file mode 100644
index 0000000000000000000000000000000000000000..e8d22f7c12ddb6d764896c33e9eb0715857cab5a
--- /dev/null
+++ b/test/moduletest/getvaluefrombuffer/getvaluefrombuffer.js
@@ -0,0 +1,32 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @tc.name:getvaluefrombuffer
+ * @tc.desc:test BuiltinsTypedArrayStubBuilder::GetValueFromBuffer
+ * @tc.type: FUNC
+ * @tc.require: issueIBDK44
+ */
+
+// This case aims to check overflow of double in BuiltinsTypedArrayStubBuilder::GetValueFromBuffer
+{
+    let v0 = new ArrayBuffer(8);
+    let v1 = new Int32Array(v0);
+    v1[0] = 0xcafe0000;
+    v1[1] = 0xffff0000;
+    let v2 = new Float64Array(v0);
+    Array.prototype.push.apply(v0, v2);
+    assert_equal(Number.isNaN(v2[0]), true);
+}
diff --git a/test/moduletest/nextinternalslowpath/BUILD.gn b/test/moduletest/nextinternalslowpath/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..a3b9aeceef38c30e037285df18efd5064251ad4c
--- /dev/null
+++ b/test/moduletest/nextinternalslowpath/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_moduletest_action("nextinternalslowpath") {
+  deps = []
+}
diff --git a/test/moduletest/nextinternalslowpath/expect_output.txt b/test/moduletest/nextinternalslowpath/expect_output.txt
new file mode 100644
index 0000000000000000000000000000000000000000..52a34023e7e1d06d0099ee52c9ddf044b50156ec
--- /dev/null
+++ b/test/moduletest/nextinternalslowpath/expect_output.txt
@@ -0,0 +1,14 @@
+# Copyright (c) 2025 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+TypeError: Cannot define property
diff --git a/test/moduletest/nextinternalslowpath/nextinternalslowpath.js b/test/moduletest/nextinternalslowpath/nextinternalslowpath.js
new file mode 100644
index 0000000000000000000000000000000000000000..d77958c34b6fb4d1f815e0936331d7fad1364674
--- /dev/null
+++ b/test/moduletest/nextinternalslowpath/nextinternalslowpath.js
@@ -0,0 +1,41 @@
+/*
+ * Copyright (c) 2025 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @tc.name:nextinternalslowpath
+ * @tc.desc:test JSForInIterator::NextInternalSlowpath
+ * @tc.type: FUNC
+ * @tc.require: issueIBJL5S
+ */
+
+// This case aims to test if JSForInIterator::NextInternalSlowpath could return exception.
+{
+    function test_func() {}
+    function f0() {}
+    let v12 = new Proxy(Object.create(null, {x: {enumerable: true}}), {
+        getOwnPropertyDescriptor(v13, v14) {
+            if (v13 != null && typeof v13 == "object") {
+                Object.defineProperty(v13, test_func(), {get: function () {}});
+            }
+            return Reflect.getOwnPropertyDescriptor(v13, v14);
+        }
+    });
+    try {
+        for (let v15 in v12) {}
+        f0([1]);
+    } catch (e) {
+        print(e);
+    }
+}
diff --git a/test/moduletest/proxyrelease/BUILD.gn b/test/moduletest/proxyrelease/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..3b0f1d906aecdb89a4ba20ce057b88fe72e2f5a6
--- /dev/null
+++ b/test/moduletest/proxyrelease/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_moduletest_assert_action("proxyrelease") {
+  deps = []
+}
diff --git a/test/moduletest/proxyrelease/proxyrelease.js b/test/moduletest/proxyrelease/proxyrelease.js
new file mode 100644
index 0000000000000000000000000000000000000000..c6fe4e8b03410bc630a0cb95c84425f4b2136ef9
--- /dev/null
+++ b/test/moduletest/proxyrelease/proxyrelease.js
@@ -0,0 +1,37 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @tc.name:proxy
+ * @tc.desc:test proxy
+ * @tc.type: FUNC
+ * @tc.require: issueIBCUJM
+ */
+
+// This case aims to test if there's stack-overflow checking in RuntimeOptConstructProxy
+{
+    let v0 = new Proxy(function () {}, {});
+    for (let v1 = 0; v1 < 10000; v1++) {
+        v0 = new Proxy(v0, {});
+    }
+    let error = new Error();
+    try {
+        new v0(0);
+    } catch (e) {
+        error = e;
+    }
+    assert_equal(error.name, "RangeError");
+    assert_equal(error.message, "Stack overflow!");
+}
diff --git a/test/moduletest/typedarrayiterator/BUILD.gn b/test/moduletest/typedarrayiterator/BUILD.gn
new file mode 100644
index 0000000000000000000000000000000000000000..9a538c4664434e8cfc9c662c5192c046051b99a3
--- /dev/null
+++ b/test/moduletest/typedarrayiterator/BUILD.gn
@@ -0,0 +1,18 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import("//arkcompiler/ets_runtime/test/test_helper.gni")
+
+host_moduletest_action("typedarrayiterator") {
+  deps = []
+}
diff --git a/test/moduletest/typedarrayiterator/expect_output.txt b/test/moduletest/typedarrayiterator/expect_output.txt
new file mode 100644
index 0000000000000000000000000000000000000000..2faecb946a6ca22c1d7795f40b7866a3f8e2cf90
--- /dev/null
+++ b/test/moduletest/typedarrayiterator/expect_output.txt
@@ -0,0 +1,14 @@
+# Copyright (c) 2024 Huawei Device Co., Ltd.
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+TypeError: Callable is false
diff --git a/test/moduletest/typedarrayiterator/typedarrayiterator.js b/test/moduletest/typedarrayiterator/typedarrayiterator.js
new file mode 100644
index 0000000000000000000000000000000000000000..6e54f6a9b1c7069c484c47470e02dce54feafb19
--- /dev/null
+++ b/test/moduletest/typedarrayiterator/typedarrayiterator.js
@@ -0,0 +1,31 @@
+/*
+ * Copyright (c) 2024 Huawei Device Co., Ltd.
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * @tc.name:typedarrayiterator
+ * @tc.desc:test TypedArray.iterator
+ * @tc.type: FUNC
+ */
+
+let v2 = new Uint8Array([1, 2, 3]);
+let v3 = v2[Symbol.iterator]();
+let nextBak = v3.__proto__["next"];
+v3.__proto__["next"] = null;
+try {
+    print(Uint8Array.from(v2));
+} catch (e) {
+    print(e);
+}
+v3.__proto__["next"] = nextBak;