Improved code generation infrastructure by doing simple register allocation and constant folding and propagation.

Optimized regular expression matching by avoiding to create intermediate string arrays and by flattening nested array representations of RegExp data.

Traverse a few stack frames when recording profiler samples to include partial call graphs in the profiling output.

Added support for using OProfile to profile generated code.

Added remote debugging support to the D8 developer shell.

Optimized creation of nested literals like JSON objects.

Fixed a bug in garbage collecting unused maps and turned it on by default (--collect-maps).

Added support for running tests under Valgrind.


git-svn-id: http://v8.googlecode.com/svn/trunk@1495 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/test/cctest/SConscript b/test/cctest/SConscript
index c2b6748..091768f 100644
--- a/test/cctest/SConscript
+++ b/test/cctest/SConscript
@@ -34,15 +34,33 @@
 
 SOURCES = {
   'all': [
-    'test-hashmap.cc', 'test-debug.cc', 'test-api.cc', 'test-flags.cc',
-    'test-ast.cc', 'test-heap.cc', 'test-utils.cc', 'test-compiler.cc',
-    'test-spaces.cc', 'test-mark-compact.cc', 'test-lock.cc',
-    'test-conversions.cc', 'test-strings.cc', 'test-serialize.cc',
-    'test-decls.cc', 'test-alloc.cc', 'test-regexp.cc', 'test-threads.cc',
-    'test-sockets.cc'
+    'test-alloc.cc',
+    'test-api.cc',
+    'test-ast.cc',
+    'test-compiler.cc',
+    'test-conversions.cc',
+    'test-debug.cc',
+    'test-decls.cc',
+    'test-flags.cc',
+    'test-hashmap.cc',
+    'test-heap.cc',
+    'test-list.cc',
+    'test-lock.cc',
+    'test-mark-compact.cc',
+    'test-regexp.cc',
+    'test-serialize.cc',
+    'test-sockets.cc',
+    'test-spaces.cc',
+    'test-strings.cc',
+    'test-threads.cc',
+    'test-utils.cc'
   ],
   'arch:arm':  ['test-assembler-arm.cc', 'test-disasm-arm.cc'],
-  'arch:ia32': ['test-assembler-ia32.cc', 'test-disasm-ia32.cc', 'test-log-ia32.cc'],
+  'arch:ia32': [
+    'test-assembler-ia32.cc',
+    'test-disasm-ia32.cc',
+    'test-log-ia32.cc'
+  ],
   'os:linux':  ['test-platform-linux.cc'],
   'os:macos':  ['test-platform-macos.cc'],
   'os:nullos': ['test-platform-nullos.cc'],
diff --git a/test/cctest/cctest.status b/test/cctest/cctest.status
index aa81dd1..9ff11ba 100644
--- a/test/cctest/cctest.status
+++ b/test/cctest/cctest.status
@@ -39,3 +39,11 @@
 
 # BUG(240): Test seems flaky on ARM.
 test-api/RegExpInterruption: SKIP
+
+# BUG(271): After exception propagation changes that compares pointers
+# into the stack, these tests fail on the arm simulator (but pass on
+# the arm hardware) because the JS stack is not combined with the C
+# stack in the simulator.  Disabling while we consider how to solve
+# the issue for the simulator.
+test-api/ExceptionOrder: PASS || FAIL
+test-api/TryCatchInTryFinally: PASS || FAIL
diff --git a/test/cctest/test-api.cc b/test/cctest/test-api.cc
index 6868b81..c6df1ac 100644
--- a/test/cctest/test-api.cc
+++ b/test/cctest/test-api.cc
@@ -1722,7 +1722,8 @@
   if (args.Length() < 1) return v8::Boolean::New(false);
   v8::HandleScope scope;
   v8::TryCatch try_catch;
-  v8::Script::Compile(args[0]->ToString())->Run();
+  Local<Value> result = v8::Script::Compile(args[0]->ToString())->Run();
+  CHECK(!try_catch.HasCaught() || result.IsEmpty());
   return v8::Boolean::New(try_catch.HasCaught());
 }
 
@@ -1759,7 +1760,11 @@
 
 // Test that a try-finally block doesn't shadow a try-catch block
 // when setting up an external handler.
-THREADED_TEST(TryCatchInTryFinally) {
+//
+// TODO(271): This should be a threaded test. It was disabled for the
+// thread tests because it fails on the ARM simulator.  Should be made
+// threadable again when the simulator issue is resolved.
+TEST(TryCatchInTryFinally) {
   v8::HandleScope scope;
   Local<ObjectTemplate> templ = ObjectTemplate::New();
   templ->Set(v8_str("CCatcher"),
@@ -1806,8 +1811,9 @@
   LocalContext context(0, templ);
   v8::TryCatch try_catch;
   try_catch.SetVerbose(true);
-  CompileRun("ThrowFromC();");
+  Local<Value> result = CompileRun("ThrowFromC();");
   CHECK(try_catch.HasCaught());
+  CHECK(result.IsEmpty());
   CHECK(message_received);
   v8::V8::RemoveMessageListeners(check_message);
 }
@@ -1853,6 +1859,7 @@
       int expected = args[3]->Int32Value();
       if (try_catch.HasCaught()) {
         CHECK_EQ(expected, count);
+        CHECK(result.IsEmpty());
         CHECK(!i::Top::has_scheduled_exception());
       } else {
         CHECK_NE(expected, count);
@@ -1910,7 +1917,11 @@
 // Each entry is an activation, either JS or C.  The index is the count at that
 // level.  Stars identify activations with exception handlers, the @ identifies
 // the exception handler that should catch the exception.
-THREADED_TEST(ExceptionOrder) {
+//
+// TODO(271): This should be a threaded test. It was disabled for the
+// thread tests because it fails on the ARM simulator.  Should be made
+// threadable again when the simulator issue is resolved.
+TEST(ExceptionOrder) {
   v8::HandleScope scope;
   Local<ObjectTemplate> templ = ObjectTemplate::New();
   templ->Set(v8_str("check"), v8::FunctionTemplate::New(JSCheck));
@@ -5320,6 +5331,28 @@
 }
 
 
+static void CheckTryCatchSourceInfo(v8::Handle<v8::Script> script,
+                                    const char* resource_name,
+                                    int line_offset) {
+  v8::HandleScope scope;
+  v8::TryCatch try_catch;
+  v8::Handle<v8::Value> result = script->Run();
+  CHECK(result.IsEmpty());
+  CHECK(try_catch.HasCaught());
+  v8::Handle<v8::Message> message = try_catch.Message();
+  CHECK(!message.IsEmpty());
+  CHECK_EQ(10 + line_offset, message->GetLineNumber());
+  CHECK_EQ(91, message->GetStartPosition());
+  CHECK_EQ(92, message->GetEndPosition());
+  CHECK_EQ(2, message->GetStartColumn());
+  CHECK_EQ(3, message->GetEndColumn());
+  v8::String::AsciiValue line(message->GetSourceLine());
+  CHECK_EQ("  throw 'nirk';", *line);
+  v8::String::AsciiValue name(message->GetScriptResourceName());
+  CHECK_EQ(resource_name, *name);
+}
+
+
 THREADED_TEST(TryCatchSourceInfo) {
   v8::HandleScope scope;
   LocalContext context;
@@ -5337,23 +5370,22 @@
       "}\n"
       "\n"
       "Foo();\n");
-  v8::Handle<v8::Script> script =
-      v8::Script::Compile(source, v8::String::New("test.js"));
-  v8::TryCatch try_catch;
-  v8::Handle<v8::Value> result = script->Run();
-  CHECK(result.IsEmpty());
-  CHECK(try_catch.HasCaught());
-  v8::Handle<v8::Message> message = try_catch.Message();
-  CHECK(!message.IsEmpty());
-  CHECK_EQ(10, message->GetLineNumber());
-  CHECK_EQ(91, message->GetStartPosition());
-  CHECK_EQ(92, message->GetEndPosition());
-  CHECK_EQ(2, message->GetStartColumn());
-  CHECK_EQ(3, message->GetEndColumn());
-  v8::String::AsciiValue line(message->GetSourceLine());
-  CHECK_EQ("  throw 'nirk';", *line);
-  v8::String::AsciiValue name(message->GetScriptResourceName());
-  CHECK_EQ("test.js", *name);
+
+  const char* resource_name;
+  v8::Handle<v8::Script> script;
+  resource_name = "test.js";
+  script = v8::Script::Compile(source, v8::String::New(resource_name));
+  CheckTryCatchSourceInfo(script, resource_name, 0);
+
+  resource_name = "test1.js";
+  v8::ScriptOrigin origin1(v8::String::New(resource_name));
+  script = v8::Script::Compile(source, &origin1);
+  CheckTryCatchSourceInfo(script, resource_name, 0);
+
+  resource_name = "test2.js";
+  v8::ScriptOrigin origin2(v8::String::New(resource_name), v8::Integer::New(7));
+  script = v8::Script::Compile(source, &origin2);
+  CheckTryCatchSourceInfo(script, resource_name, 7);
 }
 
 
diff --git a/test/cctest/test-compiler.cc b/test/cctest/test-compiler.cc
index b4da9d5..08037b3 100644
--- a/test/cctest/test-compiler.cc
+++ b/test/cctest/test-compiler.cc
@@ -312,7 +312,7 @@
 
   Handle<Script> script = Factory::NewScript(Factory::empty_string());
   script->set_source(Heap::undefined_value());
-  CHECK_EQ(-1, script->GetLineNumber(0));
-  CHECK_EQ(-1, script->GetLineNumber(100));
-  CHECK_EQ(-1, script->GetLineNumber(-1));
+  CHECK_EQ(-1, GetScriptLineNumber(script, 0));
+  CHECK_EQ(-1, GetScriptLineNumber(script, 100));
+  CHECK_EQ(-1, GetScriptLineNumber(script, -1));
 }
diff --git a/test/cctest/test-debug.cc b/test/cctest/test-debug.cc
index f8a2dd0..280d507 100644
--- a/test/cctest/test-debug.cc
+++ b/test/cctest/test-debug.cc
@@ -210,20 +210,46 @@
 }
 
 
-// Set a break point in a script using the global Debug object.
-static int SetScriptBreakPointFromJS(const char* script_data,
-                                     int line, int column) {
+// Set a break point in a script identified by id using the global Debug object.
+static int SetScriptBreakPointByIdFromJS(int script_id, int line, int column) {
   EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
   if (column >= 0) {
     // Column specified set script break point on precise location.
     OS::SNPrintF(buffer,
-                 "debug.Debug.setScriptBreakPoint(\"%s\",%d,%d)",
-                 script_data, line, column);
+                 "debug.Debug.setScriptBreakPointById(%d,%d,%d)",
+                 script_id, line, column);
   } else {
     // Column not specified set script break point on line.
     OS::SNPrintF(buffer,
-                 "debug.Debug.setScriptBreakPoint(\"%s\",%d)",
-                 script_data, line);
+                 "debug.Debug.setScriptBreakPointById(%d,%d)",
+                 script_id, line);
+  }
+  buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
+  {
+    v8::TryCatch try_catch;
+    v8::Handle<v8::String> str = v8::String::New(buffer.start());
+    v8::Handle<v8::Value> value = v8::Script::Compile(str)->Run();
+    ASSERT(!try_catch.HasCaught());
+    return value->Int32Value();
+  }
+}
+
+
+// Set a break point in a script identified by name using the global Debug
+// object.
+static int SetScriptBreakPointByNameFromJS(const char* script_name,
+                                           int line, int column) {
+  EmbeddedVector<char, SMALL_STRING_BUFFER_SIZE> buffer;
+  if (column >= 0) {
+    // Column specified set script break point on precise location.
+    OS::SNPrintF(buffer,
+                 "debug.Debug.setScriptBreakPointByName(\"%s\",%d,%d)",
+                 script_name, line, column);
+  } else {
+    // Column not specified set script break point on line.
+    OS::SNPrintF(buffer,
+                 "debug.Debug.setScriptBreakPointByName(\"%s\",%d)",
+                 script_name, line);
   }
   buffer[SMALL_STRING_BUFFER_SIZE - 1] = '\0';
   {
@@ -511,7 +537,7 @@
                                          v8::Handle<v8::Object> event_data,
                                          v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   // Count the number of breaks.
   if (event == v8::Break) {
@@ -551,7 +577,7 @@
                               v8::Handle<v8::Object> event_data,
                               v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   // Count the number of breaks.
   if (event == v8::Break) {
@@ -609,7 +635,7 @@
                                v8::Handle<v8::Object> event_data,
                                v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   if (event == v8::Break) {
     for (int i = 0; checks[i].expr != NULL; i++) {
@@ -635,7 +661,7 @@
                                        v8::Handle<v8::Object> event_data,
                                        v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   if (event == v8::Break) {
     break_point_hit_count++;
@@ -653,7 +679,7 @@
                            v8::Handle<v8::Object> event_data,
                            v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   if (event == v8::Break) {
     break_point_hit_count++;
@@ -679,7 +705,7 @@
                                    v8::Handle<v8::Object> event_data,
                                    v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   if (event == v8::Break || event == v8::Exception) {
     // Check that the current function is the expected.
@@ -709,7 +735,7 @@
     v8::Handle<v8::Object> event_data,
     v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   // Perform a garbage collection when break point is hit and continue. Based
   // on the number of break points hit either scavenge or mark compact
@@ -734,7 +760,7 @@
                             v8::Handle<v8::Object> event_data,
                             v8::Handle<v8::Value> data) {
   // When hitting a debug event listener there must be a break set.
-  CHECK(v8::internal::Top::is_break());
+  CHECK_NE(v8::internal::Debug::break_id(), 0);
 
   if (event == v8::Break) {
     // Count the number of breaks.
@@ -1166,8 +1192,9 @@
 }
 
 
-// Test that break points can be set using the global Debug object.
-TEST(ScriptBreakPointThroughJavaScript) {
+// Test that break points on scripts identified by name can be set using the
+// global Debug object.
+TEST(ScriptBreakPointByNameThroughJavaScript) {
   break_point_hit_count = 0;
   v8::HandleScope scope;
   DebugLocalContext env;
@@ -1175,7 +1202,6 @@
 
   v8::Debug::SetDebugEventListener(DebugEventBreakPointHitCount,
                                    v8::Undefined());
-  v8::Script::Compile(v8::String::New("function foo(){bar();bar();}"))->Run();
 
   v8::Local<v8::String> script = v8::String::New(
     "function f() {\n"
@@ -1213,7 +1239,7 @@
   CHECK_EQ(0, break_point_hit_count);
 
   // Call f and g with break point on line 12.
-  int sbp1 = SetScriptBreakPointFromJS("test", 12, 0);
+  int sbp1 = SetScriptBreakPointByNameFromJS("test", 12, 0);
   break_point_hit_count = 0;
   f->Call(env->Global(), 0, NULL);
   CHECK_EQ(0, break_point_hit_count);
@@ -1229,7 +1255,7 @@
   CHECK_EQ(0, break_point_hit_count);
 
   // Call f and g with break point on line 2.
-  int sbp2 = SetScriptBreakPointFromJS("test", 2, 0);
+  int sbp2 = SetScriptBreakPointByNameFromJS("test", 2, 0);
   break_point_hit_count = 0;
   f->Call(env->Global(), 0, NULL);
   CHECK_EQ(1, break_point_hit_count);
@@ -1237,17 +1263,17 @@
   CHECK_EQ(2, break_point_hit_count);
 
   // Call f and g with break point on line 2, 4, 12, 14 and 15.
-  int sbp3 = SetScriptBreakPointFromJS("test", 4, 0);
-  int sbp4 = SetScriptBreakPointFromJS("test", 12, 0);
-  int sbp5 = SetScriptBreakPointFromJS("test", 14, 0);
-  int sbp6 = SetScriptBreakPointFromJS("test", 15, 0);
+  int sbp3 = SetScriptBreakPointByNameFromJS("test", 4, 0);
+  int sbp4 = SetScriptBreakPointByNameFromJS("test", 12, 0);
+  int sbp5 = SetScriptBreakPointByNameFromJS("test", 14, 0);
+  int sbp6 = SetScriptBreakPointByNameFromJS("test", 15, 0);
   break_point_hit_count = 0;
   f->Call(env->Global(), 0, NULL);
   CHECK_EQ(2, break_point_hit_count);
   g->Call(env->Global(), 0, NULL);
   CHECK_EQ(7, break_point_hit_count);
 
-  // Remove the all the break points again.
+  // Remove all the break points again.
   break_point_hit_count = 0;
   ClearBreakPointFromJS(sbp2);
   ClearBreakPointFromJS(sbp3);
@@ -1259,19 +1285,114 @@
   g->Call(env->Global(), 0, NULL);
   CHECK_EQ(0, break_point_hit_count);
 
-  // Now set a function break point
-  int bp7 = SetBreakPointFromJS("g", 0, 0);
+  v8::Debug::SetDebugEventListener(NULL);
+  CheckDebuggerUnloaded();
+
+  // Make sure that the break point numbers are consecutive.
+  CHECK_EQ(1, sbp1);
+  CHECK_EQ(2, sbp2);
+  CHECK_EQ(3, sbp3);
+  CHECK_EQ(4, sbp4);
+  CHECK_EQ(5, sbp5);
+  CHECK_EQ(6, sbp6);
+}
+
+
+TEST(ScriptBreakPointByIdThroughJavaScript) {
+  break_point_hit_count = 0;
+  v8::HandleScope scope;
+  DebugLocalContext env;
+  env.ExposeDebug();
+
+  v8::Debug::SetDebugEventListener(DebugEventBreakPointHitCount,
+                                   v8::Undefined());
+
+  v8::Local<v8::String> source = v8::String::New(
+    "function f() {\n"
+    "  function h() {\n"
+    "    a = 0;  // line 2\n"
+    "  }\n"
+    "  b = 1;  // line 4\n"
+    "  return h();\n"
+    "}\n"
+    "\n"
+    "function g() {\n"
+    "  function h() {\n"
+    "    a = 0;\n"
+    "  }\n"
+    "  b = 2;  // line 12\n"
+    "  h();\n"
+    "  b = 3;  // line 14\n"
+    "  f();    // line 15\n"
+    "}");
+
+  // Compile the script and get the two functions.
+  v8::ScriptOrigin origin =
+      v8::ScriptOrigin(v8::String::New("test"));
+  v8::Local<v8::Script> script = v8::Script::Compile(source, &origin);
+  script->Run();
+  v8::Local<v8::Function> f =
+      v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("f")));
+  v8::Local<v8::Function> g =
+      v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("g")));
+
+  // Get the script id knowing that internally it is a 32 integer.
+  uint32_t script_id = script->Id()->Uint32Value();
+
+  // Call f and g without break points.
+  break_point_hit_count = 0;
+  f->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
+  g->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Call f and g with break point on line 12.
+  int sbp1 = SetScriptBreakPointByIdFromJS(script_id, 12, 0);
+  break_point_hit_count = 0;
+  f->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
   g->Call(env->Global(), 0, NULL);
   CHECK_EQ(1, break_point_hit_count);
 
-  // Reload the script and get g again checking that the break point survives.
-  // This tests that the function break point was converted to a script break
-  // point.
-  v8::Script::Compile(script, &origin)->Run();
-  g = v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("g")));
+  // Remove the break point again.
+  break_point_hit_count = 0;
+  ClearBreakPointFromJS(sbp1);
+  f->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
+  g->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
+
+  // Call f and g with break point on line 2.
+  int sbp2 = SetScriptBreakPointByIdFromJS(script_id, 2, 0);
+  break_point_hit_count = 0;
+  f->Call(env->Global(), 0, NULL);
+  CHECK_EQ(1, break_point_hit_count);
   g->Call(env->Global(), 0, NULL);
   CHECK_EQ(2, break_point_hit_count);
 
+  // Call f and g with break point on line 2, 4, 12, 14 and 15.
+  int sbp3 = SetScriptBreakPointByIdFromJS(script_id, 4, 0);
+  int sbp4 = SetScriptBreakPointByIdFromJS(script_id, 12, 0);
+  int sbp5 = SetScriptBreakPointByIdFromJS(script_id, 14, 0);
+  int sbp6 = SetScriptBreakPointByIdFromJS(script_id, 15, 0);
+  break_point_hit_count = 0;
+  f->Call(env->Global(), 0, NULL);
+  CHECK_EQ(2, break_point_hit_count);
+  g->Call(env->Global(), 0, NULL);
+  CHECK_EQ(7, break_point_hit_count);
+
+  // Remove all the break points again.
+  break_point_hit_count = 0;
+  ClearBreakPointFromJS(sbp2);
+  ClearBreakPointFromJS(sbp3);
+  ClearBreakPointFromJS(sbp4);
+  ClearBreakPointFromJS(sbp5);
+  ClearBreakPointFromJS(sbp6);
+  f->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
+  g->Call(env->Global(), 0, NULL);
+  CHECK_EQ(0, break_point_hit_count);
+
   v8::Debug::SetDebugEventListener(NULL);
   CheckDebuggerUnloaded();
 
@@ -1282,7 +1403,6 @@
   CHECK_EQ(4, sbp4);
   CHECK_EQ(5, sbp5);
   CHECK_EQ(6, sbp6);
-  CHECK_EQ(7, bp7);
 }
 
 
@@ -1309,7 +1429,7 @@
       v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("f")));
 
   // Set script break point on line 1 (in function f).
-  int sbp = SetScriptBreakPointFromJS("test", 1, 0);
+  int sbp = SetScriptBreakPointByNameFromJS("test", 1, 0);
 
   // Call f while enabeling and disabling the script break point.
   break_point_hit_count = 0;
@@ -1370,7 +1490,7 @@
       v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("f")));
 
   // Set script break point on line 5 (in function g).
-  int sbp1 = SetScriptBreakPointFromJS("test", 5, 0);
+  int sbp1 = SetScriptBreakPointByNameFromJS("test", 5, 0);
 
   // Call f with different conditions on the script break point.
   break_point_hit_count = 0;
@@ -1428,7 +1548,7 @@
       v8::Local<v8::Function>::Cast(env->Global()->Get(v8::String::New("f")));
 
   // Set script break point on line 1 (in function f).
-  int sbp = SetScriptBreakPointFromJS("test", 1, 0);
+  int sbp = SetScriptBreakPointByNameFromJS("test", 1, 0);
 
   // Call f with different ignores on the script break point.
   break_point_hit_count = 0;
@@ -1484,7 +1604,7 @@
   v8::ScriptOrigin origin_2 = v8::ScriptOrigin(v8::String::New("2"));
 
   // Set a script break point before the script is loaded.
-  SetScriptBreakPointFromJS("1", 2, 0);
+  SetScriptBreakPointByNameFromJS("1", 2, 0);
 
   // Compile the script and get the function.
   v8::Script::Compile(script, &origin_1)->Run();
@@ -1545,7 +1665,7 @@
       v8::ScriptOrigin(v8::String::New("test"));
 
   // Set a script break point before the scripts are loaded.
-  int sbp = SetScriptBreakPointFromJS("test", 1, 0);
+  int sbp = SetScriptBreakPointByNameFromJS("test", 1, 0);
 
   // Compile the scripts with same script data and get the functions.
   v8::Script::Compile(script_f, &origin)->Run();
@@ -1571,7 +1691,7 @@
   CHECK_EQ(0, break_point_hit_count);
 
   // Set script break point with the scripts loaded.
-  sbp = SetScriptBreakPointFromJS("test", 1, 0);
+  sbp = SetScriptBreakPointByNameFromJS("test", 1, 0);
 
   // Call f and g and check that the script break point is active.
   break_point_hit_count = 0;
@@ -1607,8 +1727,8 @@
                           v8::Integer::New(7));
 
   // Set two script break points before the script is loaded.
-  int sbp1 = SetScriptBreakPointFromJS("test.html", 8, 0);
-  int sbp2 = SetScriptBreakPointFromJS("test.html", 9, 0);
+  int sbp1 = SetScriptBreakPointByNameFromJS("test.html", 8, 0);
+  int sbp2 = SetScriptBreakPointByNameFromJS("test.html", 9, 0);
 
   // Compile the script and get the function.
   v8::Script::Compile(script, &origin)->Run();
@@ -1629,7 +1749,7 @@
   CHECK_EQ(0, break_point_hit_count);
 
   // Set a script break point with the script loaded.
-  sbp1 = SetScriptBreakPointFromJS("test.html", 9, 0);
+  sbp1 = SetScriptBreakPointByNameFromJS("test.html", 9, 0);
 
   // Call f and check that the script break point is active.
   break_point_hit_count = 0;
@@ -1673,9 +1793,9 @@
     " a=5;                      // line 12");
 
   // Set a couple script break point before the script is loaded.
-  int sbp1 = SetScriptBreakPointFromJS("test.html", 0, -1);
-  int sbp2 = SetScriptBreakPointFromJS("test.html", 1, -1);
-  int sbp3 = SetScriptBreakPointFromJS("test.html", 5, -1);
+  int sbp1 = SetScriptBreakPointByNameFromJS("test.html", 0, -1);
+  int sbp2 = SetScriptBreakPointByNameFromJS("test.html", 1, -1);
+  int sbp3 = SetScriptBreakPointByNameFromJS("test.html", 5, -1);
 
   // Compile the script and get the function.
   break_point_hit_count = 0;
@@ -1700,7 +1820,7 @@
 
   // Clear the script break point on g and set one on h.
   ClearBreakPointFromJS(sbp3);
-  int sbp4 = SetScriptBreakPointFromJS("test.html", 6, -1);
+  int sbp4 = SetScriptBreakPointByNameFromJS("test.html", 6, -1);
 
   // Call g and check that the script break point in h is hit.
   g->Call(env->Global(), 0, NULL);
@@ -1712,7 +1832,7 @@
   // more.
   ClearBreakPointFromJS(sbp2);
   ClearBreakPointFromJS(sbp4);
-  int sbp5 = SetScriptBreakPointFromJS("test.html", 4, -1);
+  int sbp5 = SetScriptBreakPointByNameFromJS("test.html", 4, -1);
   break_point_hit_count = 0;
   f->Call(env->Global(), 0, NULL);
   g->Call(env->Global(), 0, NULL);
@@ -1725,7 +1845,7 @@
   CHECK_EQ(0, strlen(last_function_hit));
 
   // Set a break point in the code after the last function decleration.
-  int sbp6 = SetScriptBreakPointFromJS("test.html", 12, -1);
+  int sbp6 = SetScriptBreakPointByNameFromJS("test.html", 12, -1);
 
   // Reload the script which should hit three break points.
   break_point_hit_count = 0;
@@ -3695,4 +3815,3 @@
   // The host dispatch callback should be called.
   CHECK_EQ(1, host_dispatch_hit_count);
 }
-
diff --git a/test/cctest/test-list.cc b/test/cctest/test-list.cc
new file mode 100644
index 0000000..d10cdd7
--- /dev/null
+++ b/test/cctest/test-list.cc
@@ -0,0 +1,67 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include <stdlib.h>
+#include <string.h>
+#include "v8.h"
+#include "cctest.h"
+
+using namespace v8::internal;
+
+// Use a testing allocator that clears memory before deletion.
+class ZeroingAllocationPolicy {
+ public:
+  static void* New(size_t size) {
+    // Stash the size in the first word to use for Delete.
+    size_t true_size = size + sizeof(size_t);
+    size_t* result = reinterpret_cast<size_t*>(malloc(true_size));
+    if (result == NULL) return result;
+    *result = true_size;
+    return result + 1;
+  }
+
+  static void Delete(void* ptr) {
+    size_t* true_ptr = reinterpret_cast<size_t*>(ptr) - 1;
+    memset(true_ptr, 0, *true_ptr);
+    free(true_ptr);
+  }
+};
+
+// Check that we can add (a reference to) an element of the list
+// itself.
+TEST(ListAdd) {
+  // Add elements to the list to grow it to its capacity.
+  List<int, ZeroingAllocationPolicy> list(4);
+  list.Add(1);
+  list.Add(2);
+  list.Add(3);
+  list.Add(4);
+
+  // Add an existing element, the backing store should have to grow.
+  list.Add(list[0]);
+  ASSERT(list[4] == 1);
+}
diff --git a/test/cctest/test-log-ia32.cc b/test/cctest/test-log-ia32.cc
index 9e2d2f4..588be71 100644
--- a/test/cctest/test-log-ia32.cc
+++ b/test/cctest/test-log-ia32.cc
@@ -43,7 +43,7 @@
 static void DoTrace(unsigned int fp) {
   trace_env.sample->fp = fp;
   // something that is less than fp
-  trace_env.sample->sp = trace_env.sample->fp - sizeof(unsigned int);
+  trace_env.sample->sp = trace_env.sample->fp - 100;
   trace_env.tracer->Trace(trace_env.sample);
 }
 
@@ -94,9 +94,9 @@
 #ifdef DEBUG
   // C stack trace works only in debug mode, in release mode EBP is
   // usually treated as a general-purpose register
+  CHECK_GT(sample.frames_count, 0);
   CheckRetAddrIsInCFunction(reinterpret_cast<unsigned int>(sample.stack[0]),
                             reinterpret_cast<unsigned int>(&CFunc));
-  CHECK_EQ(0, sample.stack[1]);
 #endif
 }
 
@@ -217,15 +217,18 @@
       "  JSFuncDoTrace();"
       "};\n"
       "JSTrace();");
+  CHECK_GT(sample.frames_count, 1);
+  CheckRetAddrIsInFunction(
+      reinterpret_cast<unsigned int>(sample.stack[0]),
+      reinterpret_cast<unsigned int>(call_trace_code->instruction_start()),
+      call_trace_code->instruction_size());
   Handle<JSFunction> js_trace(JSFunction::cast(*(v8::Utils::OpenHandle(
       *GetGlobalProperty("JSTrace")))));
   v8::internal::Code* js_trace_code = js_trace->code();
   CheckRetAddrIsInFunction(
-      reinterpret_cast<unsigned int>(sample.stack[0]),
+      reinterpret_cast<unsigned int>(sample.stack[1]),
       reinterpret_cast<unsigned int>(js_trace_code->instruction_start()),
       js_trace_code->instruction_size());
-  CHECK_EQ(0, sample.stack[1]);
 }
 
 #endif  // ENABLE_LOGGING_AND_PROFILING
-
diff --git a/test/cctest/test-regexp.cc b/test/cctest/test-regexp.cc
index 5945fe7..ed2e9ab 100644
--- a/test/cctest/test-regexp.cc
+++ b/test/cctest/test-regexp.cc
@@ -214,6 +214,7 @@
   CHECK_PARSE_EQ("\\x34", "'\x34'");
   CHECK_PARSE_EQ("\\x60", "'\x60'");
   CHECK_PARSE_EQ("\\x3z", "'x3z'");
+  CHECK_PARSE_EQ("\\c", "'c'");
   CHECK_PARSE_EQ("\\u0034", "'\x34'");
   CHECK_PARSE_EQ("\\u003z", "'u003z'");
   CHECK_PARSE_EQ("foo[z]*", "(: 'foo' (# 0 - g [z]))");
@@ -363,8 +364,6 @@
   const char* kUnterminatedCharacterClass = "Unterminated character class";
   ExpectError("[", kUnterminatedCharacterClass);
   ExpectError("[a-", kUnterminatedCharacterClass);
-  const char* kEndControl = "\\c at end of pattern";
-  ExpectError("\\c", kEndControl);
   const char* kNothingToRepeat = "Nothing to repeat";
   ExpectError("*", kNothingToRepeat);
   ExpectError("?", kNothingToRepeat);
diff --git a/test/cctest/test-sockets.cc b/test/cctest/test-sockets.cc
index 187bbe0..9316a26 100644
--- a/test/cctest/test-sockets.cc
+++ b/test/cctest/test-sockets.cc
@@ -63,6 +63,19 @@
 }
 
 
+static bool SendAll(Socket* socket, const char* data, int len) {
+  int sent_len = 0;
+  while (sent_len < len) {
+    int status = socket->Send(data, len);
+    if (status <= 0) {
+      return false;
+    }
+    sent_len += status;
+  }
+  return true;
+}
+
+
 static void SendAndReceive(char *data, int len) {
   bool ok;
 
@@ -78,7 +91,7 @@
   CHECK(ok);
 
   // Send all the data.
-  ok = client->SendAll(data, len);
+  ok = SendAll(client, data, len);
   CHECK(ok);
 
   // Wait until data is received.
diff --git a/test/mjsunit/bugs/bug-269.js b/test/mjsunit/bugs/bug-269.js
new file mode 100644
index 0000000..49b24c0
--- /dev/null
+++ b/test/mjsunit/bugs/bug-269.js
@@ -0,0 +1,49 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+function listener(event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.Break) {
+    exec_state.prepareStep(Debug.StepAction.StepIn);
+  }
+};
+
+// Add the debug event listener.
+Debug.setListener(listener);
+
+function g() {
+}
+ 
+function f() {
+  debugger;
+  g.apply(null, ['']);
+}
+
+f()
\ No newline at end of file
diff --git a/test/mjsunit/compare-constants.js b/test/mjsunit/compare-constants.js
new file mode 100644
index 0000000..e11ac0c
--- /dev/null
+++ b/test/mjsunit/compare-constants.js
@@ -0,0 +1,121 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test comparison operations that involve one or two constant smis.
+
+function test() {
+  var i = 5;
+  var j = 3;
+
+  assertTrue( j < i );
+  i = 5; j = 3;
+  assertTrue( j <= i );
+  i = 5; j = 3;
+  assertTrue( i > j );
+  i = 5; j = 3;
+  assertTrue( i >= j );
+  i = 5; j = 3;
+  assertTrue( i != j );
+  i = 5; j = 3;
+  assertTrue( i == i );
+  i = 5; j = 3;
+  assertFalse( i < j );
+  i = 5; j = 3;
+  assertFalse( i <= j );
+  i = 5; j = 3;
+  assertFalse( j > i );
+  i = 5; j = 3;
+  assertFalse(j >= i );
+  i = 5; j = 3;
+  assertFalse( j == i);
+  i = 5; j = 3;
+  assertFalse( i != i);
+
+  i = 10 * 10;
+  while ( i < 107 ) {
+    ++i;
+  }
+  j = 21;
+
+  assertTrue( j < i );
+  j = 21;
+  assertTrue( j <= i );
+  j = 21;
+  assertTrue( i > j );
+  j = 21;
+  assertTrue( i >= j );
+  j = 21;
+  assertTrue( i != j );
+  j = 21;
+  assertTrue( i == i );
+  j = 21;
+  assertFalse( i < j );
+  j = 21;
+  assertFalse( i <= j );
+  j = 21;
+  assertFalse( j > i );
+  j = 21;
+  assertFalse(j >= i );
+  j = 21;
+  assertFalse( j == i);
+  j = 21;
+  assertFalse( i != i);
+  j = 21;
+  assertTrue( j == j );
+  j = 21;
+  assertFalse( j != j );
+
+  assertTrue( 100 > 99 );
+  assertTrue( 101 >= 90 );
+  assertTrue( 11111 > -234 );
+  assertTrue( -888 <= -20 );
+
+  while ( 234 > 456 ) {
+    i = i + 1;
+  }
+
+  switch(3) {
+    case 5:
+      assertUnreachable();
+      break;
+    case 3:
+      j = 13;
+    default:
+      i = 2;
+    case 7:
+      j = 17;
+      break;
+    case 9:
+      j = 19;
+      assertUnreachable();
+      break;
+  }
+  assertEquals(17, j, "switch with constant value");
+}
+
+test();
+
diff --git a/test/mjsunit/debug-evaluate.js b/test/mjsunit/debug-evaluate.js
index 75d2334..5c5734f 100644
--- a/test/mjsunit/debug-evaluate.js
+++ b/test/mjsunit/debug-evaluate.js
@@ -64,33 +64,33 @@
 
 function listener(event, exec_state, event_data, data) {
   try {
-  if (event == Debug.DebugEvent.Break) {
-    // Get the debug command processor.
-    var dcp = exec_state.debugCommandProcessor();
+    if (event == Debug.DebugEvent.Break) {
+      // Get the debug command processor.
+      var dcp = exec_state.debugCommandProcessor();
 
-    // Test some illegal evaluate requests.
-    testRequest(dcp, void 0, false);
-    testRequest(dcp, '{"expression":"1","global"=true}', false);
-    testRequest(dcp, '{"expression":"a","frame":4}', false);
+      // Test some illegal evaluate requests.
+      testRequest(dcp, void 0, false);
+      testRequest(dcp, '{"expression":"1","global"=true}', false);
+      testRequest(dcp, '{"expression":"a","frame":4}', false);
 
-    // Test some legal evaluate requests.
-    testRequest(dcp, '{"expression":"1+2"}', true, 3);
-    testRequest(dcp, '{"expression":"a+2"}', true, 5);
-    testRequest(dcp, '{"expression":"({\\"a\\":1,\\"b\\":2}).b+2"}', true, 4);
+      // Test some legal evaluate requests.
+      testRequest(dcp, '{"expression":"1+2"}', true, 3);
+      testRequest(dcp, '{"expression":"a+2"}', true, 5);
+      testRequest(dcp, '{"expression":"({\\"a\\":1,\\"b\\":2}).b+2"}', true, 4);
 
-    // Test evaluation of a in the stack frames and the global context.
-    testRequest(dcp, '{"expression":"a"}', true, 3);
-    testRequest(dcp, '{"expression":"a","frame":0}', true, 3);
-    testRequest(dcp, '{"expression":"a","frame":1}', true, 2);
-    testRequest(dcp, '{"expression":"a","frame":2}', true, 1);
-    testRequest(dcp, '{"expression":"a","global":true}', true, 1);
-    testRequest(dcp, '{"expression":"this.a","global":true}', true, 1);
+      // Test evaluation of a in the stack frames and the global context.
+      testRequest(dcp, '{"expression":"a"}', true, 3);
+      testRequest(dcp, '{"expression":"a","frame":0}', true, 3);
+      testRequest(dcp, '{"expression":"a","frame":1}', true, 2);
+      testRequest(dcp, '{"expression":"a","frame":2}', true, 1);
+      testRequest(dcp, '{"expression":"a","global":true}', true, 1);
+      testRequest(dcp, '{"expression":"this.a","global":true}', true, 1);
 
-    // Indicate that all was processed.
-    listenerComplete = true;
-  }
+      // Indicate that all was processed.
+      listenerComplete = true;
+    }
   } catch (e) {
-    exception = e
+   exception = e
   };
 };
 
diff --git a/test/mjsunit/debug-script-breakpoints.js b/test/mjsunit/debug-script-breakpoints.js
index 28c8018..ec9656c 100644
--- a/test/mjsunit/debug-script-breakpoints.js
+++ b/test/mjsunit/debug-script-breakpoints.js
@@ -29,8 +29,8 @@
 // Get the Debug object exposed from the debug context global object.
 Debug = debug.Debug
 
-// Set and remove a script break point.
-var sbp = Debug.setScriptBreakPoint("1", 2, 3);
+// Set and remove a script break point for a named script.
+var sbp = Debug.setScriptBreakPointByName("1", 2, 3);
 assertEquals(1, Debug.scriptBreakPoints().length);
 assertEquals("1", Debug.scriptBreakPoints()[0].script_name());
 assertEquals(2, Debug.scriptBreakPoints()[0].line());
@@ -38,10 +38,10 @@
 Debug.clearBreakPoint(sbp);
 assertEquals(0, Debug.scriptBreakPoints().length);
 
-// Set three script break points.
-var sbp1 = Debug.setScriptBreakPoint("1", 2, 3);
-var sbp2 = Debug.setScriptBreakPoint("2", 3, 4);
-var sbp3 = Debug.setScriptBreakPoint("3", 4, 5);
+// Set three script break points for named scripts.
+var sbp1 = Debug.setScriptBreakPointByName("1", 2, 3);
+var sbp2 = Debug.setScriptBreakPointByName("2", 3, 4);
+var sbp3 = Debug.setScriptBreakPointByName("3", 4, 5);
 
 // Check the content of the script break points.
 assertEquals(3, Debug.scriptBreakPoints().length);
@@ -57,7 +57,48 @@
     assertEquals(4, x.line());
     assertEquals(5, x.column());
   } else {
-    assertUnreachable("unecpected script_data " + x.script_data());
+    assertUnreachable("unecpected script_name " + x.script_name());
+  }
+}
+
+// Remove script break points (in another order than they where added).
+assertEquals(3, Debug.scriptBreakPoints().length);
+Debug.clearBreakPoint(sbp1);
+assertEquals(2, Debug.scriptBreakPoints().length);
+Debug.clearBreakPoint(sbp3);
+assertEquals(1, Debug.scriptBreakPoints().length);
+Debug.clearBreakPoint(sbp2);
+assertEquals(0, Debug.scriptBreakPoints().length);
+
+// Set and remove a script break point for a script id.
+var sbp = Debug.setScriptBreakPointById(1, 2, 3);
+assertEquals(1, Debug.scriptBreakPoints().length);
+assertEquals(1, Debug.scriptBreakPoints()[0].script_id());
+assertEquals(2, Debug.scriptBreakPoints()[0].line());
+assertEquals(3, Debug.scriptBreakPoints()[0].column());
+Debug.clearBreakPoint(sbp);
+assertEquals(0, Debug.scriptBreakPoints().length);
+
+// Set three script break points for script ids.
+var sbp1 = Debug.setScriptBreakPointById(1, 2, 3);
+var sbp2 = Debug.setScriptBreakPointById(2, 3, 4);
+var sbp3 = Debug.setScriptBreakPointById(3, 4, 5);
+
+// Check the content of the script break points.
+assertEquals(3, Debug.scriptBreakPoints().length);
+for (var i = 0; i < Debug.scriptBreakPoints().length; i++) {
+  var x = Debug.scriptBreakPoints()[i];
+  if (1 == x.script_id()) {
+    assertEquals(2, x.line());
+    assertEquals(3, x.column());
+  } else if (2 == x.script_id()) {
+    assertEquals(3, x.line());
+    assertEquals(4, x.column());
+  } else if (3 == x.script_id()) {
+    assertEquals(4, x.line());
+    assertEquals(5, x.column());
+  } else {
+    assertUnreachable("unecpected script_id " + x.script_id());
   }
 }
 
diff --git a/test/mjsunit/debug-script.js b/test/mjsunit/debug-script.js
index d7a8a24..effa145 100644
--- a/test/mjsunit/debug-script.js
+++ b/test/mjsunit/debug-script.js
@@ -33,28 +33,26 @@
 RegExp();
 
 // Count script types.
-var native_count = 0;
+var named_native_count = 0;
 var extension_count = 0;
 var normal_count = 0;
 var scripts = Debug.scripts();
 for (i = 0; i < scripts.length; i++) {
   if (scripts[i].type == Debug.ScriptType.Native) {
-    native_count++;
+    if (scripts[i].name) {
+      named_native_count++;
+    }
   } else if (scripts[i].type == Debug.ScriptType.Extension) {
     extension_count++;
   } else if (scripts[i].type == Debug.ScriptType.Normal) {
-    if (!scripts[i].name) print("X" + scripts[i].source + "X"); // empty script
-    else {
-      print(scripts[i].name);
-      normal_count++;
-      }
+    normal_count++;
   } else {
     assertUnreachable('Unexpected type ' + scripts[i].type);
   }
 }
 
 // This has to be updated if the number of native scripts change.
-assertEquals(12, native_count);
+assertEquals(12, named_native_count);
 // If no snapshot is used, only the 'gc' extension is loaded.
 // If snapshot is used, all extensions are cached in the snapshot.
 assertTrue(extension_count == 1 || extension_count == 5);
diff --git a/test/mjsunit/debug-setbreakpoint.js b/test/mjsunit/debug-setbreakpoint.js
index 2a8cd6c..904ec18 100644
--- a/test/mjsunit/debug-setbreakpoint.js
+++ b/test/mjsunit/debug-setbreakpoint.js
@@ -30,8 +30,13 @@
 Debug = debug.Debug
 
 // Simple function which stores the last debug event.
-listenerComplete = false;
-exception = false;
+var listenerComplete = false;
+var exception = false;
+var f_script_id = 0;
+var g_script_id = 0;
+var h_script_id = 0;
+var f_line = 0;
+var g_line = 0;
 
 var base_request = '"seq":0,"type":"request","command":"setbreakpoint"'
 
@@ -44,13 +49,17 @@
   }
 }
 
-function testArguments(dcp, arguments, success, type) {
+function testArguments(dcp, arguments, success, is_script) {
   var request = '{' + base_request + ',"arguments":' + arguments + '}'
   var json_response = dcp.processDebugJSONRequest(request);
   var response = safeEval(json_response);
   if (success) {
     assertTrue(response.success, json_response);
-    assertEquals(type ? type : 'script', response.body.type, json_response);
+    if (is_script) {
+      assertEquals('scriptName', response.body.type, json_response);
+    } else {
+      assertEquals('scriptId', response.body.type, json_response);
+    }
   } else {
     assertFalse(response.success, json_response);
   }
@@ -79,18 +88,23 @@
     testArguments(dcp, '{"type":"function","target":"f","ignoreCount":-1}', false);
 
     // Test some legal setbreakpoint requests.
-    testArguments(dcp, '{"type":"function","target":"f"}', true);
-    testArguments(dcp, '{"type":"function","target":"h"}', true, 'function');
-    testArguments(dcp, '{"type":"function","target":"f","line":1}', true);
-    testArguments(dcp, '{"type":"function","target":"f","position":1}', true);
-    testArguments(dcp, '{"type":"function","target":"f","condition":"i == 1"}', true);
-    testArguments(dcp, '{"type":"function","target":"f","enabled":true}', true);
-    testArguments(dcp, '{"type":"function","target":"f","enabled":false}', true);
-    testArguments(dcp, '{"type":"function","target":"f","ignoreCount":7}', true);
-    testArguments(dcp, '{"type":"script","target":"test"}', true);
-    testArguments(dcp, '{"type":"script","target":"test"}', true);
-    testArguments(dcp, '{"type":"script","target":"test","line":1}', true);
-    testArguments(dcp, '{"type":"script","target":"test","column":1}', true);
+    testArguments(dcp, '{"type":"function","target":"f"}', true, false);
+    testArguments(dcp, '{"type":"function","target":"h"}', true, false);
+    testArguments(dcp, '{"type":"function","target":"f","line":1}', true, false);
+    testArguments(dcp, '{"type":"function","target":"f","position":1}', true, false);
+    testArguments(dcp, '{"type":"function","target":"f","condition":"i == 1"}', true, false);
+    testArguments(dcp, '{"type":"function","target":"f","enabled":true}', true, false);
+    testArguments(dcp, '{"type":"function","target":"f","enabled":false}', true, false);
+    testArguments(dcp, '{"type":"function","target":"f","ignoreCount":7}', true, false);
+
+    testArguments(dcp, '{"type":"script","target":"test"}', true, true);
+    testArguments(dcp, '{"type":"script","target":"test"}', true, true);
+    testArguments(dcp, '{"type":"script","target":"test","line":1}', true, true);
+    testArguments(dcp, '{"type":"script","target":"test","column":1}', true, true);
+
+    testArguments(dcp, '{"type":"scriptId","target":' + f_script_id + ',"line":' + f_line + '}', true, false);
+    testArguments(dcp, '{"type":"scriptId","target":' + g_script_id + ',"line":' + g_line + '}', true, false);
+    testArguments(dcp, '{"type":"scriptId","target":' + h_script_id + ',"line":' + h_line + '}', true, false);
 
     // Indicate that all was processed.
     listenerComplete = true;
@@ -113,10 +127,27 @@
 
 eval('function h(){}');
 
+// Check the script ids for the test functions.
+f_script_id = Debug.findScript(f).id;
+g_script_id = Debug.findScript(g).id;
+h_script_id = Debug.findScript(h).id;
+assertTrue(f_script_id > 0, "invalid script id for f");
+assertTrue(g_script_id > 0, "invalid script id for g");
+assertTrue(h_script_id > 0, "invalid script id for h");
+assertEquals(f_script_id, g_script_id);
+
+// Get the source line for the test functions.
+f_line = Debug.findFunctionSourceLocation(f).line;
+g_line = Debug.findFunctionSourceLocation(g).line;
+h_line = Debug.findFunctionSourceLocation(h).line;
+assertTrue(f_line > 0, "invalid line for f");
+assertTrue(g_line > 0, "invalid line for g");
+assertTrue(f_line < g_line);
+assertEquals(h_line, 0, "invalid line for h");
+
 // Set a break point and call to invoke the debug event listener.
 Debug.setBreakPoint(g, 0, 0);
 g();
 
 // Make sure that the debug event listener vas invoked.
-assertTrue(listenerComplete, "listener did not run to completion");
-assertFalse(exception, "exception in listener")
+assertTrue(listenerComplete, "listener did not run to completion: " + exception);
diff --git a/test/mjsunit/debug-sourceinfo.js b/test/mjsunit/debug-sourceinfo.js
index 2bad07a..36e9f03 100644
--- a/test/mjsunit/debug-sourceinfo.js
+++ b/test/mjsunit/debug-sourceinfo.js
@@ -175,18 +175,18 @@
 assertEquals(0, script.locationFromLine(1, 12, start_b).column);

 

 // Test the Debug.findSourcePosition which wraps SourceManager.

-assertEquals(0 + start_a, Debug.findFunctionSourcePosition(a, 0, 0));

-assertEquals(0 + start_b, Debug.findFunctionSourcePosition(b, 0, 0));

-assertEquals(6 + start_b, Debug.findFunctionSourcePosition(b, 1, 0));

-assertEquals(8 + start_b, Debug.findFunctionSourcePosition(b, 1, 2));

-assertEquals(18 + start_b, Debug.findFunctionSourcePosition(b, 2, 0));

-assertEquals(0 + start_c, Debug.findFunctionSourcePosition(c, 0, 0));

-assertEquals(7 + start_c, Debug.findFunctionSourcePosition(c, 1, 0));

-assertEquals(21 + start_c, Debug.findFunctionSourcePosition(c, 2, 0));

-assertEquals(38 + start_c, Debug.findFunctionSourcePosition(c, 3, 0));

-assertEquals(52 + start_c, Debug.findFunctionSourcePosition(c, 4, 0));

-assertEquals(69 + start_c, Debug.findFunctionSourcePosition(c, 5, 0));

-assertEquals(76 + start_c, Debug.findFunctionSourcePosition(c, 6, 0));

+assertEquals(0 + start_a, Debug.findFunctionSourceLocation(a, 0, 0).position);

+assertEquals(0 + start_b, Debug.findFunctionSourceLocation(b, 0, 0).position);

+assertEquals(6 + start_b, Debug.findFunctionSourceLocation(b, 1, 0).position);

+assertEquals(8 + start_b, Debug.findFunctionSourceLocation(b, 1, 2).position);

+assertEquals(18 + start_b, Debug.findFunctionSourceLocation(b, 2, 0).position);

+assertEquals(0 + start_c, Debug.findFunctionSourceLocation(c, 0, 0).position);

+assertEquals(7 + start_c, Debug.findFunctionSourceLocation(c, 1, 0).position);

+assertEquals(21 + start_c, Debug.findFunctionSourceLocation(c, 2, 0).position);

+assertEquals(38 + start_c, Debug.findFunctionSourceLocation(c, 3, 0).position);

+assertEquals(52 + start_c, Debug.findFunctionSourceLocation(c, 4, 0).position);

+assertEquals(69 + start_c, Debug.findFunctionSourceLocation(c, 5, 0).position);

+assertEquals(76 + start_c, Debug.findFunctionSourceLocation(c, 6, 0).position);

 

 // Test source line and restriction. All the following tests start from line 1

 // column 2 in function b, which is the call to c.

diff --git a/test/mjsunit/debug-step.js b/test/mjsunit/debug-step.js
index 7a75bb1..4534218 100644
--- a/test/mjsunit/debug-step.js
+++ b/test/mjsunit/debug-step.js
@@ -36,8 +36,7 @@
 var bp1, bp2;
 
 function listener(event, exec_state, event_data, data) {
-  if (event == Debug.DebugEvent.Break)
-  {
+  if (event == Debug.DebugEvent.Break) {
     if (state == 0) {
       exec_state.prepareStep(Debug.StepAction.StepIn, 1000);
       state = 1;
@@ -68,7 +67,6 @@
 state = 0;
 result = -1;
 f();
-print(state);
 assertEquals(499, result);
 
 // Check that performing 1000 steps with a break point on the statement in the
diff --git a/test/mjsunit/error-constructors.js b/test/mjsunit/error-constructors.js
new file mode 100644
index 0000000..ca2aa06
--- /dev/null
+++ b/test/mjsunit/error-constructors.js
@@ -0,0 +1,32 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var e = new Error();
+assertFalse(e.hasOwnProperty('message'));
+Error.prototype.toString = Object.prototype.toString;
+assertEquals("[object Error]", Error.prototype.toString());
+assertEquals(Object.prototype, Error.prototype.__proto__);
diff --git a/test/mjsunit/fuzz-natives.js b/test/mjsunit/fuzz-natives.js
index a2c3217..c9d192f 100644
--- a/test/mjsunit/fuzz-natives.js
+++ b/test/mjsunit/fuzz-natives.js
@@ -31,8 +31,8 @@
   var result = [ ];
   result.push(17);
   result.push(-31);
-  result.push(Number.MAX_VALUE);
-  result.push(new Array(5003));
+  result.push(new Array(100));
+  result.push(new Array(100003));
   result.push(Number.MIN_VALUE);
   result.push("whoops");
   result.push("x");
@@ -121,7 +121,8 @@
   "PushContext": true,
   "LazyCompile": true,
   "CreateObjectLiteralBoilerplate": true,
-  "CloneObjectLiteralBoilerplate": true,
+  "CloneLiteralBoilerplate": true,
+  "CreateArrayLiteralBoilerplate": true,
   "IS_VAR": true,
   "ResolvePossiblyDirectEval": true,
   "Log": true
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 090208e..375978e 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -34,12 +34,18 @@
 # too long to run in debug mode on ARM.
 fuzz-natives: PASS, SKIP if ($mode == release || $arch == arm)
 
+# Bug realiably triggers a debug assertion and crashed in release mode.
+bugs/bug-269: CRASH, FAIL if $mode == debug
+
 [ $arch == arm ]
 
 # Slow tests which times out in debug mode.
 try: PASS, SKIP if $mode == debug
 debug-scripts-request: PASS, SKIP if $mode == debug
 
+# Flaky test that can hit compilation-time stack overflow in debug mode.
+unicode-test: PASS, (PASS || FAIL) if $mode == debug
+
 # Bug number 1020483: Debug tests fail on ARM.
 debug-constructor: CRASH, FAIL
 debug-continue: SKIP
@@ -56,6 +62,7 @@
 debug-step: SKIP
 debug-breakpoints: PASS || FAIL
 debug-handle: CRASH, FAIL if $mode == debug
+bugs/bug-269: SKIP
 
 # Bug number 130 http://code.google.com/p/v8/issues/detail?id=130
 # Fails on real ARM hardware but not on the simulator.
diff --git a/test/mjsunit/multiple-return.js b/test/mjsunit/multiple-return.js
new file mode 100644
index 0000000..610a367
--- /dev/null
+++ b/test/mjsunit/multiple-return.js
@@ -0,0 +1,62 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function F() {
+  for (var x in [1,2,3]) {
+    return 42;
+  }
+  return 87;
+}
+
+
+function G() {
+  for (var x in [1,2,3]) {
+    try {
+      return 42;
+    } finally {
+      // Do nothing.
+    }
+  }
+  return 87;
+}
+
+
+function H() {
+  for (var x in [1,2,3]) {
+    try {
+      return 42;
+    } catch (e) {
+      // Do nothing.
+    }
+  }
+  return 87;
+}
+
+
+assertEquals(42, F());
+assertEquals(42, G());
+assertEquals(42, H());
diff --git a/test/mjsunit/object-literal.js b/test/mjsunit/object-literal.js
new file mode 100644
index 0000000..e2da84b
--- /dev/null
+++ b/test/mjsunit/object-literal.js
@@ -0,0 +1,63 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var obj = {
+    a: 7,
+    b: { x: 12, y: 24 },
+    c: 'Zebra'
+}
+
+assertEquals(7, obj.a);
+assertEquals(12, obj.b.x);
+assertEquals(24, obj.b.y);
+assertEquals('Zebra', obj.c);
+
+var z = 24;
+
+var obj2 = {
+    a: 7,
+    b: { x: 12, y: z },
+    c: 'Zebra'
+}
+
+assertEquals(7, obj2.a);
+assertEquals(12, obj2.b.x);
+assertEquals(24, obj2.b.y);
+assertEquals('Zebra', obj2.c);
+
+var arr = [];
+for (var i = 0; i < 2; i++) {
+  arr[i] = {
+      a: 7,
+      b: { x: 12, y: 24 },
+      c: 'Zebra'
+  }
+}
+
+arr[0].a = 2;
+assertEquals(2, arr[0].a);
+assertEquals(7, arr[1].a);
diff --git a/test/mjsunit/regexp-static.js b/test/mjsunit/regexp-static.js
index 5db9fe2..9e73f3d 100644
--- a/test/mjsunit/regexp-static.js
+++ b/test/mjsunit/regexp-static.js
@@ -132,3 +132,36 @@
 re = /(.)/g;
 function f() { return RegExp.$1; };
 assertEquals('abcd', 'abcd'.replace(re, f));
+
+// lastParen where the last parenthesis didn't match.
+assertEquals("foo,", /foo(?:a(x))?/.exec("foobx"), "lastParen setup");
+assertEquals("", RegExp.lastParen, "lastParen");
+
+// The same test for $1 to $9.
+for (var i = 1; i <= 9; i++) {
+  var haystack = "foo";
+  var re_text = "^foo";
+  for (var j = 0; j < i - 1; j++) {
+    haystack += "x";
+    re_text += "(x)";
+  }
+  re_text += "(?:a(x))?";
+  haystack += "bx";
+  var re = new RegExp(re_text);
+  assertTrue(re.test(haystack), "$" + i + " setup");
+  for (var j = 1; j < i - 1; j++) {
+    assertEquals("x", RegExp['$' + j], "$" + j + " in $" + i + " setup");
+  }
+  assertEquals("", RegExp['$' + (i)], "$" + i);
+}
+
+RegExp.multiline = "foo";
+assertTrue(typeof RegExp.multiline == typeof Boolean(), "RegExp.multiline coerces values to booleans");
+RegExp.input = Number();
+assertTrue(typeof RegExp.input == typeof String(), "RegExp.input coerces values to booleans");
+
+// Ensure that we save the correct string as the last subject when
+// we do a match on a sliced string (the top one not the underlying).
+var foo = "lsdfj sldkfj sdklfj læsdfjl sdkfjlsdk fjsdl fjsdljskdj flsj flsdkj flskd regexp: /foobar/\nldkfj sdlkfj sdkl";
+assertTrue(/^([a-z]+): (.*)/.test(foo.substring(foo.indexOf("regexp:"))), "regexp: setup");
+assertEquals("regexp", RegExp.$1, "RegExp.$1");
diff --git a/test/mjsunit/regexp-string-methods.js b/test/mjsunit/regexp-string-methods.js
new file mode 100644
index 0000000..ef3bf6e
--- /dev/null
+++ b/test/mjsunit/regexp-string-methods.js
@@ -0,0 +1,51 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regexp shouldn't use String.prototype.slice()
+var s = new String("foo");
+assertEquals("f", s.slice(0,1));
+String.prototype.slice = function() { return "x"; }
+assertEquals("x", s.slice(0,1));
+assertEquals("g", /g/.exec("gg"));
+
+// Regexp shouldn't use String.prototype.charAt()
+var f1 = new RegExp("f", "i");
+assertEquals("F", f1.exec("F"));
+assertEquals("f", "foo".charAt(0));
+String.prototype.charAt = function(idx) { return 'g'; };
+assertEquals("g", "foo".charAt(0));
+var f2 = new RegExp("[g]", "i");
+assertEquals("G", f2.exec("G"));
+assertTrue(f2.ignoreCase);
+
+// On the other hand test is defined in a semi-coherent way as a call to exec.
+// 15.10.6.3
+// We match other browsers in using the original value of RegExp.prototype.exec.
+// I.e., RegExp.prototype.test shouldn't use the current value of
+// RegExp.prototype.exec.
+RegExp.prototype.exec = function(string) { return 'x'; }
+assertFalse(/f/.test('x'));
diff --git a/test/mjsunit/regress/regress-1493017.js b/test/mjsunit/regress/regress-1493017.js
new file mode 100644
index 0000000..99a1dad
--- /dev/null
+++ b/test/mjsunit/regress/regress-1493017.js
@@ -0,0 +1,52 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test collection of abandoned maps.  Tests that deleted map
+// transitions do not show up as properties in for in.
+
+// Flags: --expose-gc --collect-maps
+
+function C() {}
+
+
+// Create an instance of C.  Add a property to the instance and then
+// remove all references to instances of C.
+var o = new C();
+o.x = 42;
+o = null;
+
+// Force a global GC. This will collect the maps starting from C and
+// delete map transitions.
+gc();
+
+// Create a new instance of C.
+o = new C();
+
+// Test that the deleted map transitions do not show up in for in.
+for (var p in o) {
+  assertTrue(false);
+}
diff --git a/test/mjsunit/regress/regress-244.js b/test/mjsunit/regress/regress-244.js
new file mode 100644
index 0000000..ffddcf8
--- /dev/null
+++ b/test/mjsunit/regress/regress-244.js
@@ -0,0 +1,67 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var kLegalPairs = [
+  [0x00, '%00'],
+  [0x01, '%01'],
+  [0x7f, '%7F'],
+  [0x80, '%C2%80'],
+  [0x81, '%C2%81'],
+  [0x7ff, '%DF%BF'],
+  [0x800, '%E0%A0%80'],
+  [0x801, '%E0%A0%81'],
+  [0xd7ff, '%ED%9F%BF'],
+  [0xffff, '%EF%BF%BF']
+];
+
+var kIllegalEncoded = [
+  '%80', '%BF', '%80%BF', '%80%BF%80', '%C0%22', '%DF',
+  '%EF%BF', '%F7BFBF', '%FE', '%FF', '%FE%FE%FF%FF',
+  '%C0%AF', '%E0%9F%BF', '%F0%8F%BF%BF', '%C0%80',
+  '%E0%80%80'
+];
+
+function run() {
+  for (var i = 0; i < kLegalPairs.length; i++) {
+    var decoded = String.fromCharCode(kLegalPairs[i][0]);
+    var encoded = kLegalPairs[i][1];
+    assertEquals(decodeURI(encoded), decoded);
+    assertEquals(encodeURI(decoded), encoded);
+  }
+  for (var i = 0; i < kIllegalEncoded.length; i++) {
+    var value = kIllegalEncoded[i];
+    var threw = false;
+    try {
+      decodeURI(value);
+      fail(value);
+    } catch (e) {
+      assertInstanceof(e, URIError);
+    }
+  }
+}
+
+run();
diff --git a/test/mjsunit/regress/regress-254.js b/test/mjsunit/regress/regress-254.js
new file mode 100755
index 0000000..ec4b40a
--- /dev/null
+++ b/test/mjsunit/regress/regress-254.js
@@ -0,0 +1,58 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=254
+
+// RegExp with global flag: exec and test updates lastIndex.
+var re = /x/g;
+
+assertEquals(0, re.lastIndex, "Global, initial lastIndex");
+
+assertTrue(re.test("x"), "Global, test 1");
+assertEquals(1, re.lastIndex, "Global, lastIndex after test 1");
+assertFalse(re.test("x"), "Global, test 2");
+assertEquals(0, re.lastIndex, "Global, lastIndex after test 2");
+
+assertEquals(["x"], re.exec("x"), "Global, exec 1");
+assertEquals(1, re.lastIndex, "Global, lastIndex after exec 1");
+assertEquals(null, re.exec("x"), "Global, exec 2");
+assertEquals(0, re.lastIndex, "Global, lastIndex after exec 2");
+
+// RegExp without global flag: exec and test leavs lastIndex at zero.
+var re2 = /x/;
+
+assertEquals(0, re2.lastIndex, "Non-global, initial lastIndex");
+
+assertTrue(re2.test("x"), "Non-global, test 1");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after test 1");
+assertTrue(re2.test("x"), "Non-global, test 2");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after test 2");
+
+assertEquals(["x"], re2.exec("x"), "Non-global, exec 1");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after exec 1");
+assertEquals(["x"], re2.exec("x"), "Non-global, exec 2");
+assertEquals(0, re2.lastIndex, "Non-global, lastIndex after exec 2");
diff --git a/test/mjsunit/regress/regress-259.js b/test/mjsunit/regress/regress-259.js
new file mode 100644
index 0000000..f0476ff
--- /dev/null
+++ b/test/mjsunit/regress/regress-259.js
@@ -0,0 +1,33 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we do not crash when compiling a try/finally with an
+// infinite loop (with no normal exits) in the try block.
+
+// See http://code.google.com/p/v8/issues/detail?id=259
+
+assertThrows("try { while (true) { throw 0; }} finally {}");
diff --git a/test/mjsunit/regress/regress-260.js b/test/mjsunit/regress/regress-260.js
new file mode 100644
index 0000000..65242bc
--- /dev/null
+++ b/test/mjsunit/regress/regress-260.js
@@ -0,0 +1,33 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// We should not compile the bodies of function literals in loop
+// conditions twice, even in cases where the loop condition is
+// compiled twice.
+
+function test() { eval("while(!function () { var x; });"); }
+test();
diff --git a/test/mjsunit/regress/regress-263.js b/test/mjsunit/regress/regress-263.js
new file mode 100644
index 0000000..123bde6
--- /dev/null
+++ b/test/mjsunit/regress/regress-263.js
@@ -0,0 +1,38 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Exits via return, break, or continue from within try/finally or
+// for/in should not crash or trigger a debug assert.
+
+// See http://code.google.com/p/v8/issues/detail?id=263
+
+function test0() { with({}) for(var x in {}) return; }
+test0();
+
+
+function test1() { with({}) try { } finally { with({}) return; } }
+test1();
diff --git a/test/mjsunit/regress/regress-265.js b/test/mjsunit/regress/regress-265.js
new file mode 100644
index 0000000..21ac1a6
--- /dev/null
+++ b/test/mjsunit/regress/regress-265.js
@@ -0,0 +1,64 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// When returning or breaking out of a deeply nested try/finally, we
+// should not crash.
+
+// See http://code.google.com/p/v8/issues/detail?id=263
+
+function test0() {
+  try {
+    try {
+      return 0;
+    } finally {
+      try {
+        return 0;
+      } finally {
+      }
+    }
+  } finally {
+  }
+}
+
+test0();
+
+function test1() {
+L0:
+  try {
+    try {
+      break L0;
+    } finally {
+      try {
+        break L0;
+      } finally {
+      }
+    }
+  } finally {
+  }
+}
+
+test1();
diff --git a/test/mjsunit/regress/regress-267.js b/test/mjsunit/regress/regress-267.js
new file mode 100644
index 0000000..bb61606
--- /dev/null
+++ b/test/mjsunit/regress/regress-267.js
@@ -0,0 +1,35 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://code.google.com/p/v8/issues/detail?id=267
+
+var global = (function(){ return this; })();
+function taint(fn){var v = fn(); eval("taint"); return v; }
+function getThis(){ return this; }
+var obj = taint(getThis);
+
+assertEquals(global, obj, "Should be the global object.");
diff --git a/test/mjsunit/short-circuit-boolean.js b/test/mjsunit/short-circuit-boolean.js
new file mode 100644
index 0000000..df40c22
--- /dev/null
+++ b/test/mjsunit/short-circuit-boolean.js
@@ -0,0 +1,46 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test some code paths through the compiler for short-circuited
+// boolean expressions.
+
+function andTest0() {
+  var a = 0;
+  // Left subexpression is known false at compile time.
+  return a != 0 && "failure";
+}
+
+assertFalse(andTest0());
+
+
+function orTest0() {
+  var a = 0;
+  // Left subexpression is known true at compile time.
+  return a == 0 || "failure";
+}
+
+assertTrue(orTest0());
diff --git a/test/mjsunit/sparse-array-reverse.js b/test/mjsunit/sparse-array-reverse.js
index 9b9f323..45a6da4 100644
--- a/test/mjsunit/sparse-array-reverse.js
+++ b/test/mjsunit/sparse-array-reverse.js
@@ -74,7 +74,15 @@
 
     var to_delete = [];
 
-    var a = new Array(size);
+    var a;
+    // Make sure we test both array-backed and hash-table backed
+    // arrays.
+    if (size < 1000) {
+      a = new Array(size);
+    } else {
+      a = new Array();
+      a.length = size;
+    }
 
     var expected = '';
     var expected_reversed = '';
diff --git a/test/mjsunit/switch.js b/test/mjsunit/switch.js
index e2b14d1..4044490 100644
--- a/test/mjsunit/switch.js
+++ b/test/mjsunit/switch.js
@@ -222,8 +222,8 @@
 assertEquals(190, f6(20), "largeSwitch.20");
 assertEquals(2016, f6(64), "largeSwitch.64");
 assertEquals(4032, f6(128), "largeSwitch.128");
-assertEquals(4222, f6(148), "largeSwitch.148"); 
- 
+assertEquals(4222, f6(148), "largeSwitch.148");
+
 
 function f7(value) {
   switch (value) {
@@ -252,7 +252,7 @@
   case 11:
   case 12:
   case 13:
-  case 14: 
+  case 14:
   case 15:  // Dummy fillers
   }
   return "default";
@@ -270,7 +270,7 @@
 
 function makeVeryLong(length) {
   var res = "function() {\n" +
-            "  var res = 0;\n" + 
+            "  var res = 0;\n" +
             "  for (var i = 0; i <= " + length + "; i++) {\n" +
             "    switch(i) {\n";
   for (var i = 0; i < length; i++) {
@@ -286,4 +286,4 @@
 var verylong_size = 1000;
 var verylong = makeVeryLong(verylong_size);
 
-assertEquals(verylong_size * 2 + 1, verylong());
\ No newline at end of file
+assertEquals(verylong_size * 2 + 1, verylong());
diff --git a/test/mjsunit/this.js b/test/mjsunit/this.js
index 0019eb2..890dea4 100644
--- a/test/mjsunit/this.js
+++ b/test/mjsunit/this.js
@@ -35,7 +35,7 @@
 assertTrue(this === f());
 
 var x = {}, y = {};
-x.f = y.f = f; 
+x.f = y.f = f;
 assertFalse(x === f());
 assertFalse(y === f());
 assertTrue(x === x.f());
diff --git a/test/mjsunit/try.js b/test/mjsunit/try.js
index a3f4433..0bd78b4 100644
--- a/test/mjsunit/try.js
+++ b/test/mjsunit/try.js
@@ -65,7 +65,7 @@
 assertEquals(4, guard(function() { try { throw 3; } finally { throw 4; } }));
 
 (function () {
-  var iter = 10000000;
+  var iter = 1000000;
   for (var i = 1; i <= iter; i++) {
     try {
       if (i == iter) gc();