Version 3.20.4

Fixed garbage-collection issue that causes a crash on ARM (Chromium issue 254570)

Performance and stability improvements on all platforms.

git-svn-id: http://v8.googlecode.com/svn/trunk@15597 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/ChangeLog b/ChangeLog
index 2b6b491..d3ec509 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,11 @@
+2013-07-10: Version 3.20.4
+
+        Fixed garbage-collection issue that causes a crash on ARM
+        (Chromium issue 254570)
+
+        Performance and stability improvements on all platforms.
+
+
 2013-07-08: Version 3.20.3
 
         Performance and stability improvements on all platforms.
diff --git a/Makefile b/Makefile
index 16c004f..f96c1e1 100644
--- a/Makefile
+++ b/Makefile
@@ -210,9 +210,9 @@
 NACL_ARCHES = nacl_ia32 nacl_x64
 
 # List of files that trigger Makefile regeneration:
-GYPFILES = build/all.gyp build/common.gypi build/standalone.gypi \
-           preparser/preparser.gyp samples/samples.gyp src/d8.gyp \
-           test/cctest/cctest.gyp tools/gyp/v8.gyp
+GYPFILES = build/all.gyp build/features.gypi build/standalone.gypi \
+	   build/toolchain.gypi preparser/preparser.gyp samples/samples.gyp \
+	   src/d8.gyp test/cctest/cctest.gyp tools/gyp/v8.gyp
 
 # If vtunejit=on, the v8vtune.gyp will be appended.
 ifeq ($(vtunejit), on)
diff --git a/build/features.gypi b/build/features.gypi
new file mode 100644
index 0000000..3c6d25f
--- /dev/null
+++ b/build/features.gypi
@@ -0,0 +1,111 @@
+# Copyright 2013 the V8 project authors. All rights reserved.
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of Google Inc. nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+# Compile time controlled V8 features.
+
+{
+  'variables': {
+    'v8_compress_startup_data%': 'off',
+
+    'v8_enable_debugger_support%': 1,
+
+    'v8_enable_disassembler%': 0,
+
+    'v8_enable_gdbjit%': 0,
+
+    'v8_object_print%': 0,
+
+    'v8_enable_verify_heap%': 0,
+
+    'v8_use_snapshot%': 'true',
+
+    # With post mortem support enabled, metadata is embedded into libv8 that
+    # describes various parameters of the VM for use by debuggers. See
+    # tools/gen-postmortem-metadata.py for details.
+    'v8_postmortem_support%': 'false',
+
+    # Interpreted regexp engine exists as platform-independent alternative
+    # based where the regular expression is compiled to a bytecode.
+    'v8_interpreted_regexp%': 0,
+
+    # Enable ECMAScript Internationalization API. Enabling this feature will
+    # add a dependency on the ICU library.
+    'v8_enable_i18n_support%': 0,
+  },
+  'target_defaults': {
+    'conditions': [
+      ['v8_enable_debugger_support==1', {
+        'defines': ['ENABLE_DEBUGGER_SUPPORT',],
+      }],
+      ['v8_enable_disassembler==1', {
+        'defines': ['ENABLE_DISASSEMBLER',],
+      }],
+      ['v8_enable_gdbjit==1', {
+        'defines': ['ENABLE_GDB_JIT_INTERFACE',],
+      }],
+      ['v8_object_print==1', {
+        'defines': ['OBJECT_PRINT',],
+      }],
+      ['v8_enable_verify_heap==1', {
+        'defines': ['VERIFY_HEAP',],
+      }],
+      ['v8_interpreted_regexp==1', {
+        'defines': ['V8_INTERPRETED_REGEXP',],
+      }],
+      ['v8_enable_i18n_support==1', {
+        'defines': ['V8_I18N_SUPPORT',],
+      }],
+      ['v8_compress_startup_data=="bz2"', {
+        'defines': [
+          'COMPRESS_STARTUP_DATA_BZ2',
+        ],
+      }],
+    ],  # conditions
+    'configurations': {
+      'Debug': {
+        'variables': {
+          'v8_enable_extra_checks%': 1,
+        },
+        'conditions': [
+          ['v8_enable_extra_checks==1', {
+            'defines': ['ENABLE_EXTRA_CHECKS',],
+          }],
+        ],
+      },  # Debug
+      'Release': {
+        'variables': {
+          'v8_enable_extra_checks%': 0,
+        },
+        'conditions': [
+          ['v8_enable_extra_checks==1', {
+            'defines': ['ENABLE_EXTRA_CHECKS',],
+          }],
+        ],  # conditions
+      },  # Release
+    },  # configurations
+  },  # target_defaults
+}
diff --git a/build/standalone.gypi b/build/standalone.gypi
index b1303c8..ab2dfd5 100644
--- a/build/standalone.gypi
+++ b/build/standalone.gypi
@@ -28,11 +28,15 @@
 # Definitions to be used when building stand-alone V8 binaries.
 
 {
+  # We need to include toolchain.gypi here for third-party sources that don't
+  # directly include it themselves.
+  'includes': ['toolchain.gypi'],
   'variables': {
     'component%': 'static_library',
     'clang%': 0,
     'visibility%': 'hidden',
     'v8_enable_backtrace%': 0,
+    'v8_enable_i18n_support%': 0,
     'msvs_multi_core_compile%': '1',
     'mac_deployment_target%': '10.5',
     'variables': {
@@ -128,6 +132,9 @@
             },
           }],
           ['OS == "win"', {
+            'defines!': [
+              'DEBUG',
+            ],
             'msvs_settings': {
               'VCCLCompilerTool': {
                 'WarnAsError': 'false',
@@ -218,6 +225,14 @@
             #   1 == /SUBSYSTEM:CONSOLE
             #   2 == /SUBSYSTEM:WINDOWS
             'SubSystem': '1',
+
+            'conditions': [
+              ['v8_enable_i18n_support==1', {
+                'AdditionalDependencies': [
+                  'advapi32.lib',
+                ],
+              }],
+            ],
           },
         },
       },
diff --git a/build/common.gypi b/build/toolchain.gypi
similarity index 88%
rename from build/common.gypi
rename to build/toolchain.gypi
index dbb33a8..034fbc3 100644
--- a/build/common.gypi
+++ b/build/toolchain.gypi
@@ -1,4 +1,4 @@
-# Copyright 2012 the V8 project authors. All rights reserved.
+# Copyright 2013 the V8 project authors. All rights reserved.
 # Redistribution and use in source and binary forms, with or without
 # modification, are permitted provided that the following conditions are
 # met:
@@ -32,7 +32,6 @@
     'msvs_use_common_release': 0,
     'gcc_version%': 'unknown',
     'CXX%': '${CXX:-$(which g++)}',  # Used to assemble a shell command.
-    'v8_compress_startup_data%': 'off',
     'v8_target_arch%': '<(target_arch)',
     # Native Client builds currently use the V8 ARM JIT and
     # arm/simulator-arm.cc to defer the significant effort required
@@ -42,14 +41,6 @@
     # NaCl V8 builds stop using the ARM simulator
     'nacl_target_arch%': 'none',     # must be set externally
 
-    # Setting 'v8_can_use_unaligned_accesses' to 'true' will allow the code
-    # generated by V8 to do unaligned memory access, and setting it to 'false'
-    # will ensure that the generated code will always do aligned memory
-    # accesses. The default value of 'default' will try to determine the correct
-    # setting. Note that for Intel architectures (ia32 and x64) unaligned memory
-    # access is allowed for all CPUs.
-    'v8_can_use_unaligned_accesses%': 'default',
-
     # Setting 'v8_can_use_vfp32dregs' to 'true' will cause V8 to use the VFP
     # registers d16-d31 in the generated code, both in the snapshot and for the
     # ARM target. Leaving the default value of 'false' will avoid the use of
@@ -67,21 +58,10 @@
     # Default arch variant for MIPS.
     'mips_arch_variant%': 'mips32r2',
 
-    'v8_enable_debugger_support%': 1,
-
     'v8_enable_backtrace%': 0,
-
-    'v8_enable_disassembler%': 0,
-
-    'v8_enable_gdbjit%': 0,
-
-    'v8_object_print%': 0,
-
     # Enable profiling support. Only required on Windows.
     'v8_enable_prof%': 0,
 
-    'v8_enable_verify_heap%': 0,
-
     # Some versions of GCC 4.5 seem to need -fno-strict-aliasing.
     'v8_no_strict_aliasing%': 0,
 
@@ -89,49 +69,13 @@
     # it's handled in build/standalone.gypi.
     'want_separate_host_toolset%': 1,
 
-    'v8_use_snapshot%': 'true',
     'host_os%': '<(OS)',
     'werror%': '-Werror',
-
-    # With post mortem support enabled, metadata is embedded into libv8 that
-    # describes various parameters of the VM for use by debuggers. See
-    # tools/gen-postmortem-metadata.py for details.
-    'v8_postmortem_support%': 'false',
-
     # For a shared library build, results in "libv8-<(soname_version).so".
     'soname_version%': '',
-
-    # Interpreted regexp engine exists as platform-independent alternative
-    # based where the regular expression is compiled to a bytecode.
-    'v8_interpreted_regexp%': 0,
-
-    # Enable ECMAScript Internationalization API. Enabling this feature will
-    # add a dependency on the ICU library.
-    'v8_enable_i18n_support%': 0,
   },
   'target_defaults': {
     'conditions': [
-      ['v8_enable_debugger_support==1', {
-        'defines': ['ENABLE_DEBUGGER_SUPPORT',],
-      }],
-      ['v8_enable_disassembler==1', {
-        'defines': ['ENABLE_DISASSEMBLER',],
-      }],
-      ['v8_enable_gdbjit==1', {
-        'defines': ['ENABLE_GDB_JIT_INTERFACE',],
-      }],
-      ['v8_object_print==1', {
-        'defines': ['OBJECT_PRINT',],
-      }],
-      ['v8_enable_verify_heap==1', {
-        'defines': ['VERIFY_HEAP',],
-      }],
-      ['v8_interpreted_regexp==1', {
-        'defines': ['V8_INTERPRETED_REGEXP',],
-      }],
-      ['v8_enable_i18n_support==1', {
-        'defines': ['V8_I18N_SUPPORT',],
-      }],
       ['v8_target_arch=="arm"', {
         'defines': [
           'V8_TARGET_ARCH_ARM',
@@ -391,11 +335,6 @@
         },
         'msvs_configuration_platform': 'x64',
       }],  # v8_target_arch=="x64"
-      ['v8_compress_startup_data=="bz2"', {
-        'defines': [
-          'COMPRESS_STARTUP_DATA_BZ2',
-        ],
-      }],
       ['OS=="win"', {
         'defines': [
           'WIN32',
@@ -488,9 +427,6 @@
     ],  # conditions
     'configurations': {
       'Debug': {
-        'variables': {
-          'v8_enable_extra_checks%': 1,
-        },
         'defines': [
           'DEBUG',
           'ENABLE_DISASSEMBLER',
@@ -515,9 +451,6 @@
           },
         },
         'conditions': [
-          ['v8_enable_extra_checks==1', {
-            'defines': ['ENABLE_EXTRA_CHECKS',],
-          }],
           ['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="netbsd"', {
             'cflags': [ '-Wall', '<(werror)', '-W', '-Wno-unused-parameter',
                         '-Wnon-virtual-dtor', '-Woverloaded-virtual' ],
@@ -548,13 +481,7 @@
         ],
       },  # Debug
       'Release': {
-        'variables': {
-          'v8_enable_extra_checks%': 0,
-        },
         'conditions': [
-          ['v8_enable_extra_checks==1', {
-            'defines': ['ENABLE_EXTRA_CHECKS',],
-          }],
           ['OS=="linux" or OS=="freebsd" or OS=="openbsd" or OS=="netbsd"', {
             'cflags!': [
               '-O2',
diff --git a/include/v8.h b/include/v8.h
index e27c094..5505901 100644
--- a/include/v8.h
+++ b/include/v8.h
@@ -5403,7 +5403,7 @@
   static const int kNodeIsIndependentShift = 4;
   static const int kNodeIsPartiallyDependentShift = 5;
 
-  static const int kJSObjectType = 0xb0;
+  static const int kJSObjectType = 0xb1;
   static const int kFirstNonstringType = 0x80;
   static const int kOddballType = 0x83;
   static const int kForeignType = 0x88;
diff --git a/preparser/preparser.gyp b/preparser/preparser.gyp
index 598f0a5..23cbfff 100644
--- a/preparser/preparser.gyp
+++ b/preparser/preparser.gyp
@@ -29,7 +29,7 @@
   'variables': {
     'v8_code': 1,
   },
-  'includes': ['../build/common.gypi'],
+  'includes': ['../build/toolchain.gypi', '../build/features.gypi'],
   'targets': [
     {
       'target_name': 'preparser',
diff --git a/samples/lineprocessor.cc b/samples/lineprocessor.cc
index adc5b13..0c84419 100644
--- a/samples/lineprocessor.cc
+++ b/samples/lineprocessor.cc
@@ -137,6 +137,8 @@
 
 int RunMain(int argc, char* argv[]) {
   v8::V8::SetFlagsFromCommandLine(&argc, argv, true);
+  v8::V8::SetFlagsFromString("--noenable_i18n",
+                             static_cast<int>(strlen("--noenable_i18n")));
   v8::Isolate* isolate = v8::Isolate::GetCurrent();
   v8::HandleScope handle_scope(isolate);
 
diff --git a/samples/process.cc b/samples/process.cc
index 1f1f92b..80805d2 100644
--- a/samples/process.cc
+++ b/samples/process.cc
@@ -27,6 +27,7 @@
 
 #include <v8.h>
 
+#include <cstring>
 #include <string>
 #include <map>
 
@@ -634,6 +635,8 @@
     fprintf(stderr, "No script was specified.\n");
     return 1;
   }
+  V8::SetFlagsFromString("--noenable_i18n",
+                         static_cast<int>(strlen("--noenable_i18n")));
   Isolate* isolate = Isolate::GetCurrent();
   HandleScope scope(isolate);
   Handle<String> source = ReadFile(file);
diff --git a/samples/samples.gyp b/samples/samples.gyp
index 8b1de7e..cd2d15b 100644
--- a/samples/samples.gyp
+++ b/samples/samples.gyp
@@ -29,7 +29,7 @@
   'variables': {
     'v8_code': 1,
   },
-  'includes': ['../build/common.gypi'],
+  'includes': ['../build/toolchain.gypi', '../build/features.gypi'],
   'target_defaults': {
     'type': 'executable',
     'dependencies': [
diff --git a/samples/shell.cc b/samples/shell.cc
index a0af931..5c5f056 100644
--- a/samples/shell.cc
+++ b/samples/shell.cc
@@ -67,6 +67,8 @@
 
 int main(int argc, char* argv[]) {
   v8::V8::SetFlagsFromCommandLine(&argc, argv, true);
+  v8::V8::SetFlagsFromString("--noenable_i18n",
+                             static_cast<int>(strlen("--noenable_i18n")));
   v8::Isolate* isolate = v8::Isolate::GetCurrent();
   run_shell = (argc == 1);
   int result;
diff --git a/src/arm/code-stubs-arm.cc b/src/arm/code-stubs-arm.cc
index c5e4db8..ff754ec 100644
--- a/src/arm/code-stubs-arm.cc
+++ b/src/arm/code-stubs-arm.cc
@@ -60,6 +60,16 @@
 }
 
 
+void CreateAllocationSiteStub::InitializeInterfaceDescriptor(
+    Isolate* isolate,
+    CodeStubInterfaceDescriptor* descriptor) {
+  static Register registers[] = { r2 };
+  descriptor->register_param_count_ = 1;
+  descriptor->register_params_ = registers;
+  descriptor->deoptimization_handler_ = NULL;
+}
+
+
 void KeyedLoadFastElementStub::InitializeInterfaceDescriptor(
     Isolate* isolate,
     CodeStubInterfaceDescriptor* descriptor) {
@@ -2753,6 +2763,7 @@
   StubFailureTrampolineStub::GenerateAheadOfTime(isolate);
   RecordWriteStub::GenerateFixedRegStubsAheadOfTime(isolate);
   ArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
+  CreateAllocationSiteStub::GenerateAheadOfTime(isolate);
 }
 
 
@@ -3392,7 +3403,8 @@
 
   StubCompiler::GenerateLoadFunctionPrototype(masm, receiver, r3, r4, &miss);
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -3423,7 +3435,8 @@
                                          support_wrapper_);
 
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -3493,7 +3506,8 @@
 
   __ bind(&miss);
 
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -4401,20 +4415,17 @@
   // function without changing the state.
   __ cmp(r3, r1);
   __ b(eq, &done);
-  __ CompareRoot(r3, Heap::kUndefinedValueRootIndex);
-  __ b(eq, &done);
 
-  // Special handling of the Array() function, which caches not only the
-  // monomorphic Array function but the initial ElementsKind with special
-  // sentinels
-  __ JumpIfNotSmi(r3, &miss);
-  if (FLAG_debug_code) {
-    Handle<Object> terminal_kind_sentinel =
-        TypeFeedbackCells::MonomorphicArraySentinel(masm->isolate(),
-                                                    LAST_FAST_ELEMENTS_KIND);
-    __ cmp(r3, Operand(terminal_kind_sentinel));
-    __ Assert(le, "Array function sentinel is not an ElementsKind");
-  }
+  // If we came here, we need to see if we are the array function.
+  // If we didn't have a matching function, and we didn't find the megamorph
+  // sentinel, then we have in the cell either some other function or an
+  // AllocationSite. Do a map check on the object in ecx.
+  Handle<Map> allocation_site_map(
+      masm->isolate()->heap()->allocation_site_map(),
+      masm->isolate());
+  __ ldr(r5, FieldMemOperand(r3, 0));
+  __ CompareRoot(r5, Heap::kAllocationSiteMapRootIndex);
+  __ b(ne, &miss);
 
   // Make sure the function is the Array() function
   __ LoadArrayFunction(r3);
@@ -4443,14 +4454,22 @@
   __ cmp(r1, r3);
   __ b(ne, &not_array_function);
 
-  // The target function is the Array constructor, install a sentinel value in
-  // the constructor's type info cell that will track the initial ElementsKind
-  // that should be used for the array when its constructed.
-  Handle<Object> initial_kind_sentinel =
-      TypeFeedbackCells::MonomorphicArraySentinel(masm->isolate(),
-          GetInitialFastElementsKind());
-  __ mov(r3, Operand(initial_kind_sentinel));
-  __ str(r3, FieldMemOperand(r2, Cell::kValueOffset));
+  // The target function is the Array constructor,
+  // Create an AllocationSite if we don't already have it, store it in the cell
+  {
+    FrameScope scope(masm, StackFrame::INTERNAL);
+
+    __ push(r0);
+    __ push(r1);
+    __ push(r2);
+
+    CreateAllocationSiteStub create_stub;
+    __ CallStub(&create_stub);
+
+    __ pop(r2);
+    __ pop(r1);
+    __ pop(r0);
+  }
   __ b(&done);
 
   __ bind(&not_array_function);
@@ -6934,10 +6953,6 @@
   ASSERT(FAST_DOUBLE_ELEMENTS == 4);
   ASSERT(FAST_HOLEY_DOUBLE_ELEMENTS == 5);
 
-  Handle<Object> undefined_sentinel(
-      masm->isolate()->heap()->undefined_value(),
-      masm->isolate());
-
   // is the low bit set? If so, we are holey and that is good.
   __ tst(r3, Operand(1));
   Label normal_sequence;
@@ -6949,18 +6964,19 @@
   __ b(eq, &normal_sequence);
 
   // We are going to create a holey array, but our kind is non-holey.
-  // Fix kind and retry
+  // Fix kind and retry (only if we have an allocation site in the cell).
   __ add(r3, r3, Operand(1));
-  __ cmp(r2, Operand(undefined_sentinel));
+  __ CompareRoot(r2, Heap::kUndefinedValueRootIndex);
   __ b(eq, &normal_sequence);
-
-  // The type cell may have gone megamorphic, don't overwrite if so
-  __ ldr(r5, FieldMemOperand(r2, kPointerSize));
-  __ JumpIfNotSmi(r5, &normal_sequence);
+  __ ldr(r5, FieldMemOperand(r2, Cell::kValueOffset));
+  __ ldr(r5, FieldMemOperand(r5, 0));
+  __ CompareRoot(r5, Heap::kAllocationSiteMapRootIndex);
+  __ b(ne, &normal_sequence);
 
   // Save the resulting elements kind in type info
   __ SmiTag(r3);
-  __ str(r3, FieldMemOperand(r2, kPointerSize));
+  __ ldr(r5, FieldMemOperand(r2, Cell::kValueOffset));
+  __ str(r3, FieldMemOperand(r5, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(r3);
 
   __ bind(&normal_sequence);
@@ -6989,7 +7005,7 @@
     ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
     T stub(kind);
     stub.GetCode(isolate)->set_is_pregenerated(true);
-    if (AllocationSiteInfo::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
+    if (AllocationSite::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
       T stub1(kind, CONTEXT_CHECK_REQUIRED, DISABLE_ALLOCATION_SITES);
       stub1.GetCode(isolate)->set_is_pregenerated(true);
     }
@@ -7030,10 +7046,6 @@
   //  -- sp[0] : return address
   //  -- sp[4] : last argument
   // -----------------------------------
-  Handle<Object> undefined_sentinel(
-      masm->isolate()->heap()->undefined_value(),
-      masm->isolate());
-
   if (FLAG_debug_code) {
     // The array construct code is only set for the global and natives
     // builtin Array functions which always have maps.
@@ -7049,7 +7061,7 @@
     // We should either have undefined in ebx or a valid cell
     Label okay_here;
     Handle<Map> cell_map = masm->isolate()->factory()->cell_map();
-    __ cmp(r2, Operand(undefined_sentinel));
+    __ CompareRoot(r2, Heap::kUndefinedValueRootIndex);
     __ b(eq, &okay_here);
     __ ldr(r3, FieldMemOperand(r2, 0));
     __ cmp(r3, Operand(cell_map));
@@ -7059,10 +7071,20 @@
 
   Label no_info, switch_ready;
   // Get the elements kind and case on that.
-  __ cmp(r2, Operand(undefined_sentinel));
+  __ CompareRoot(r2, Heap::kUndefinedValueRootIndex);
   __ b(eq, &no_info);
   __ ldr(r3, FieldMemOperand(r2, Cell::kValueOffset));
-  __ JumpIfNotSmi(r3, &no_info);
+
+  // The type cell may have undefined in its value.
+  __ CompareRoot(r3, Heap::kUndefinedValueRootIndex);
+  __ b(eq, &no_info);
+
+  // The type cell has either an AllocationSite or a JSFunction
+  __ ldr(r4, FieldMemOperand(r3, 0));
+  __ CompareRoot(r4, Heap::kAllocationSiteMapRootIndex);
+  __ b(ne, &no_info);
+
+  __ ldr(r3, FieldMemOperand(r3, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(r3);
   __ jmp(&switch_ready);
   __ bind(&no_info);
diff --git a/src/arm/ic-arm.cc b/src/arm/ic-arm.cc
index 89ebfde..f5a1fc3 100644
--- a/src/arm/ic-arm.cc
+++ b/src/arm/ic-arm.cc
@@ -1230,8 +1230,8 @@
   // Must return the modified receiver in r0.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                          FAST_DOUBLE_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                      FAST_DOUBLE_ELEMENTS);
     ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, &fail);
     __ mov(r0, r2);
     __ Ret();
@@ -1253,8 +1253,8 @@
   // Must return the modified receiver in r0.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS,
-                                                          FAST_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS,
+                                                      FAST_ELEMENTS);
     ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, &fail);
     __ mov(r0, r2);
     __ Ret();
@@ -1384,8 +1384,8 @@
                                          r4,
                                          slow);
   ASSERT(receiver_map.is(r3));  // Transition code expects map in r3
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                        FAST_DOUBLE_ELEMENTS);
+  AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                    FAST_DOUBLE_ELEMENTS);
   ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, slow);
   __ ldr(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
   __ jmp(&fast_double_without_map_check);
@@ -1398,7 +1398,7 @@
                                          r4,
                                          slow);
   ASSERT(receiver_map.is(r3));  // Transition code expects map in r3
-  mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateMapChangeElementsTransition(masm, mode,
                                                                    slow);
   __ ldr(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
@@ -1414,7 +1414,7 @@
                                          r4,
                                          slow);
   ASSERT(receiver_map.is(r3));  // Transition code expects map in r3
-  mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, slow);
   __ ldr(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
   __ jmp(&finish_object_store);
@@ -1531,8 +1531,9 @@
   // -----------------------------------
 
   // Get the receiver from the stack and probe the stub cache.
-  Code::Flags flags =
-      Code::ComputeFlags(Code::STORE_IC, MONOMORPHIC, strict_mode);
+  Code::Flags flags = Code::ComputeFlags(
+      Code::STUB, MONOMORPHIC, strict_mode,
+      Code::NORMAL, Code::STORE_IC);
 
   Isolate::Current()->stub_cache()->GenerateProbe(
       masm, flags, r1, r2, r3, r4, r5, r6);
diff --git a/src/arm/lithium-arm.cc b/src/arm/lithium-arm.cc
index c8d0fdb..56332ee 100644
--- a/src/arm/lithium-arm.cc
+++ b/src/arm/lithium-arm.cc
@@ -2431,14 +2431,6 @@
 }
 
 
-LInstruction* LChunkBuilder::DoDeleteProperty(HDeleteProperty* instr) {
-  LOperand* object = UseFixed(instr->object(), r0);
-  LOperand* key = UseFixed(instr->key(), r1);
-  LDeleteProperty* result = new(zone()) LDeleteProperty(object, key);
-  return MarkAsCall(DefineFixed(result, r0), instr);
-}
-
-
 LInstruction* LChunkBuilder::DoOsrEntry(HOsrEntry* instr) {
   ASSERT(argument_count_ == 0);
   allocator_->MarkAsOsrEntry();
@@ -2611,14 +2603,6 @@
 }
 
 
-LInstruction* LChunkBuilder::DoIn(HIn* instr) {
-  LOperand* key = UseRegisterAtStart(instr->key());
-  LOperand* object = UseRegisterAtStart(instr->object());
-  LIn* result = new(zone()) LIn(key, object);
-  return MarkAsCall(DefineFixed(result, r0), instr);
-}
-
-
 LInstruction* LChunkBuilder::DoForInPrepareMap(HForInPrepareMap* instr) {
   LOperand* object = UseFixed(instr->enumerable(), r0);
   LForInPrepareMap* result = new(zone()) LForInPrepareMap(object);
diff --git a/src/arm/lithium-arm.h b/src/arm/lithium-arm.h
index 4adf026..b91288d 100644
--- a/src/arm/lithium-arm.h
+++ b/src/arm/lithium-arm.h
@@ -92,7 +92,6 @@
   V(Context)                                    \
   V(DebugBreak)                                 \
   V(DeclareGlobals)                             \
-  V(DeleteProperty)                             \
   V(Deoptimize)                                 \
   V(DivI)                                       \
   V(DoubleToI)                                  \
@@ -106,7 +105,6 @@
   V(Goto)                                       \
   V(HasCachedArrayIndexAndBranch)               \
   V(HasInstanceTypeAndBranch)                   \
-  V(In)                                         \
   V(InstanceOf)                                 \
   V(InstanceOfKnownGlobal)                      \
   V(InstanceSize)                               \
@@ -2566,20 +2564,6 @@
 };
 
 
-class LDeleteProperty: public LTemplateInstruction<1, 2, 0> {
- public:
-  LDeleteProperty(LOperand* object, LOperand* key) {
-    inputs_[0] = object;
-    inputs_[1] = key;
-  }
-
-  LOperand* object() { return inputs_[0]; }
-  LOperand* key() { return inputs_[1]; }
-
-  DECLARE_CONCRETE_INSTRUCTION(DeleteProperty, "delete-property")
-};
-
-
 class LOsrEntry: public LTemplateInstruction<0, 0, 0> {
  public:
   LOsrEntry() {}
@@ -2601,20 +2585,6 @@
 };
 
 
-class LIn: public LTemplateInstruction<1, 2, 0> {
- public:
-  LIn(LOperand* key, LOperand* object) {
-    inputs_[0] = key;
-    inputs_[1] = object;
-  }
-
-  LOperand* key() { return inputs_[0]; }
-  LOperand* object() { return inputs_[1]; }
-
-  DECLARE_CONCRETE_INSTRUCTION(In, "in")
-};
-
-
 class LForInPrepareMap: public LTemplateInstruction<1, 1, 0> {
  public:
   explicit LForInPrepareMap(LOperand* object) {
diff --git a/src/arm/lithium-codegen-arm.cc b/src/arm/lithium-codegen-arm.cc
index 191ee49..a07bbcd 100644
--- a/src/arm/lithium-codegen-arm.cc
+++ b/src/arm/lithium-codegen-arm.cc
@@ -4142,7 +4142,7 @@
   __ mov(r2, Operand(instr->hydrogen()->property_cell()));
   ElementsKind kind = instr->hydrogen()->elements_kind();
   AllocationSiteOverrideMode override_mode =
-      (AllocationSiteInfo::GetMode(kind) == TRACK_ALLOCATION_SITE)
+      (AllocationSite::GetMode(kind) == TRACK_ALLOCATION_SITE)
           ? DISABLE_ALLOCATION_SITES
           : DONT_OVERRIDE;
   ContextCheckMode context_mode = CONTEXT_CHECK_NOT_REQUIRED;
@@ -5731,33 +5731,6 @@
 }
 
 
-void LCodeGen::DoDeleteProperty(LDeleteProperty* instr) {
-  Register object = ToRegister(instr->object());
-  Register key = ToRegister(instr->key());
-  Register strict = scratch0();
-  __ mov(strict, Operand(Smi::FromInt(strict_mode_flag())));
-  __ Push(object, key, strict);
-  ASSERT(instr->HasPointerMap());
-  LPointerMap* pointers = instr->pointer_map();
-  RecordPosition(pointers->position());
-  SafepointGenerator safepoint_generator(
-      this, pointers, Safepoint::kLazyDeopt);
-  __ InvokeBuiltin(Builtins::DELETE, CALL_FUNCTION, safepoint_generator);
-}
-
-
-void LCodeGen::DoIn(LIn* instr) {
-  Register obj = ToRegister(instr->object());
-  Register key = ToRegister(instr->key());
-  __ Push(key, obj);
-  ASSERT(instr->HasPointerMap());
-  LPointerMap* pointers = instr->pointer_map();
-  RecordPosition(pointers->position());
-  SafepointGenerator safepoint_generator(this, pointers, Safepoint::kLazyDeopt);
-  __ InvokeBuiltin(Builtins::IN, CALL_FUNCTION, safepoint_generator);
-}
-
-
 void LCodeGen::DoDeferredStackCheck(LStackCheck* instr) {
   PushSafepointRegistersScope scope(this, Safepoint::kWithRegisters);
   __ CallRuntimeSaveDoubles(Runtime::kStackGuard);
diff --git a/src/arm/stub-cache-arm.cc b/src/arm/stub-cache-arm.cc
index c154f9a..3bec1c5 100644
--- a/src/arm/stub-cache-arm.cc
+++ b/src/arm/stub-cache-arm.cc
@@ -437,91 +437,58 @@
 }
 
 
+void BaseStoreStubCompiler::GenerateNegativeHolderLookup(
+    MacroAssembler* masm,
+    Handle<JSObject> holder,
+    Register holder_reg,
+    Handle<Name> name,
+    Label* miss) {
+  if (holder->IsJSGlobalObject()) {
+    GenerateCheckPropertyCell(
+        masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+  } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
+    GenerateDictionaryNegativeLookup(
+        masm, miss, holder_reg, name, scratch1(), scratch2());
+  }
+}
+
+
 // Generate StoreTransition code, value is passed in r0 register.
 // When leaving generated code after success, the receiver_reg and name_reg
 // may be clobbered.  Upon branch to miss_label, the receiver and name
 // registers have their original values.
-void StubCompiler::GenerateStoreTransition(MacroAssembler* masm,
-                                           Handle<JSObject> object,
-                                           LookupResult* lookup,
-                                           Handle<Map> transition,
-                                           Handle<Name> name,
-                                           Register receiver_reg,
-                                           Register name_reg,
-                                           Register value_reg,
-                                           Register scratch1,
-                                           Register scratch2,
-                                           Register scratch3,
-                                           Label* miss_label,
-                                           Label* miss_restore_name,
-                                           Label* slow) {
+void BaseStoreStubCompiler::GenerateStoreTransition(MacroAssembler* masm,
+                                                    Handle<JSObject> object,
+                                                    LookupResult* lookup,
+                                                    Handle<Map> transition,
+                                                    Handle<Name> name,
+                                                    Register receiver_reg,
+                                                    Register storage_reg,
+                                                    Register value_reg,
+                                                    Register scratch1,
+                                                    Register scratch2,
+                                                    Register scratch3,
+                                                    Label* miss_label,
+                                                    Label* slow) {
   // r0 : value
   Label exit;
 
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, scratch1, Handle<Map>(object->map()), miss_label,
-              DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, miss_label);
-  }
-
   int descriptor = transition->LastAdded();
   DescriptorArray* descriptors = transition->instance_descriptors();
   PropertyDetails details = descriptors->GetDetails(descriptor);
   Representation representation = details.representation();
   ASSERT(!representation.IsNone());
 
-  // Ensure no transitions to deprecated maps are followed.
-  __ CheckMapDeprecated(transition, scratch1, miss_label);
-
-  // Check that we are allowed to write this.
-  if (object->GetPrototype()->IsJSObject()) {
-    JSObject* holder;
-    // holder == object indicates that no property was found.
-    if (lookup->holder() != *object) {
-      holder = lookup->holder();
-    } else {
-      // Find the top object.
-      holder = *object;
-      do {
-        holder = JSObject::cast(holder->GetPrototype());
-      } while (holder->GetPrototype()->IsJSObject());
-    }
-    Register holder_reg = CheckPrototypes(
-        object, receiver_reg, Handle<JSObject>(holder), name_reg,
-        scratch1, scratch2, name, miss_restore_name, SKIP_RECEIVER);
-    // If no property was found, and the holder (the last object in the
-    // prototype chain) is in slow mode, we need to do a negative lookup on the
-    // holder.
-    if (lookup->holder() == *object) {
-      if (holder->IsJSGlobalObject()) {
-        GenerateCheckPropertyCell(
-            masm,
-            Handle<GlobalObject>(GlobalObject::cast(holder)),
-            name,
-            scratch1,
-            miss_restore_name);
-      } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
-        GenerateDictionaryNegativeLookup(
-            masm, miss_restore_name, holder_reg, name, scratch1, scratch2);
-      }
-    }
-  }
-
-  Register storage_reg = name_reg;
-
   if (details.type() == CONSTANT_FUNCTION) {
     Handle<HeapObject> constant(
         HeapObject::cast(descriptors->GetValue(descriptor)));
     __ LoadHeapObject(scratch1, constant);
     __ cmp(value_reg, scratch1);
-    __ b(ne, miss_restore_name);
+    __ b(ne, miss_label);
   } else if (FLAG_track_fields && representation.IsSmi()) {
-    __ JumpIfNotSmi(value_reg, miss_restore_name);
+    __ JumpIfNotSmi(value_reg, miss_label);
   } else if (FLAG_track_heap_object_fields && representation.IsHeapObject()) {
-    __ JumpIfSmi(value_reg, miss_restore_name);
+    __ JumpIfSmi(value_reg, miss_label);
   } else if (FLAG_track_double_fields && representation.IsDouble()) {
     Label do_store, heap_number;
     __ LoadRoot(scratch3, Heap::kHeapNumberMapRootIndex);
@@ -535,7 +502,7 @@
 
     __ bind(&heap_number);
     __ CheckMap(value_reg, scratch1, Heap::kHeapNumberMapRootIndex,
-                miss_restore_name, DONT_DO_SMI_CHECK);
+                miss_label, DONT_DO_SMI_CHECK);
     __ vldr(d0, FieldMemOperand(value_reg, HeapNumber::kValueOffset));
 
     __ bind(&do_store);
@@ -566,8 +533,7 @@
   __ mov(scratch1, Operand(transition));
   __ str(scratch1, FieldMemOperand(receiver_reg, HeapObject::kMapOffset));
 
-  // Update the write barrier for the map field and pass the now unused
-  // name_reg as scratch register.
+  // Update the write barrier for the map field.
   __ RecordWriteField(receiver_reg,
                       HeapObject::kMapOffset,
                       scratch1,
@@ -604,19 +570,13 @@
     }
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
-      // Skip updating write barrier if storing a smi.
-      __ JumpIfSmi(value_reg, &exit);
-
       // Update the write barrier for the array address.
-      // Pass the now unused name_reg as a scratch register.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ mov(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ mov(storage_reg, value_reg);
       }
       __ RecordWriteField(receiver_reg,
                           offset,
-                          name_reg,
+                          storage_reg,
                           scratch1,
                           kLRHasNotBeenSaved,
                           kDontSaveFPRegs,
@@ -636,19 +596,13 @@
     }
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
-      // Skip updating write barrier if storing a smi.
-      __ JumpIfSmi(value_reg, &exit);
-
       // Update the write barrier for the array address.
-      // Ok to clobber receiver_reg and name_reg, since we return.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ mov(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ mov(storage_reg, value_reg);
       }
       __ RecordWriteField(scratch1,
                           offset,
-                          name_reg,
+                          storage_reg,
                           receiver_reg,
                           kLRHasNotBeenSaved,
                           kDontSaveFPRegs,
@@ -668,27 +622,18 @@
 // When leaving generated code after success, the receiver_reg and name_reg
 // may be clobbered.  Upon branch to miss_label, the receiver and name
 // registers have their original values.
-void StubCompiler::GenerateStoreField(MacroAssembler* masm,
-                                      Handle<JSObject> object,
-                                      LookupResult* lookup,
-                                      Register receiver_reg,
-                                      Register name_reg,
-                                      Register value_reg,
-                                      Register scratch1,
-                                      Register scratch2,
-                                      Label* miss_label) {
+void BaseStoreStubCompiler::GenerateStoreField(MacroAssembler* masm,
+                                               Handle<JSObject> object,
+                                               LookupResult* lookup,
+                                               Register receiver_reg,
+                                               Register name_reg,
+                                               Register value_reg,
+                                               Register scratch1,
+                                               Register scratch2,
+                                               Label* miss_label) {
   // r0 : value
   Label exit;
 
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, scratch1, Handle<Map>(object->map()), miss_label,
-              DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, miss_label);
-  }
-
   // Stub never generated for non-global objects that require access
   // checks.
   ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
@@ -1342,7 +1287,8 @@
 }
 
 
-void BaseLoadStubCompiler::HandlerFrontendFooter(Label* success,
+void BaseLoadStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                 Label* success,
                                                  Label* miss) {
   if (!miss->is_unused()) {
     __ b(success);
@@ -1352,6 +1298,17 @@
 }
 
 
+void BaseStoreStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                  Label* success,
+                                                  Label* miss) {
+  if (!miss->is_unused()) {
+    __ b(success);
+    GenerateRestoreName(masm(), miss, name);
+    TailCallBuiltin(masm(), MissBuiltin(kind()));
+  }
+}
+
+
 Register BaseLoadStubCompiler::CallbackHandlerFrontend(
     Handle<JSObject> object,
     Register object_reg,
@@ -1394,7 +1351,7 @@
     __ b(ne, &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
   return reg;
 }
 
@@ -1415,7 +1372,7 @@
     GenerateCheckPropertyCell(masm(), global, name, scratch2(), &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
 }
 
 
@@ -1728,11 +1685,11 @@
     GenerateLoadFunctionFromCell(cell, function, &miss);
   }
 
-  Handle<Smi> kind(Smi::FromInt(GetInitialFastElementsKind()), isolate());
-  Handle<Cell> kind_feedback_cell =
-      isolate()->factory()->NewCell(kind);
+  Handle<AllocationSite> site = isolate()->factory()->NewAllocationSite();
+  site->set_transition_info(Smi::FromInt(GetInitialFastElementsKind()));
+  Handle<Cell> site_feedback_cell = isolate()->factory()->NewCell(site);
   __ mov(r0, Operand(argc));
-  __ mov(r2, Operand(kind_feedback_cell));
+  __ mov(r2, Operand(site_feedback_cell));
   __ mov(r1, Operand(function));
 
   ArrayConstructorStub stub(isolate());
@@ -2824,34 +2781,30 @@
 
 
 Handle<Code> StoreStubCompiler::CompileStoreCallback(
-    Handle<Name> name,
     Handle<JSObject> object,
     Handle<JSObject> holder,
+    Handle<Name> name,
     Handle<ExecutableAccessorInfo> callback) {
-  Label miss;
-  // Check that the maps haven't changed.
-  __ JumpIfSmi(receiver(), &miss);
-  CheckPrototypes(object, receiver(), holder,
-                  scratch1(), scratch2(), scratch3(), name, &miss);
+  Label success;
+  HandlerFrontend(object, receiver(), holder, name, &success);
+  __ bind(&success);
 
   // Stub never generated for non-global objects that require access checks.
   ASSERT(holder->IsJSGlobalProxy() || !holder->IsAccessCheckNeeded());
 
   __ push(receiver());  // receiver
   __ mov(ip, Operand(callback));  // callback info
-  __ Push(ip, this->name(), value());
+  __ push(ip);
+  __ mov(ip, Operand(name));
+  __ Push(ip, value());
 
   // Do tail-call to the runtime system.
   ExternalReference store_callback_property =
       ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate());
   __ TailCallExternalReference(store_callback_property, 4, 1);
 
-  // Handle store cache miss.
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
   // Return the generated code.
-  return GetICCode(kind(), Code::CALLBACKS, name);
+  return GetCode(kind(), Code::CALLBACKS, name);
 }
 
 
@@ -3105,7 +3058,7 @@
     __ b(eq, &miss);
   }
 
-  HandlerFrontendFooter(&success, &miss);
+  HandlerFrontendFooter(name, &success, &miss);
   __ bind(&success);
 
   Counters* counters = isolate()->counters();
@@ -3118,7 +3071,7 @@
 }
 
 
-Handle<Code> BaseLoadStubCompiler::CompilePolymorphicIC(
+Handle<Code> BaseLoadStoreStubCompiler::CompilePolymorphicIC(
     MapHandleList* receiver_maps,
     CodeHandleList* handlers,
     Handle<Name> name,
diff --git a/src/ast.cc b/src/ast.cc
index 7da9b33..964f5bc 100644
--- a/src/ast.cc
+++ b/src/ast.cc
@@ -503,7 +503,7 @@
     // Record receiver type for monomorphic keyed stores.
     receiver_types_.Add(oracle->StoreMonomorphicReceiverType(id), zone);
     store_mode_ = oracle->GetStoreMode(id);
-  } else if (oracle->StoreIsPolymorphic(id)) {
+  } else if (oracle->StoreIsKeyedPolymorphic(id)) {
     receiver_types_.Reserve(kMaxKeyedPolymorphism, zone);
     oracle->CollectKeyedReceiverTypes(id, &receiver_types_);
     store_mode_ = oracle->GetStoreMode(id);
@@ -520,9 +520,11 @@
     // Record receiver type for monomorphic keyed stores.
     receiver_types_.Add(
         oracle->StoreMonomorphicReceiverType(id), zone);
-  } else if (oracle->StoreIsPolymorphic(id)) {
+  } else if (oracle->StoreIsKeyedPolymorphic(id)) {
     receiver_types_.Reserve(kMaxKeyedPolymorphism, zone);
     oracle->CollectKeyedReceiverTypes(id, &receiver_types_);
+  } else {
+    oracle->CollectPolymorphicStoreReceiverTypes(id, &receiver_types_);
   }
   store_mode_ = oracle->GetStoreMode(id);
   type_ = oracle->IncrementType(this);
@@ -676,8 +678,9 @@
     target_ = oracle->GetCallNewTarget(this);
     Object* value = allocation_info_cell_->value();
     ASSERT(!value->IsTheHole());
-    if (value->IsSmi()) {
-      elements_kind_ = static_cast<ElementsKind>(Smi::cast(value)->value());
+    if (value->IsAllocationSite()) {
+      AllocationSite* site = AllocationSite::cast(value);
+      elements_kind_ = site->GetElementsKind();
     }
   }
 }
diff --git a/src/builtins.cc b/src/builtins.cc
index f4ebdc2..f081e3d 100644
--- a/src/builtins.cc
+++ b/src/builtins.cc
@@ -212,8 +212,9 @@
     if (maybe_array->IsFailure()) return maybe_array;
 
     AllocationSiteInfo* info = AllocationSiteInfo::FindForJSObject(array);
-    ElementsKind to_kind = array->GetElementsKind();
-    if (info != NULL && info->GetElementsKindPayload(&to_kind)) {
+    if (info != NULL && info->IsValid()) {
+      AllocationSite* site = info->GetAllocationSite();
+      ElementsKind to_kind = site->GetElementsKind();
       if (IsMoreGeneralElementsKindTransition(array->GetElementsKind(),
                                               to_kind)) {
         // We have advice that we should change the elements kind
diff --git a/src/code-stubs-hydrogen.cc b/src/code-stubs-hydrogen.cc
index 9792096..d8eaae0 100644
--- a/src/code-stubs-hydrogen.cc
+++ b/src/code-stubs-hydrogen.cc
@@ -315,16 +315,17 @@
   FastCloneShallowArrayStub::Mode mode = casted_stub()->mode();
   int length = casted_stub()->length();
 
-  HInstruction* boilerplate =
+  HInstruction* allocation_site =
       AddInstruction(new(zone) HLoadKeyed(GetParameter(0),
                                           GetParameter(1),
                                           NULL,
                                           FAST_ELEMENTS));
-
   IfBuilder checker(this);
-  checker.IfNot<HCompareObjectEqAndBranch, HValue*>(boilerplate, undefined);
+  checker.IfNot<HCompareObjectEqAndBranch, HValue*>(allocation_site, undefined);
   checker.Then();
 
+  HObjectAccess access = HObjectAccess::ForAllocationSiteInfoSite();
+  HInstruction* boilerplate = AddLoad(allocation_site, access);
   if (mode == FastCloneShallowArrayStub::CLONE_ANY_ELEMENTS) {
     HValue* elements = AddLoadElements(boilerplate);
 
@@ -333,6 +334,7 @@
     if_fixed_cow.Then();
     environment()->Push(BuildCloneShallowArray(context(),
                                                boilerplate,
+                                               allocation_site,
                                                alloc_site_mode,
                                                FAST_ELEMENTS,
                                                0/*copy-on-write*/));
@@ -343,12 +345,14 @@
     if_fixed.Then();
     environment()->Push(BuildCloneShallowArray(context(),
                                                boilerplate,
+                                               allocation_site,
                                                alloc_site_mode,
                                                FAST_ELEMENTS,
                                                length));
     if_fixed.Else();
     environment()->Push(BuildCloneShallowArray(context(),
                                                boilerplate,
+                                               allocation_site,
                                                alloc_site_mode,
                                                FAST_DOUBLE_ELEMENTS,
                                                length));
@@ -356,6 +360,7 @@
     ElementsKind elements_kind = casted_stub()->ComputeElementsKind();
     environment()->Push(BuildCloneShallowArray(context(),
                                                boilerplate,
+                                               allocation_site,
                                                alloc_site_mode,
                                                elements_kind,
                                                length));
@@ -422,6 +427,45 @@
 
 
 template <>
+HValue* CodeStubGraphBuilder<CreateAllocationSiteStub>::BuildCodeStub() {
+  Zone* zone = this->zone();
+
+  HValue* size = AddInstruction(new(zone) HConstant(AllocationSite::kSize));
+  HAllocate::Flags flags = HAllocate::DefaultFlags();
+  flags = static_cast<HAllocate::Flags>(
+      flags | HAllocate::CAN_ALLOCATE_IN_OLD_POINTER_SPACE);
+  HInstruction* object = AddInstruction(new(zone)
+      HAllocate(context(), size, HType::JSObject(), flags));
+
+  // Store the map
+  Handle<Map> allocation_site_map(isolate()->heap()->allocation_site_map(),
+                                  isolate());
+  AddStoreMapConstant(object, allocation_site_map);
+
+  // Store the payload (smi elements kind)
+  HValue* initial_elements_kind = AddInstruction(new(zone) HConstant(
+      GetInitialFastElementsKind()));
+  AddInstruction(new(zone) HStoreNamedField(object,
+      HObjectAccess::ForAllocationSiteTransitionInfo(), initial_elements_kind));
+
+  // We use a hammer (SkipWriteBarrier()) to indicate that we know the input
+  // cell is really a Cell, and so no write barrier is needed.
+  // TODO(mvstanton): Add a debug_code check to verify the input cell is really
+  // a cell. (perhaps with a new instruction, HAssert).
+  HInstruction* cell = GetParameter(0);
+  HObjectAccess access = HObjectAccess::ForCellValue();
+  HStoreNamedField* store = AddStore(cell, access, object);
+  store->SkipWriteBarrier();
+  return cell;
+}
+
+
+Handle<Code> CreateAllocationSiteStub::GenerateCode() {
+  return DoGenerateCode(this);
+}
+
+
+template <>
 HValue* CodeStubGraphBuilder<KeyedLoadFastElementStub>::BuildCodeStub() {
   HInstruction* load = BuildUncheckedMonomorphicElementAccess(
       GetParameter(0), GetParameter(1), NULL, NULL,
@@ -484,45 +528,36 @@
 
 template <>
 HValue* CodeStubGraphBuilder<TransitionElementsKindStub>::BuildCodeStub() {
-  Zone* zone = this->zone();
+  TransitionElementsKindStub* stub = casted_stub();
+  ElementsKind from_kind = stub->from_kind();
+  ElementsKind to_kind = stub->to_kind();
 
   HValue* js_array = GetParameter(0);
   HValue* map = GetParameter(1);
 
   info()->MarkAsSavesCallerDoubles();
 
-  AddInstruction(new(zone) HTrapAllocationMemento(js_array));
+  if (AllocationSite::GetMode(from_kind, to_kind) == TRACK_ALLOCATION_SITE) {
+    Add<HTrapAllocationMemento>(js_array);
+  }
 
   HInstruction* array_length =
       AddLoad(js_array, HObjectAccess::ForArrayLength());
   array_length->set_type(HType::Smi());
 
-  ElementsKind to_kind = casted_stub()->to_kind();
-  BuildNewSpaceArrayCheck(array_length, to_kind);
-
   IfBuilder if_builder(this);
 
-  if_builder.If<HCompareNumericAndBranch>(array_length,
-                                          graph()->GetConstant0(),
-                                          Token::EQ);
+  if_builder.IfNot<HCompareNumericAndBranch>(array_length,
+                                             graph()->GetConstant0(),
+                                             Token::EQ);
   if_builder.Then();
 
-  // Nothing to do, just change the map.
-
-  if_builder.Else();
-
   HInstruction* elements = AddLoadElements(js_array);
 
   HInstruction* elements_length = AddLoadFixedArrayLength(elements);
 
-  HValue* new_elements = BuildAllocateElementsAndInitializeElementsHeader(
-      context(), to_kind, elements_length);
-
-  BuildCopyElements(context(), elements,
-                    casted_stub()->from_kind(), new_elements,
-                    to_kind, array_length, elements_length);
-
-  AddStore(js_array, HObjectAccess::ForElementsPointer(), new_elements);
+  BuildGrowElementsCapacity(js_array, elements, from_kind, to_kind,
+                            array_length, elements_length);
 
   if_builder.End();
 
@@ -548,7 +583,10 @@
   }
 
   HValue* property_cell = GetParameter(ArrayConstructorStubBase::kPropertyCell);
-  JSArrayBuilder array_builder(this, kind, property_cell, constructor,
+  // Walk through the property cell to the AllocationSite
+  HValue* alloc_site = AddInstruction(new(zone()) HLoadNamedField(property_cell,
+      HObjectAccess::ForCellValue()));
+  JSArrayBuilder array_builder(this, kind, alloc_site, constructor,
                                override_mode);
   HValue* result = NULL;
   switch (argument_class) {
diff --git a/src/code-stubs.cc b/src/code-stubs.cc
index 802e720..bfc71fc 100644
--- a/src/code-stubs.cc
+++ b/src/code-stubs.cc
@@ -663,6 +663,12 @@
 }
 
 
+void CreateAllocationSiteStub::GenerateAheadOfTime(Isolate* isolate) {
+  CreateAllocationSiteStub stub;
+  stub.GetCode(isolate)->set_is_pregenerated(true);
+}
+
+
 void KeyedStoreElementStub::Generate(MacroAssembler* masm) {
   switch (elements_kind_) {
     case FAST_ELEMENTS:
@@ -807,7 +813,7 @@
 
 void ElementsTransitionAndStoreStub::Generate(MacroAssembler* masm) {
   Label fail;
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(from_, to_);
+  AllocationSiteMode mode = AllocationSite::GetMode(from_, to_);
   ASSERT(!IsFastHoleyElementsKind(from_) || IsFastHoleyElementsKind(to_));
   if (!FLAG_trace_elements_transitions) {
     if (IsFastSmiOrObjectElementsKind(to_)) {
diff --git a/src/code-stubs.h b/src/code-stubs.h
index 0eefe8c..e4cbe18 100644
--- a/src/code-stubs.h
+++ b/src/code-stubs.h
@@ -66,6 +66,7 @@
   V(FastNewBlockContext)                 \
   V(FastCloneShallowArray)               \
   V(FastCloneShallowObject)              \
+  V(CreateAllocationSite)                \
   V(ToBoolean)                           \
   V(ToNumber)                            \
   V(ArgumentsAccess)                     \
@@ -738,6 +739,28 @@
 };
 
 
+class CreateAllocationSiteStub : public HydrogenCodeStub {
+ public:
+  explicit CreateAllocationSiteStub() { }
+
+  virtual Handle<Code> GenerateCode();
+
+  virtual bool IsPregenerated() { return true; }
+
+  static void GenerateAheadOfTime(Isolate* isolate);
+
+  virtual void InitializeInterfaceDescriptor(
+      Isolate* isolate,
+      CodeStubInterfaceDescriptor* descriptor);
+
+ private:
+  Major MajorKey() { return CreateAllocationSite; }
+  int NotMissMinorKey() { return 0; }
+
+  DISALLOW_COPY_AND_ASSIGN(CreateAllocationSiteStub);
+};
+
+
 class InstanceofStub: public PlatformCodeStub {
  public:
   enum Flags {
@@ -1873,7 +1896,7 @@
     // if there is a difference between the global allocation site policy
     // for an ElementsKind and the desired usage of the stub.
     ASSERT(override_mode != DISABLE_ALLOCATION_SITES ||
-           AllocationSiteInfo::GetMode(kind) == TRACK_ALLOCATION_SITE);
+           AllocationSite::GetMode(kind) == TRACK_ALLOCATION_SITE);
     bit_field_ = ElementsKindBits::encode(kind) |
         AllocationSiteOverrideModeBits::encode(override_mode) |
         ContextCheckModeBits::encode(context_mode);
diff --git a/src/d8.cc b/src/d8.cc
index cb43d2f..21daa0b 100644
--- a/src/d8.cc
+++ b/src/d8.cc
@@ -68,6 +68,10 @@
 #include "v8.h"
 #endif  // V8_SHARED
 
+#if defined(V8_I18N_SUPPORT)
+#include "icu_util.h"
+#endif
+
 #if !defined(_WIN32) && !defined(_WIN64)
 #include <unistd.h>  // NOLINT
 #endif
@@ -1582,6 +1586,9 @@
 
 int Shell::Main(int argc, char* argv[]) {
   if (!SetOptions(argc, argv)) return 1;
+#if defined(V8_I18N_SUPPORT)
+  InitializeICU();
+#endif
 #ifndef V8_SHARED
   i::FLAG_harmony_array_buffer = true;
   i::FLAG_harmony_typed_arrays = true;
diff --git a/src/d8.gyp b/src/d8.gyp
index 47a7cc0..6a57e12 100644
--- a/src/d8.gyp
+++ b/src/d8.gyp
@@ -31,8 +31,9 @@
     'console%': '',
     # Enable support for Intel VTune. Supported on ia32/x64 only
     'v8_enable_vtunejit%': 0,
+    'v8_enable_i18n_support%': 0,
   },
-  'includes': ['../build/common.gypi'],
+  'includes': ['../build/toolchain.gypi', '../build/features.gypi'],
   'targets': [
     {
       'target_name': 'd8',
@@ -78,6 +79,15 @@
             '../src/third_party/vtune/v8vtune.gyp:v8_vtune',
           ],
         }],
+        ['v8_enable_i18n_support==1', {
+          'sources': [
+            'icu_util.cc',
+            'icu_util.h',
+          ],
+          'dependencies': [
+            '<(DEPTH)/third_party/icu/icu.gyp:*',
+          ],
+        }],
       ],
     },
     {
diff --git a/src/extensions/i18n/number-format.cc b/src/extensions/i18n/number-format.cc
index 2240b08..1364715 100644
--- a/src/extensions/i18n/number-format.cc
+++ b/src/extensions/i18n/number-format.cc
@@ -148,10 +148,10 @@
     args.GetReturnValue().Set(result.getDouble());
     return;
   case icu::Formattable::kLong:
-    args.GetReturnValue().Set(v8::Number::New(result.getLong()));
+    args.GetReturnValue().Set(result.getLong());
     return;
   case icu::Formattable::kInt64:
-    args.GetReturnValue().Set(v8::Number::New(result.getInt64()));
+    args.GetReturnValue().Set(static_cast<double>(result.getInt64()));
     return;
   default:
     return;
diff --git a/src/factory.cc b/src/factory.cc
index 6efc2c2..dc07768 100644
--- a/src/factory.cc
+++ b/src/factory.cc
@@ -519,6 +519,14 @@
 }
 
 
+Handle<AllocationSite> Factory::NewAllocationSite() {
+  CALL_HEAP_FUNCTION(
+      isolate(),
+      isolate()->heap()->AllocateAllocationSite(),
+      AllocationSite);
+}
+
+
 Handle<Map> Factory::NewMap(InstanceType type,
                             int instance_size,
                             ElementsKind elements_kind) {
diff --git a/src/factory.h b/src/factory.h
index b39c4f4..dc7933a 100644
--- a/src/factory.h
+++ b/src/factory.h
@@ -243,6 +243,8 @@
 
   Handle<PropertyCell> NewPropertyCell(Handle<Object> value);
 
+  Handle<AllocationSite> NewAllocationSite();
+
   Handle<Map> NewMap(
       InstanceType type,
       int instance_size,
diff --git a/src/global-handles.cc b/src/global-handles.cc
index c69b9e2..5c65635 100644
--- a/src/global-handles.cc
+++ b/src/global-handles.cc
@@ -634,6 +634,11 @@
     for (int i = 0; i < new_space_nodes_.length(); ++i) {
       Node* node = new_space_nodes_[i];
       ASSERT(node->is_in_new_space_list());
+      if (!node->IsRetainer()) {
+        // Free nodes do not have weak callbacks. Do not use them to compute
+        // the next_gc_likely_to_collect_more.
+        continue;
+      }
       // Skip dependent handles. Their weak callbacks might expect to be
       // called between two global garbage collection callbacks which
       // are not called for minor collections.
@@ -656,6 +661,11 @@
     }
   } else {
     for (NodeIterator it(this); !it.done(); it.Advance()) {
+      if (!it.node()->IsRetainer()) {
+        // Free nodes do not have weak callbacks. Do not use them to compute
+        // the next_gc_likely_to_collect_more.
+        continue;
+      }
       it.node()->clear_partially_dependent();
       if (it.node()->PostGarbageCollectionProcessing(isolate_)) {
         if (initial_post_gc_processing_count != post_gc_processing_count_) {
diff --git a/src/heap-inl.h b/src/heap-inl.h
index 92ae8e5..97c56df 100644
--- a/src/heap-inl.h
+++ b/src/heap-inl.h
@@ -495,10 +495,9 @@
 
 MaybeObject* Heap::AllocateEmptyJSArrayWithAllocationSite(
       ElementsKind elements_kind,
-      Handle<Object> allocation_site_payload) {
+      Handle<AllocationSite> allocation_site) {
   return AllocateJSArrayAndStorageWithAllocationSite(elements_kind, 0, 0,
-      allocation_site_payload,
-      DONT_INITIALIZE_ARRAY_ELEMENTS);
+      allocation_site, DONT_INITIALIZE_ARRAY_ELEMENTS);
 }
 
 
diff --git a/src/heap-snapshot-generator.cc b/src/heap-snapshot-generator.cc
index d65b814..cb1fa4d 100644
--- a/src/heap-snapshot-generator.cc
+++ b/src/heap-snapshot-generator.cc
@@ -955,9 +955,10 @@
     ExtractCellReferences(entry, Cell::cast(obj));
     extract_indexed_refs = false;
   } else if (obj->IsPropertyCell()) {
-    ExtractPropertyCellReferences(
-        entry, PropertyCell::cast(obj));
+    ExtractPropertyCellReferences(entry, PropertyCell::cast(obj));
     extract_indexed_refs = false;
+  } else if (obj->IsAllocationSite()) {
+    ExtractAllocationSiteReferences(entry, AllocationSite::cast(obj));
   }
   if (extract_indexed_refs) {
     SetInternalReference(obj, entry, "map", obj->map(), HeapObject::kMapOffset);
@@ -1264,6 +1265,13 @@
 }
 
 
+void V8HeapExplorer::ExtractAllocationSiteReferences(int entry,
+                                                     AllocationSite* site) {
+  SetInternalReference(site, entry, "transition_info", site->transition_info(),
+                       AllocationSite::kTransitionInfoOffset);
+}
+
+
 void V8HeapExplorer::ExtractClosureReferences(JSObject* js_obj, int entry) {
   if (!js_obj->IsJSFunction()) return;
 
diff --git a/src/heap-snapshot-generator.h b/src/heap-snapshot-generator.h
index 70881ef..31d8088 100644
--- a/src/heap-snapshot-generator.h
+++ b/src/heap-snapshot-generator.h
@@ -460,6 +460,7 @@
   void ExtractCodeReferences(int entry, Code* code);
   void ExtractCellReferences(int entry, Cell* cell);
   void ExtractPropertyCellReferences(int entry, PropertyCell* cell);
+  void ExtractAllocationSiteReferences(int entry, AllocationSite* site);
   void ExtractClosureReferences(JSObject* js_obj, int entry);
   void ExtractPropertyReferences(JSObject* js_obj, int entry);
   bool ExtractAccessorPairProperty(JSObject* js_obj, int entry,
diff --git a/src/heap.cc b/src/heap.cc
index 90f8837..ebf1487 100644
--- a/src/heap.cc
+++ b/src/heap.cc
@@ -74,7 +74,7 @@
 #define LUMP_OF_MEMORY MB
       code_range_size_(0),
 #endif
-#if defined(ANDROID)
+#if defined(ANDROID) || V8_TARGET_ARCH_MIPS
       reserved_semispace_size_(4 * Max(LUMP_OF_MEMORY, Page::kPageSize)),
       max_semispace_size_(4 * Max(LUMP_OF_MEMORY, Page::kPageSize)),
       initial_semispace_size_(Page::kPageSize),
@@ -613,8 +613,10 @@
                                      kReduceMemoryFootprintMask);
   isolate_->compilation_cache()->Clear();
   const int kMaxNumberOfAttempts = 7;
+  const int kMinNumberOfAttempts = 2;
   for (int attempt = 0; attempt < kMaxNumberOfAttempts; attempt++) {
-    if (!CollectGarbage(OLD_POINTER_SPACE, MARK_COMPACTOR, gc_reason, NULL)) {
+    if (!CollectGarbage(OLD_POINTER_SPACE, MARK_COMPACTOR, gc_reason, NULL) &&
+        attempt + 1 >= kMinNumberOfAttempts) {
       break;
     }
   }
@@ -2880,6 +2882,16 @@
 }
 
 
+MaybeObject* Heap::AllocateAllocationSite() {
+  Object* result;
+  MaybeObject* maybe_result = Allocate(allocation_site_map(),
+                                       OLD_POINTER_SPACE);
+  if (!maybe_result->ToObject(&result)) return maybe_result;
+  AllocationSite::cast(result)->Initialize();
+  return result;
+}
+
+
 MaybeObject* Heap::CreateOddball(const char* to_string,
                                  Object* to_number,
                                  byte kind) {
@@ -4186,7 +4198,7 @@
 
 
 MaybeObject* Heap::AllocateWithAllocationSite(Map* map, AllocationSpace space,
-    Handle<Object> allocation_site_info_payload) {
+    Handle<AllocationSite> allocation_site) {
   ASSERT(gc_state_ == NOT_IN_GC);
   ASSERT(map->instance_type() != MAP_TYPE);
   // If allocation failures are disallowed, we may allocate in a different
@@ -4202,7 +4214,7 @@
   AllocationSiteInfo* alloc_info = reinterpret_cast<AllocationSiteInfo*>(
       reinterpret_cast<Address>(result) + map->instance_size());
   alloc_info->set_map_no_write_barrier(allocation_site_info_map());
-  alloc_info->set_payload(*allocation_site_info_payload, SKIP_WRITE_BARRIER);
+  alloc_info->set_allocation_site(*allocation_site, SKIP_WRITE_BARRIER);
   return result;
 }
 
@@ -4461,7 +4473,7 @@
 
 
 MaybeObject* Heap::AllocateJSObjectFromMapWithAllocationSite(Map* map,
-    Handle<Object> allocation_site_info_payload) {
+    Handle<AllocationSite> allocation_site) {
   // JSFunctions should be allocated using AllocateFunction to be
   // properly initialized.
   ASSERT(map->instance_type() != JS_FUNCTION_TYPE);
@@ -4486,8 +4498,8 @@
   AllocationSpace space = NEW_SPACE;
   if (map->instance_size() > Page::kMaxNonCodeHeapObjectSize) space = LO_SPACE;
   Object* obj;
-  MaybeObject* maybe_obj = AllocateWithAllocationSite(map, space,
-      allocation_site_info_payload);
+  MaybeObject* maybe_obj =
+      AllocateWithAllocationSite(map, space, allocation_site);
   if (!maybe_obj->To(&obj)) return maybe_obj;
 
   // Initialize the JSObject.
@@ -4523,7 +4535,7 @@
 
 
 MaybeObject* Heap::AllocateJSObjectWithAllocationSite(JSFunction* constructor,
-    Handle<Object> allocation_site_info_payload) {
+    Handle<AllocationSite> allocation_site) {
   // Allocate the initial map if absent.
   if (!constructor->has_initial_map()) {
     Object* initial_map;
@@ -4537,8 +4549,7 @@
   // advice
   Map* initial_map = constructor->initial_map();
 
-  Cell* cell = Cell::cast(*allocation_site_info_payload);
-  Smi* smi = Smi::cast(cell->value());
+  Smi* smi = Smi::cast(allocation_site->transition_info());
   ElementsKind to_kind = static_cast<ElementsKind>(smi->value());
   AllocationSiteMode mode = TRACK_ALLOCATION_SITE;
   if (to_kind != initial_map->elements_kind()) {
@@ -4546,13 +4557,13 @@
     if (!maybe_new_map->To(&initial_map)) return maybe_new_map;
     // Possibly alter the mode, since we found an updated elements kind
     // in the type info cell.
-    mode = AllocationSiteInfo::GetMode(to_kind);
+    mode = AllocationSite::GetMode(to_kind);
   }
 
   MaybeObject* result;
   if (mode == TRACK_ALLOCATION_SITE) {
     result = AllocateJSObjectFromMapWithAllocationSite(initial_map,
-        allocation_site_info_payload);
+        allocation_site);
   } else {
     result = AllocateJSObjectFromMap(initial_map, NOT_TENURED);
   }
@@ -4647,10 +4658,10 @@
     ElementsKind elements_kind,
     int length,
     int capacity,
-    Handle<Object> allocation_site_payload,
+    Handle<AllocationSite> allocation_site,
     ArrayStorageAllocationMode mode) {
   MaybeObject* maybe_array = AllocateJSArrayWithAllocationSite(elements_kind,
-      allocation_site_payload);
+      allocation_site);
   JSArray* array;
   if (!maybe_array->To(&array)) return maybe_array;
   return AllocateJSArrayStorage(array, length, capacity, mode);
@@ -4899,7 +4910,9 @@
 }
 
 
-MaybeObject* Heap::CopyJSObjectWithAllocationSite(JSObject* source) {
+MaybeObject* Heap::CopyJSObjectWithAllocationSite(
+    JSObject* source,
+    AllocationSite* site) {
   // Never used to copy functions.  If functions need to be copied we
   // have to be careful to clear the literals array.
   SLOW_ASSERT(!source->IsJSFunction());
@@ -4949,7 +4962,7 @@
       AllocationSiteInfo* alloc_info;
       if (maybe_alloc_info->To(&alloc_info)) {
         alloc_info->set_map_no_write_barrier(allocation_site_info_map());
-        alloc_info->set_payload(source, SKIP_WRITE_BARRIER);
+        alloc_info->set_allocation_site(site, SKIP_WRITE_BARRIER);
       }
     }
   } else {
@@ -4971,7 +4984,7 @@
     AllocationSiteInfo* alloc_info = reinterpret_cast<AllocationSiteInfo*>(
         reinterpret_cast<Address>(clone) + object_size);
     alloc_info->set_map_no_write_barrier(allocation_site_info_map());
-    alloc_info->set_payload(source, SKIP_WRITE_BARRIER);
+    alloc_info->set_allocation_site(site, SKIP_WRITE_BARRIER);
   }
 
   SLOW_ASSERT(
@@ -5388,7 +5401,7 @@
 
 MaybeObject* Heap::AllocateJSArrayWithAllocationSite(
     ElementsKind elements_kind,
-    Handle<Object> allocation_site_info_payload) {
+    Handle<AllocationSite> allocation_site) {
   Context* native_context = isolate()->context()->native_context();
   JSFunction* array_function = native_context->array_function();
   Map* map = array_function->initial_map();
@@ -5400,8 +5413,7 @@
       map = Map::cast(maybe_transitioned_map);
     }
   }
-  return AllocateJSObjectFromMapWithAllocationSite(map,
-      allocation_site_info_payload);
+  return AllocateJSObjectFromMapWithAllocationSite(map, allocation_site);
 }
 
 
diff --git a/src/heap.h b/src/heap.h
index d6f41a8..4bc2d30 100644
--- a/src/heap.h
+++ b/src/heap.h
@@ -232,6 +232,7 @@
   V(last_index_string, "lastIndex")                                      \
   V(object_string, "object")                                             \
   V(payload_string, "payload")                                           \
+  V(literals_string, "literals")                                         \
   V(prototype_string, "prototype")                                       \
   V(string_string, "string")                                             \
   V(String_string, "String")                                             \
@@ -658,7 +659,7 @@
 
   MUST_USE_RESULT MaybeObject* AllocateJSObjectWithAllocationSite(
       JSFunction* constructor,
-      Handle<Object> allocation_site_info_payload);
+      Handle<AllocationSite> allocation_site);
 
   MUST_USE_RESULT MaybeObject* AllocateJSGeneratorObject(
       JSFunction* function);
@@ -677,7 +678,7 @@
 
   inline MUST_USE_RESULT MaybeObject* AllocateEmptyJSArrayWithAllocationSite(
       ElementsKind elements_kind,
-      Handle<Object> allocation_site_payload);
+      Handle<AllocationSite> allocation_site);
 
   // Allocate a JSArray with a specified length but elements that are left
   // uninitialized.
@@ -692,7 +693,7 @@
       ElementsKind elements_kind,
       int length,
       int capacity,
-      Handle<Object> allocation_site_payload,
+      Handle<AllocationSite> allocation_site,
       ArrayStorageAllocationMode mode = DONT_INITIALIZE_ARRAY_ELEMENTS);
 
   MUST_USE_RESULT MaybeObject* AllocateJSArrayStorage(
@@ -719,7 +720,8 @@
   // Returns failure if allocation failed.
   MUST_USE_RESULT MaybeObject* CopyJSObject(JSObject* source);
 
-  MUST_USE_RESULT MaybeObject* CopyJSObjectWithAllocationSite(JSObject* source);
+  MUST_USE_RESULT MaybeObject* CopyJSObjectWithAllocationSite(
+      JSObject* source, AllocationSite* site);
 
   // Allocates the function prototype.
   // Returns Failure::RetryAfterGC(requested_bytes, space) if the allocation
@@ -769,7 +771,7 @@
       Map* map, PretenureFlag pretenure = NOT_TENURED);
 
   MUST_USE_RESULT MaybeObject* AllocateJSObjectFromMapWithAllocationSite(
-      Map* map, Handle<Object> allocation_site_info_payload);
+      Map* map, Handle<AllocationSite> allocation_site);
 
   // Allocates a heap object based on the map.
   // Returns Failure::RetryAfterGC(requested_bytes, space) if the allocation
@@ -778,7 +780,7 @@
   MUST_USE_RESULT MaybeObject* Allocate(Map* map, AllocationSpace space);
 
   MUST_USE_RESULT MaybeObject* AllocateWithAllocationSite(Map* map,
-      AllocationSpace space, Handle<Object> allocation_site_info_payload);
+      AllocationSpace space, Handle<AllocationSite> allocation_site);
 
   // Allocates a JS Map in the heap.
   // Returns Failure::RetryAfterGC(requested_bytes, space) if the allocation
@@ -956,6 +958,9 @@
   MUST_USE_RESULT MaybeObject* AllocateBox(Object* value,
                                            PretenureFlag pretenure);
 
+  // Allocate a tenured AllocationSite. It's payload is null
+  MUST_USE_RESULT MaybeObject* AllocateAllocationSite();
+
   // Allocates a fixed array initialized with undefined values
   // Returns Failure::RetryAfterGC(requested_bytes, space) if the allocation
   // failed.
@@ -2159,7 +2164,7 @@
 
   MUST_USE_RESULT MaybeObject* AllocateJSArrayWithAllocationSite(
       ElementsKind elements_kind,
-      Handle<Object> allocation_site_info_payload);
+      Handle<AllocationSite> allocation_site);
 
   // Allocate empty fixed array.
   MUST_USE_RESULT MaybeObject* AllocateEmptyFixedArray();
diff --git a/src/hydrogen-bce.cc b/src/hydrogen-bce.cc
new file mode 100644
index 0000000..e50cd7a
--- /dev/null
+++ b/src/hydrogen-bce.cc
@@ -0,0 +1,390 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "hydrogen-bce.h"
+
+namespace v8 {
+namespace internal {
+
+// We try to "factor up" HBoundsCheck instructions towards the root of the
+// dominator tree.
+// For now we handle checks where the index is like "exp + int32value".
+// If in the dominator tree we check "exp + v1" and later (dominated)
+// "exp + v2", if v2 <= v1 we can safely remove the second check, and if
+// v2 > v1 we can use v2 in the 1st check and again remove the second.
+// To do so we keep a dictionary of all checks where the key if the pair
+// "exp, length".
+// The class BoundsCheckKey represents this key.
+class BoundsCheckKey : public ZoneObject {
+ public:
+  HValue* IndexBase() const { return index_base_; }
+  HValue* Length() const { return length_; }
+
+  uint32_t Hash() {
+    return static_cast<uint32_t>(index_base_->Hashcode() ^ length_->Hashcode());
+  }
+
+  static BoundsCheckKey* Create(Zone* zone,
+                                HBoundsCheck* check,
+                                int32_t* offset) {
+    if (!check->index()->representation().IsSmiOrInteger32()) return NULL;
+
+    HValue* index_base = NULL;
+    HConstant* constant = NULL;
+    bool is_sub = false;
+
+    if (check->index()->IsAdd()) {
+      HAdd* index = HAdd::cast(check->index());
+      if (index->left()->IsConstant()) {
+        constant = HConstant::cast(index->left());
+        index_base = index->right();
+      } else if (index->right()->IsConstant()) {
+        constant = HConstant::cast(index->right());
+        index_base = index->left();
+      }
+    } else if (check->index()->IsSub()) {
+      HSub* index = HSub::cast(check->index());
+      is_sub = true;
+      if (index->left()->IsConstant()) {
+        constant = HConstant::cast(index->left());
+        index_base = index->right();
+      } else if (index->right()->IsConstant()) {
+        constant = HConstant::cast(index->right());
+        index_base = index->left();
+      }
+    }
+
+    if (constant != NULL && constant->HasInteger32Value()) {
+      *offset = is_sub ? - constant->Integer32Value()
+                       : constant->Integer32Value();
+    } else {
+      *offset = 0;
+      index_base = check->index();
+    }
+
+    return new(zone) BoundsCheckKey(index_base, check->length());
+  }
+
+ private:
+  BoundsCheckKey(HValue* index_base, HValue* length)
+    : index_base_(index_base),
+      length_(length) { }
+
+  HValue* index_base_;
+  HValue* length_;
+
+  DISALLOW_COPY_AND_ASSIGN(BoundsCheckKey);
+};
+
+
+// Data about each HBoundsCheck that can be eliminated or moved.
+// It is the "value" in the dictionary indexed by "base-index, length"
+// (the key is BoundsCheckKey).
+// We scan the code with a dominator tree traversal.
+// Traversing the dominator tree we keep a stack (implemented as a singly
+// linked list) of "data" for each basic block that contains a relevant check
+// with the same key (the dictionary holds the head of the list).
+// We also keep all the "data" created for a given basic block in a list, and
+// use it to "clean up" the dictionary when backtracking in the dominator tree
+// traversal.
+// Doing this each dictionary entry always directly points to the check that
+// is dominating the code being examined now.
+// We also track the current "offset" of the index expression and use it to
+// decide if any check is already "covered" (so it can be removed) or not.
+class BoundsCheckBbData: public ZoneObject {
+ public:
+  BoundsCheckKey* Key() const { return key_; }
+  int32_t LowerOffset() const { return lower_offset_; }
+  int32_t UpperOffset() const { return upper_offset_; }
+  HBasicBlock* BasicBlock() const { return basic_block_; }
+  HBoundsCheck* LowerCheck() const { return lower_check_; }
+  HBoundsCheck* UpperCheck() const { return upper_check_; }
+  BoundsCheckBbData* NextInBasicBlock() const { return next_in_bb_; }
+  BoundsCheckBbData* FatherInDominatorTree() const { return father_in_dt_; }
+
+  bool OffsetIsCovered(int32_t offset) const {
+    return offset >= LowerOffset() && offset <= UpperOffset();
+  }
+
+  bool HasSingleCheck() { return lower_check_ == upper_check_; }
+
+  // The goal of this method is to modify either upper_offset_ or
+  // lower_offset_ so that also new_offset is covered (the covered
+  // range grows).
+  //
+  // The precondition is that new_check follows UpperCheck() and
+  // LowerCheck() in the same basic block, and that new_offset is not
+  // covered (otherwise we could simply remove new_check).
+  //
+  // If HasSingleCheck() is true then new_check is added as "second check"
+  // (either upper or lower; note that HasSingleCheck() becomes false).
+  // Otherwise one of the current checks is modified so that it also covers
+  // new_offset, and new_check is removed.
+  //
+  // If the check cannot be modified because the context is unknown it
+  // returns false, otherwise it returns true.
+  bool CoverCheck(HBoundsCheck* new_check,
+                  int32_t new_offset) {
+    ASSERT(new_check->index()->representation().IsSmiOrInteger32());
+    bool keep_new_check = false;
+
+    if (new_offset > upper_offset_) {
+      upper_offset_ = new_offset;
+      if (HasSingleCheck()) {
+        keep_new_check = true;
+        upper_check_ = new_check;
+      } else {
+        bool result = BuildOffsetAdd(upper_check_,
+                                     &added_upper_index_,
+                                     &added_upper_offset_,
+                                     Key()->IndexBase(),
+                                     new_check->index()->representation(),
+                                     new_offset);
+        if (!result) return false;
+        upper_check_->ReplaceAllUsesWith(upper_check_->index());
+        upper_check_->SetOperandAt(0, added_upper_index_);
+      }
+    } else if (new_offset < lower_offset_) {
+      lower_offset_ = new_offset;
+      if (HasSingleCheck()) {
+        keep_new_check = true;
+        lower_check_ = new_check;
+      } else {
+        bool result = BuildOffsetAdd(lower_check_,
+                                     &added_lower_index_,
+                                     &added_lower_offset_,
+                                     Key()->IndexBase(),
+                                     new_check->index()->representation(),
+                                     new_offset);
+        if (!result) return false;
+        lower_check_->ReplaceAllUsesWith(lower_check_->index());
+        lower_check_->SetOperandAt(0, added_lower_index_);
+      }
+    } else {
+      ASSERT(false);
+    }
+
+    if (!keep_new_check) {
+      new_check->DeleteAndReplaceWith(new_check->ActualValue());
+    }
+
+    return true;
+  }
+
+  void RemoveZeroOperations() {
+    RemoveZeroAdd(&added_lower_index_, &added_lower_offset_);
+    RemoveZeroAdd(&added_upper_index_, &added_upper_offset_);
+  }
+
+  BoundsCheckBbData(BoundsCheckKey* key,
+                    int32_t lower_offset,
+                    int32_t upper_offset,
+                    HBasicBlock* bb,
+                    HBoundsCheck* lower_check,
+                    HBoundsCheck* upper_check,
+                    BoundsCheckBbData* next_in_bb,
+                    BoundsCheckBbData* father_in_dt)
+  : key_(key),
+    lower_offset_(lower_offset),
+    upper_offset_(upper_offset),
+    basic_block_(bb),
+    lower_check_(lower_check),
+    upper_check_(upper_check),
+    added_lower_index_(NULL),
+    added_lower_offset_(NULL),
+    added_upper_index_(NULL),
+    added_upper_offset_(NULL),
+    next_in_bb_(next_in_bb),
+    father_in_dt_(father_in_dt) { }
+
+ private:
+  BoundsCheckKey* key_;
+  int32_t lower_offset_;
+  int32_t upper_offset_;
+  HBasicBlock* basic_block_;
+  HBoundsCheck* lower_check_;
+  HBoundsCheck* upper_check_;
+  HInstruction* added_lower_index_;
+  HConstant* added_lower_offset_;
+  HInstruction* added_upper_index_;
+  HConstant* added_upper_offset_;
+  BoundsCheckBbData* next_in_bb_;
+  BoundsCheckBbData* father_in_dt_;
+
+  // Given an existing add instruction and a bounds check it tries to
+  // find the current context (either of the add or of the check index).
+  HValue* IndexContext(HInstruction* add, HBoundsCheck* check) {
+    if (add != NULL && add->IsAdd()) {
+      return HAdd::cast(add)->context();
+    }
+    if (check->index()->IsBinaryOperation()) {
+      return HBinaryOperation::cast(check->index())->context();
+    }
+    return NULL;
+  }
+
+  // This function returns false if it cannot build the add because the
+  // current context cannot be determined.
+  bool BuildOffsetAdd(HBoundsCheck* check,
+                      HInstruction** add,
+                      HConstant** constant,
+                      HValue* original_value,
+                      Representation representation,
+                      int32_t new_offset) {
+    HValue* index_context = IndexContext(*add, check);
+    if (index_context == NULL) return false;
+
+    HConstant* new_constant = new(BasicBlock()->zone()) HConstant(
+        new_offset, representation);
+    if (*add == NULL) {
+      new_constant->InsertBefore(check);
+      (*add) = HAdd::New(
+          BasicBlock()->zone(), index_context, original_value, new_constant);
+      (*add)->AssumeRepresentation(representation);
+      (*add)->InsertBefore(check);
+    } else {
+      new_constant->InsertBefore(*add);
+      (*constant)->DeleteAndReplaceWith(new_constant);
+    }
+    *constant = new_constant;
+    return true;
+  }
+
+  void RemoveZeroAdd(HInstruction** add, HConstant** constant) {
+    if (*add != NULL && (*add)->IsAdd() && (*constant)->Integer32Value() == 0) {
+      (*add)->DeleteAndReplaceWith(HAdd::cast(*add)->left());
+      (*constant)->DeleteAndReplaceWith(NULL);
+    }
+  }
+
+  DISALLOW_COPY_AND_ASSIGN(BoundsCheckBbData);
+};
+
+
+static bool BoundsCheckKeyMatch(void* key1, void* key2) {
+  BoundsCheckKey* k1 = static_cast<BoundsCheckKey*>(key1);
+  BoundsCheckKey* k2 = static_cast<BoundsCheckKey*>(key2);
+  return k1->IndexBase() == k2->IndexBase() && k1->Length() == k2->Length();
+}
+
+
+BoundsCheckTable::BoundsCheckTable(Zone* zone)
+    : ZoneHashMap(BoundsCheckKeyMatch, ZoneHashMap::kDefaultHashMapCapacity,
+                  ZoneAllocationPolicy(zone)) { }
+
+
+BoundsCheckBbData** BoundsCheckTable::LookupOrInsert(BoundsCheckKey* key,
+                                                     Zone* zone) {
+  return reinterpret_cast<BoundsCheckBbData**>(
+      &(Lookup(key, key->Hash(), true, ZoneAllocationPolicy(zone))->value));
+}
+
+
+void BoundsCheckTable::Insert(BoundsCheckKey* key,
+                              BoundsCheckBbData* data,
+                              Zone* zone) {
+  Lookup(key, key->Hash(), true, ZoneAllocationPolicy(zone))->value = data;
+}
+
+
+void BoundsCheckTable::Delete(BoundsCheckKey* key) {
+  Remove(key, key->Hash());
+}
+
+
+// Eliminates checks in bb and recursively in the dominated blocks.
+// Also replace the results of check instructions with the original value, if
+// the result is used. This is safe now, since we don't do code motion after
+// this point. It enables better register allocation since the value produced
+// by check instructions is really a copy of the original value.
+void HBoundsCheckEliminationPhase::EliminateRedundantBoundsChecks(
+    HBasicBlock* bb) {
+  BoundsCheckBbData* bb_data_list = NULL;
+
+  for (HInstructionIterator it(bb); !it.Done(); it.Advance()) {
+    HInstruction* i = it.Current();
+    if (!i->IsBoundsCheck()) continue;
+
+    HBoundsCheck* check = HBoundsCheck::cast(i);
+    int32_t offset;
+    BoundsCheckKey* key =
+        BoundsCheckKey::Create(zone(), check, &offset);
+    if (key == NULL) continue;
+    BoundsCheckBbData** data_p = table_.LookupOrInsert(key, zone());
+    BoundsCheckBbData* data = *data_p;
+    if (data == NULL) {
+      bb_data_list = new(zone()) BoundsCheckBbData(key,
+                                                   offset,
+                                                   offset,
+                                                   bb,
+                                                   check,
+                                                   check,
+                                                   bb_data_list,
+                                                   NULL);
+      *data_p = bb_data_list;
+    } else if (data->OffsetIsCovered(offset)) {
+      check->DeleteAndReplaceWith(check->ActualValue());
+    } else if (data->BasicBlock() != bb ||
+               !data->CoverCheck(check, offset)) {
+      // If the check is in the current BB we try to modify it by calling
+      // "CoverCheck", but if also that fails we record the current offsets
+      // in a new data instance because from now on they are covered.
+      int32_t new_lower_offset = offset < data->LowerOffset()
+          ? offset
+          : data->LowerOffset();
+      int32_t new_upper_offset = offset > data->UpperOffset()
+          ? offset
+          : data->UpperOffset();
+      bb_data_list = new(zone()) BoundsCheckBbData(key,
+                                                   new_lower_offset,
+                                                   new_upper_offset,
+                                                   bb,
+                                                   data->LowerCheck(),
+                                                   data->UpperCheck(),
+                                                   bb_data_list,
+                                                   data);
+      table_.Insert(key, bb_data_list, zone());
+    }
+  }
+
+  for (int i = 0; i < bb->dominated_blocks()->length(); ++i) {
+    EliminateRedundantBoundsChecks(bb->dominated_blocks()->at(i));
+  }
+
+  for (BoundsCheckBbData* data = bb_data_list;
+       data != NULL;
+       data = data->NextInBasicBlock()) {
+    data->RemoveZeroOperations();
+    if (data->FatherInDominatorTree()) {
+      table_.Insert(data->Key(), data->FatherInDominatorTree(), zone());
+    } else {
+      table_.Delete(data->Key());
+    }
+  }
+}
+
+} }  // namespace v8::internal
diff --git a/src/hydrogen-bce.h b/src/hydrogen-bce.h
new file mode 100644
index 0000000..d91997b
--- /dev/null
+++ b/src/hydrogen-bce.h
@@ -0,0 +1,72 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_HYDROGEN_BCE_H_
+#define V8_HYDROGEN_BCE_H_
+
+#include "hydrogen.h"
+
+namespace v8 {
+namespace internal {
+
+
+class BoundsCheckBbData;
+class BoundsCheckKey;
+class BoundsCheckTable : private ZoneHashMap {
+ public:
+  explicit BoundsCheckTable(Zone* zone);
+
+  INLINE(BoundsCheckBbData** LookupOrInsert(BoundsCheckKey* key, Zone* zone));
+  INLINE(void Insert(BoundsCheckKey* key, BoundsCheckBbData* data, Zone* zone));
+  INLINE(void Delete(BoundsCheckKey* key));
+
+ private:
+  DISALLOW_COPY_AND_ASSIGN(BoundsCheckTable);
+};
+
+
+class HBoundsCheckEliminationPhase : public HPhase {
+ public:
+  explicit HBoundsCheckEliminationPhase(HGraph* graph)
+      : HPhase("H_Bounds checks elimination", graph), table_(zone()) { }
+
+  void Run() {
+    EliminateRedundantBoundsChecks(graph()->entry_block());
+  }
+
+ private:
+  void EliminateRedundantBoundsChecks(HBasicBlock* bb);
+
+  BoundsCheckTable table_;
+
+  DISALLOW_COPY_AND_ASSIGN(HBoundsCheckEliminationPhase);
+};
+
+
+} }  // namespace v8::internal
+
+#endif  // V8_HYDROGEN_BCE_H_
diff --git a/src/hydrogen-instructions.cc b/src/hydrogen-instructions.cc
index 041ef8b..0143baa 100644
--- a/src/hydrogen-instructions.cc
+++ b/src/hydrogen-instructions.cc
@@ -1737,9 +1737,10 @@
     result = new(zone) Range(Smi::kMinValue, Smi::kMaxValue);
     result->set_can_be_minus_zero(false);
   } else {
-    // Untagged integer32 cannot be -0, all other representations can.
     result = new(zone) Range();
-    result->set_can_be_minus_zero(!representation().IsInteger32());
+    result->set_can_be_minus_zero(!CheckFlag(kAllUsesTruncatingToInt32));
+    // TODO(jkummerow): The range cannot be minus zero when the upper type
+    // bound is Integer32.
   }
   return result;
 }
@@ -1757,7 +1758,8 @@
   Range* result = (input_range != NULL)
       ? input_range->Copy(zone)
       : HValue::InferRange(zone);
-  if (to().IsInteger32()) result->set_can_be_minus_zero(false);
+  result->set_can_be_minus_zero(!to().IsSmiOrInteger32() ||
+                                !CheckFlag(kAllUsesTruncatingToInt32));
   return result;
 }
 
@@ -1802,9 +1804,8 @@
         CheckFlag(kAllUsesTruncatingToInt32)) {
       ClearFlag(kCanOverflow);
     }
-    if (!CheckFlag(kAllUsesTruncatingToInt32)) {
-      res->set_can_be_minus_zero(a->CanBeMinusZero() && b->CanBeMinusZero());
-    }
+    res->set_can_be_minus_zero(!CheckFlag(kAllUsesTruncatingToInt32) &&
+                               a->CanBeMinusZero() && b->CanBeMinusZero());
     return res;
   } else {
     return HValue::InferRange(zone);
@@ -1821,9 +1822,8 @@
         CheckFlag(kAllUsesTruncatingToInt32)) {
       ClearFlag(kCanOverflow);
     }
-    if (!CheckFlag(kAllUsesTruncatingToInt32)) {
-      res->set_can_be_minus_zero(a->CanBeMinusZero() && b->CanBeZero());
-    }
+    res->set_can_be_minus_zero(!CheckFlag(kAllUsesTruncatingToInt32) &&
+                               a->CanBeMinusZero() && b->CanBeZero());
     return res;
   } else {
     return HValue::InferRange(zone);
@@ -1842,11 +1842,9 @@
       // precise and therefore not the same as converting to Double and back.
       ClearFlag(kCanOverflow);
     }
-    if (!CheckFlag(kAllUsesTruncatingToInt32)) {
-      bool m0 = (a->CanBeZero() && b->CanBeNegative()) ||
-          (a->CanBeNegative() && b->CanBeZero());
-      res->set_can_be_minus_zero(m0);
-    }
+    res->set_can_be_minus_zero(!CheckFlag(kAllUsesTruncatingToInt32) &&
+                               ((a->CanBeZero() && b->CanBeNegative()) ||
+                                (a->CanBeNegative() && b->CanBeZero())));
     return res;
   } else {
     return HValue::InferRange(zone);
@@ -1859,16 +1857,9 @@
     Range* a = left()->range();
     Range* b = right()->range();
     Range* result = new(zone) Range();
-    if (!CheckFlag(kAllUsesTruncatingToInt32)) {
-      if (a->CanBeMinusZero()) {
-        result->set_can_be_minus_zero(true);
-      }
-
-      if (a->CanBeZero() && b->CanBeNegative()) {
-        result->set_can_be_minus_zero(true);
-      }
-    }
-
+    result->set_can_be_minus_zero(!CheckFlag(kAllUsesTruncatingToInt32) &&
+                                  (a->CanBeMinusZero() ||
+                                   (a->CanBeZero() && b->CanBeNegative())));
     if (!a->Includes(kMinInt) || !b->Includes(-1)) {
       ClearFlag(HValue::kCanOverflow);
     }
@@ -1898,9 +1889,8 @@
     Range* result = new(zone) Range(left_can_be_negative ? -positive_bound : 0,
                                     a->CanBePositive() ? positive_bound : 0);
 
-    if (left_can_be_negative && !CheckFlag(kAllUsesTruncatingToInt32)) {
-      result->set_can_be_minus_zero(true);
-    }
+    result->set_can_be_minus_zero(!CheckFlag(kAllUsesTruncatingToInt32) &&
+                                  left_can_be_negative);
 
     if (!a->Includes(kMinInt) || !b->Includes(-1)) {
       ClearFlag(HValue::kCanOverflow);
@@ -2450,7 +2440,9 @@
                     ? static_cast<int32_t>(-limit) : 0;
       return new(zone) Range(min, static_cast<int32_t>(limit - 1));
     }
-    return HValue::InferRange(zone);
+    Range* result = HValue::InferRange(zone);
+    result->set_can_be_minus_zero(false);
+    return result;
   }
   const int32_t kDefaultMask = static_cast<int32_t>(0xffffffff);
   int32_t left_mask = (left()->range() != NULL)
@@ -2462,9 +2454,11 @@
   int32_t result_mask = (op() == Token::BIT_AND)
       ? left_mask & right_mask
       : left_mask | right_mask;
-  return (result_mask >= 0)
-      ? new(zone) Range(0, result_mask)
-      : HValue::InferRange(zone);
+  if (result_mask >= 0) return new(zone) Range(0, result_mask);
+
+  Range* result = HValue::InferRange(zone);
+  result->set_can_be_minus_zero(false);
+  return result;
 }
 
 
@@ -2476,7 +2470,6 @@
           ? left()->range()->Copy(zone)
           : new(zone) Range();
       result->Sar(c->Integer32Value());
-      result->set_can_be_minus_zero(false);
       return result;
     }
   }
@@ -2501,7 +2494,6 @@
             ? left()->range()->Copy(zone)
             : new(zone) Range();
         result->Sar(c->Integer32Value());
-        result->set_can_be_minus_zero(false);
         return result;
       }
     }
@@ -2518,7 +2510,6 @@
           ? left()->range()->Copy(zone)
           : new(zone) Range();
       result->Shl(c->Integer32Value());
-      result->set_can_be_minus_zero(false);
       return result;
     }
   }
@@ -3131,11 +3122,6 @@
 }
 
 
-HType HDeleteProperty::CalculateInferredType() {
-  return HType::Boolean();
-}
-
-
 HType HInstanceOfKnownGlobal::CalculateInferredType() {
   return HType::Boolean();
 }
@@ -3652,13 +3638,6 @@
 #undef H_CONSTANT_DOUBLE
 
 
-void HIn::PrintDataTo(StringStream* stream) {
-  key()->PrintNameTo(stream);
-  stream->Add(" ");
-  object()->PrintNameTo(stream);
-}
-
-
 void HBitwise::PrintDataTo(StringStream* stream) {
   stream->Add(Token::Name(op_));
   stream->Add(" ");
diff --git a/src/hydrogen-instructions.h b/src/hydrogen-instructions.h
index 4227b8e..7bca40c 100644
--- a/src/hydrogen-instructions.h
+++ b/src/hydrogen-instructions.h
@@ -105,7 +105,6 @@
   V(Context)                                   \
   V(DebugBreak)                                \
   V(DeclareGlobals)                            \
-  V(DeleteProperty)                            \
   V(Deoptimize)                                \
   V(Div)                                       \
   V(DummyUse)                                  \
@@ -121,7 +120,6 @@
   V(HasCachedArrayIndexAndBranch)              \
   V(HasInstanceTypeAndBranch)                  \
   V(InductionVariableAnnotation)               \
-  V(In)                                        \
   V(InnerAllocatedObject)                      \
   V(InstanceOf)                                \
   V(InstanceOfKnownGlobal)                     \
@@ -5340,6 +5338,10 @@
     return HObjectAccess(kArrayLengths, JSArray::kLengthOffset);
   }
 
+  static HObjectAccess ForAllocationSiteTransitionInfo() {
+    return HObjectAccess(kInobject, AllocationSite::kTransitionInfoOffset);
+  }
+
   static HObjectAccess ForFixedArrayLength() {
     return HObjectAccess(kArrayLengths, FixedArray::kLengthOffset);
   }
@@ -5356,8 +5358,16 @@
     return HObjectAccess(kMaps, JSObject::kMapOffset);
   }
 
-  static HObjectAccess ForAllocationSitePayload() {
-    return HObjectAccess(kInobject, AllocationSiteInfo::kPayloadOffset);
+  static HObjectAccess ForPropertyCellValue() {
+    return HObjectAccess(kInobject, PropertyCell::kValueOffset);
+  }
+
+  static HObjectAccess ForCellValue() {
+    return HObjectAccess(kInobject, Cell::kValueOffset);
+  }
+
+  static HObjectAccess ForAllocationSiteInfoSite() {
+    return HObjectAccess(kInobject, AllocationSiteInfo::kAllocationSiteOffset);
   }
 
   // Create an access to an offset in a fixed array header.
@@ -5785,7 +5795,8 @@
         field_representation_(field_representation),
         transition_(),
         transition_unique_id_(),
-        new_space_dominator_(NULL) {
+        new_space_dominator_(NULL),
+        write_barrier_mode_(UPDATE_WRITE_BARRIER) {
     SetOperandAt(0, obj);
     SetOperandAt(1, val);
     access.SetGVNFlags(this, true);
@@ -5810,6 +5821,11 @@
   }
   virtual void PrintDataTo(StringStream* stream);
 
+  void SkipWriteBarrier() { write_barrier_mode_ = SKIP_WRITE_BARRIER; }
+  bool IsSkipWriteBarrier() const {
+    return write_barrier_mode_ == SKIP_WRITE_BARRIER;
+  }
+
   HValue* object() { return OperandAt(0); }
   HValue* value() { return OperandAt(1); }
 
@@ -5828,6 +5844,7 @@
   bool NeedsWriteBarrier() {
     ASSERT(!(FLAG_track_double_fields && field_representation_.IsDouble()) ||
            transition_.is_null());
+    if (IsSkipWriteBarrier()) return false;
     return (!FLAG_track_fields || !field_representation_.IsSmi()) &&
         // If there is a transition, a new storage object needs to be allocated.
         !(FLAG_track_double_fields && field_representation_.IsDouble()) &&
@@ -5836,6 +5853,7 @@
   }
 
   bool NeedsWriteBarrierForMap() {
+    if (IsSkipWriteBarrier()) return false;
     return ReceiverObjectNeedsWriteBarrier(object(), new_space_dominator());
   }
 
@@ -5853,6 +5871,7 @@
   Handle<Map> transition_;
   UniqueValueId transition_unique_id_;
   HValue* new_space_dominator_;
+  WriteBarrierMode write_barrier_mode_;
 };
 
 
@@ -6504,55 +6523,6 @@
 };
 
 
-class HDeleteProperty: public HBinaryOperation {
- public:
-  HDeleteProperty(HValue* context, HValue* obj, HValue* key)
-      : HBinaryOperation(context, obj, key) {
-    set_representation(Representation::Tagged());
-    SetAllSideEffects();
-  }
-
-  virtual Representation RequiredInputRepresentation(int index) {
-    return Representation::Tagged();
-  }
-
-  virtual HType CalculateInferredType();
-
-  DECLARE_CONCRETE_INSTRUCTION(DeleteProperty)
-
-  HValue* object() { return left(); }
-  HValue* key() { return right(); }
-};
-
-
-class HIn: public HTemplateInstruction<3> {
- public:
-  HIn(HValue* context, HValue* key, HValue* object) {
-    SetOperandAt(0, context);
-    SetOperandAt(1, key);
-    SetOperandAt(2, object);
-    set_representation(Representation::Tagged());
-    SetAllSideEffects();
-  }
-
-  HValue* context() { return OperandAt(0); }
-  HValue* key() { return OperandAt(1); }
-  HValue* object() { return OperandAt(2); }
-
-  virtual Representation RequiredInputRepresentation(int index) {
-    return Representation::Tagged();
-  }
-
-  virtual HType CalculateInferredType() {
-    return HType::Boolean();
-  }
-
-  virtual void PrintDataTo(StringStream* stream);
-
-  DECLARE_CONCRETE_INSTRUCTION(In)
-};
-
-
 class HCheckMapValue: public HTemplateInstruction<2> {
  public:
   HCheckMapValue(HValue* value,
diff --git a/src/hydrogen-minus-zero.cc b/src/hydrogen-minus-zero.cc
new file mode 100644
index 0000000..e962895
--- /dev/null
+++ b/src/hydrogen-minus-zero.cc
@@ -0,0 +1,83 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "hydrogen-minus-zero.h"
+
+namespace v8 {
+namespace internal {
+
+void HComputeMinusZeroChecksPhase::Run() {
+  const ZoneList<HBasicBlock*>* blocks(graph()->blocks());
+  for (int i = 0; i < blocks->length(); ++i) {
+    for (HInstructionIterator it(blocks->at(i)); !it.Done(); it.Advance()) {
+      HInstruction* current = it.Current();
+      if (current->IsChange()) {
+        HChange* change = HChange::cast(current);
+        // Propagate flags for negative zero checks upwards from conversions
+        // int32-to-tagged and int32-to-double.
+        Representation from = change->value()->representation();
+        ASSERT(from.Equals(change->from()));
+        if (from.IsInteger32()) {
+          ASSERT(change->to().IsTagged() ||
+                 change->to().IsDouble() ||
+                 change->to().IsSmi());
+          ASSERT(visited_.IsEmpty());
+          PropagateMinusZeroChecks(change->value());
+          visited_.Clear();
+        }
+      }
+    }
+  }
+}
+
+
+void HComputeMinusZeroChecksPhase::PropagateMinusZeroChecks(HValue* value) {
+  for (HValue* current = value;
+       current != NULL && !visited_.Contains(current->id());
+       current = current->EnsureAndPropagateNotMinusZero(&visited_)) {
+    // For phis, we must propagate the check to all of its inputs.
+    if (current->IsPhi()) {
+      visited_.Add(current->id());
+      HPhi* phi = HPhi::cast(current);
+      for (int i = 0; i < phi->OperandCount(); ++i) {
+        PropagateMinusZeroChecks(phi->OperandAt(i));
+      }
+      break;
+    }
+
+    // For multiplication, division, and Math.min/max(), we must propagate
+    // to the left and the right side.
+    if (current->IsMul() || current->IsDiv() || current->IsMathMinMax()) {
+      HBinaryOperation* operation = HBinaryOperation::cast(current);
+      operation->EnsureAndPropagateNotMinusZero(&visited_);
+      PropagateMinusZeroChecks(operation->left());
+      PropagateMinusZeroChecks(operation->right());
+    }
+  }
+}
+
+} }  // namespace v8::internal
diff --git a/src/hydrogen-minus-zero.h b/src/hydrogen-minus-zero.h
new file mode 100644
index 0000000..d23ec11
--- /dev/null
+++ b/src/hydrogen-minus-zero.h
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_HYDROGEN_MINUS_ZERO_H_
+#define V8_HYDROGEN_MINUS_ZERO_H_
+
+#include "hydrogen.h"
+
+namespace v8 {
+namespace internal {
+
+
+class HComputeMinusZeroChecksPhase : public HPhase {
+ public:
+  explicit HComputeMinusZeroChecksPhase(HGraph* graph)
+      : HPhase("H_Compute minus zero checks", graph),
+        visited_(graph->GetMaximumValueID(), zone()) { }
+
+  void Run();
+
+ private:
+  void PropagateMinusZeroChecks(HValue* value);
+
+  BitVector visited_;
+
+  DISALLOW_COPY_AND_ASSIGN(HComputeMinusZeroChecksPhase);
+};
+
+
+} }  // namespace v8::internal
+
+#endif  // V8_HYDROGEN_MINUS_ZERO_H_
diff --git a/src/hydrogen-representation-changes.cc b/src/hydrogen-representation-changes.cc
new file mode 100644
index 0000000..e8f0140
--- /dev/null
+++ b/src/hydrogen-representation-changes.cc
@@ -0,0 +1,167 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "hydrogen-representation-changes.h"
+
+namespace v8 {
+namespace internal {
+
+void HRepresentationChangesPhase::InsertRepresentationChangeForUse(
+    HValue* value, HValue* use_value, int use_index, Representation to) {
+  // Insert the representation change right before its use. For phi-uses we
+  // insert at the end of the corresponding predecessor.
+  HInstruction* next = NULL;
+  if (use_value->IsPhi()) {
+    next = use_value->block()->predecessors()->at(use_index)->end();
+  } else {
+    next = HInstruction::cast(use_value);
+  }
+  // For constants we try to make the representation change at compile
+  // time. When a representation change is not possible without loss of
+  // information we treat constants like normal instructions and insert the
+  // change instructions for them.
+  HInstruction* new_value = NULL;
+  bool is_truncating = use_value->CheckFlag(HValue::kTruncatingToInt32);
+  bool allow_undefined_as_nan =
+      use_value->CheckFlag(HValue::kAllowUndefinedAsNaN);
+  if (value->IsConstant()) {
+    HConstant* constant = HConstant::cast(value);
+    // Try to create a new copy of the constant with the new representation.
+    new_value = (is_truncating && to.IsInteger32())
+        ? constant->CopyToTruncatedInt32(graph()->zone())
+        : constant->CopyToRepresentation(to, graph()->zone());
+  }
+
+  if (new_value == NULL) {
+    new_value = new(graph()->zone()) HChange(value, to,
+                                             is_truncating,
+                                             allow_undefined_as_nan);
+  }
+
+  new_value->InsertBefore(next);
+  use_value->SetOperandAt(use_index, new_value);
+}
+
+
+void HRepresentationChangesPhase::InsertRepresentationChangesForValue(
+    HValue* value) {
+  Representation r = value->representation();
+  if (r.IsNone()) return;
+  if (value->HasNoUses()) return;
+
+  for (HUseIterator it(value->uses()); !it.Done(); it.Advance()) {
+    HValue* use_value = it.value();
+    int use_index = it.index();
+    Representation req = use_value->RequiredInputRepresentation(use_index);
+    if (req.IsNone() || req.Equals(r)) continue;
+    InsertRepresentationChangeForUse(value, use_value, use_index, req);
+  }
+  if (value->HasNoUses()) {
+    ASSERT(value->IsConstant());
+    value->DeleteAndReplaceWith(NULL);
+  }
+
+  // The only purpose of a HForceRepresentation is to represent the value
+  // after the (possible) HChange instruction.  We make it disappear.
+  if (value->IsForceRepresentation()) {
+    value->DeleteAndReplaceWith(HForceRepresentation::cast(value)->value());
+  }
+}
+
+
+void HRepresentationChangesPhase::Run() {
+  // Compute truncation flag for phis: Initially assume that all
+  // int32-phis allow truncation and iteratively remove the ones that
+  // are used in an operation that does not allow a truncating
+  // conversion.
+  ZoneList<HPhi*> worklist(8, zone());
+
+  const ZoneList<HPhi*>* phi_list(graph()->phi_list());
+  for (int i = 0; i < phi_list->length(); i++) {
+    HPhi* phi = phi_list->at(i);
+    if (phi->representation().IsInteger32()) {
+      phi->SetFlag(HValue::kTruncatingToInt32);
+    }
+  }
+
+  for (int i = 0; i < phi_list->length(); i++) {
+    HPhi* phi = phi_list->at(i);
+    for (HUseIterator it(phi->uses()); !it.Done(); it.Advance()) {
+      // If a Phi is used as a non-truncating int32 or as a double,
+      // clear its "truncating" flag.
+      HValue* use = it.value();
+      Representation input_representation =
+          use->RequiredInputRepresentation(it.index());
+      if (!input_representation.IsInteger32() ||
+          !use->CheckFlag(HValue::kTruncatingToInt32)) {
+        if (FLAG_trace_representation) {
+          PrintF("#%d Phi is not truncating because of #%d %s\n",
+                 phi->id(), it.value()->id(), it.value()->Mnemonic());
+        }
+        phi->ClearFlag(HValue::kTruncatingToInt32);
+        worklist.Add(phi, zone());
+        break;
+      }
+    }
+  }
+
+  while (!worklist.is_empty()) {
+    HPhi* current = worklist.RemoveLast();
+    for (int i = 0; i < current->OperandCount(); ++i) {
+      HValue* input = current->OperandAt(i);
+      if (input->IsPhi() &&
+          input->representation().IsInteger32() &&
+          input->CheckFlag(HValue::kTruncatingToInt32)) {
+        if (FLAG_trace_representation) {
+          PrintF("#%d Phi is not truncating because of #%d %s\n",
+                 input->id(), current->id(), current->Mnemonic());
+        }
+        input->ClearFlag(HValue::kTruncatingToInt32);
+        worklist.Add(HPhi::cast(input), zone());
+      }
+    }
+  }
+
+  const ZoneList<HBasicBlock*>* blocks(graph()->blocks());
+  for (int i = 0; i < blocks->length(); ++i) {
+    // Process phi instructions first.
+    const HBasicBlock* block(blocks->at(i));
+    const ZoneList<HPhi*>* phis = block->phis();
+    for (int j = 0; j < phis->length(); j++) {
+      InsertRepresentationChangesForValue(phis->at(j));
+    }
+
+    // Process normal instructions.
+    for (HInstruction* current = block->first(); current != NULL; ) {
+      HInstruction* next = current->next();
+      InsertRepresentationChangesForValue(current);
+      current = next;
+    }
+  }
+}
+
+} }  // namespace v8::internal
diff --git a/src/hydrogen-representation-changes.h b/src/hydrogen-representation-changes.h
new file mode 100644
index 0000000..77e899b
--- /dev/null
+++ b/src/hydrogen-representation-changes.h
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#ifndef V8_HYDROGEN_REPRESENTATION_CHANGES_H_
+#define V8_HYDROGEN_REPRESENTATION_CHANGES_H_
+
+#include "hydrogen.h"
+
+namespace v8 {
+namespace internal {
+
+
+class HRepresentationChangesPhase : public HPhase {
+ public:
+  explicit HRepresentationChangesPhase(HGraph* graph)
+      : HPhase("H_Representation changes", graph) { }
+
+  void Run();
+
+ private:
+  void InsertRepresentationChangeForUse(HValue* value,
+                                        HValue* use_value,
+                                        int use_index,
+                                        Representation to);
+  void InsertRepresentationChangesForValue(HValue* value);
+};
+
+
+} }  // namespace v8::internal
+
+#endif  // V8_HYDROGEN_REPRESENTATION_CHANGES_H_
diff --git a/src/hydrogen.cc b/src/hydrogen.cc
index 3a785ac..1b11330 100644
--- a/src/hydrogen.cc
+++ b/src/hydrogen.cc
@@ -33,15 +33,18 @@
 #include "codegen.h"
 #include "full-codegen.h"
 #include "hashmap.h"
+#include "hydrogen-bce.h"
 #include "hydrogen-dce.h"
 #include "hydrogen-environment-liveness.h"
 #include "hydrogen-escape-analysis.h"
 #include "hydrogen-infer-representation.h"
 #include "hydrogen-infer-types.h"
 #include "hydrogen-gvn.h"
+#include "hydrogen-minus-zero.h"
 #include "hydrogen-osr.h"
 #include "hydrogen-range-analysis.h"
 #include "hydrogen-redundant-phi.h"
+#include "hydrogen-representation-changes.h"
 #include "hydrogen-sce.h"
 #include "hydrogen-uint32-analysis.h"
 #include "lithium-allocator.h"
@@ -1157,7 +1160,7 @@
       BuildNewElementsCapacity(context, current_capacity);
 
   HValue* new_elements = BuildGrowElementsCapacity(object, elements,
-                                                   kind, length,
+                                                   kind, kind, length,
                                                    new_capacity);
 
   environment()->Push(new_elements);
@@ -1201,7 +1204,7 @@
 
   HValue* capacity = AddLoadFixedArrayLength(elements);
 
-  HValue* new_elements = BuildGrowElementsCapacity(object, elements,
+  HValue* new_elements = BuildGrowElementsCapacity(object, elements, kind,
                                                    kind, length, capacity);
 
   environment()->Push(new_elements);
@@ -1473,17 +1476,18 @@
 HValue* HGraphBuilder::BuildGrowElementsCapacity(HValue* object,
                                                  HValue* elements,
                                                  ElementsKind kind,
+                                                 ElementsKind new_kind,
                                                  HValue* length,
                                                  HValue* new_capacity) {
   HValue* context = environment()->LookupContext();
 
-  BuildNewSpaceArrayCheck(new_capacity, kind);
+  BuildNewSpaceArrayCheck(new_capacity, new_kind);
 
   HValue* new_elements = BuildAllocateElementsAndInitializeElementsHeader(
-      context, kind, new_capacity);
+      context, new_kind, new_capacity);
 
   BuildCopyElements(context, elements, kind,
-                    new_elements, kind,
+                    new_elements, new_kind,
                     length, new_capacity);
 
   AddStore(object, HObjectAccess::ForElementsPointer(), new_elements);
@@ -1595,6 +1599,7 @@
 
 HValue* HGraphBuilder::BuildCloneShallowArray(HContext* context,
                                               HValue* boilerplate,
+                                              HValue* allocation_site,
                                               AllocationSiteMode mode,
                                               ElementsKind kind,
                                               int length) {
@@ -1631,7 +1636,7 @@
 
   // Create an allocation site info if requested.
   if (mode == TRACK_ALLOCATION_SITE) {
-    BuildCreateAllocationSiteInfo(object, JSArray::kSize, boilerplate);
+    BuildCreateAllocationSiteInfo(object, JSArray::kSize, allocation_site);
   }
 
   if (length > 0) {
@@ -1738,14 +1743,16 @@
 
 HValue* HGraphBuilder::BuildCreateAllocationSiteInfo(HValue* previous_object,
                                                      int previous_object_size,
-                                                     HValue* payload) {
-  HInnerAllocatedObject* alloc_site = Add<HInnerAllocatedObject>(
+                                                     HValue* alloc_site) {
+  ASSERT(alloc_site != NULL);
+  HInnerAllocatedObject* alloc_site_info = Add<HInnerAllocatedObject>(
       previous_object, previous_object_size);
-  Handle<Map> alloc_site_map(isolate()->heap()->allocation_site_info_map());
-  AddStoreMapConstant(alloc_site, alloc_site_map);
-  HObjectAccess access = HObjectAccess::ForAllocationSitePayload();
-  AddStore(alloc_site, access, payload);
-  return alloc_site;
+  Handle<Map> alloc_site_info_map(
+      isolate()->heap()->allocation_site_info_map());
+  AddStoreMapConstant(alloc_site_info, alloc_site_info_map);
+  HObjectAccess access = HObjectAccess::ForAllocationSiteInfoSite();
+  AddStore(alloc_site_info, access, alloc_site);
+  return alloc_site_info;
 }
 
 
@@ -1778,7 +1785,7 @@
         constructor_function_(constructor_function) {
   mode_ = override_mode == DISABLE_ALLOCATION_SITES
       ? DONT_TRACK_ALLOCATION_SITE
-      : AllocationSiteInfo::GetMode(kind);
+      : AllocationSite::GetMode(kind);
 }
 
 
@@ -1952,7 +1959,7 @@
 
 
 HValue* HGraphBuilder::AddLoadJSBuiltin(Builtins::JavaScript builtin,
-                                        HContext* context) {
+                                        HValue* context) {
   HGlobalObject* global_object = Add<HGlobalObject>(context);
   HObjectAccess access = HObjectAccess::ForJSObjectOffset(
       GlobalObject::kBuiltinsOffset);
@@ -2628,180 +2635,6 @@
 }
 
 
-void HGraph::PropagateMinusZeroChecks(HValue* value, BitVector* visited) {
-  HValue* current = value;
-  while (current != NULL) {
-    if (visited->Contains(current->id())) return;
-
-    // For phis, we must propagate the check to all of its inputs.
-    if (current->IsPhi()) {
-      visited->Add(current->id());
-      HPhi* phi = HPhi::cast(current);
-      for (int i = 0; i < phi->OperandCount(); ++i) {
-        PropagateMinusZeroChecks(phi->OperandAt(i), visited);
-      }
-      break;
-    }
-
-    // For multiplication, division, and Math.min/max(), we must propagate
-    // to the left and the right side.
-    if (current->IsMul()) {
-      HMul* mul = HMul::cast(current);
-      mul->EnsureAndPropagateNotMinusZero(visited);
-      PropagateMinusZeroChecks(mul->left(), visited);
-      PropagateMinusZeroChecks(mul->right(), visited);
-    } else if (current->IsDiv()) {
-      HDiv* div = HDiv::cast(current);
-      div->EnsureAndPropagateNotMinusZero(visited);
-      PropagateMinusZeroChecks(div->left(), visited);
-      PropagateMinusZeroChecks(div->right(), visited);
-    } else if (current->IsMathMinMax()) {
-      HMathMinMax* minmax = HMathMinMax::cast(current);
-      visited->Add(minmax->id());
-      PropagateMinusZeroChecks(minmax->left(), visited);
-      PropagateMinusZeroChecks(minmax->right(), visited);
-    }
-
-    current = current->EnsureAndPropagateNotMinusZero(visited);
-  }
-}
-
-
-void HGraph::InsertRepresentationChangeForUse(HValue* value,
-                                              HValue* use_value,
-                                              int use_index,
-                                              Representation to) {
-  // Insert the representation change right before its use. For phi-uses we
-  // insert at the end of the corresponding predecessor.
-  HInstruction* next = NULL;
-  if (use_value->IsPhi()) {
-    next = use_value->block()->predecessors()->at(use_index)->end();
-  } else {
-    next = HInstruction::cast(use_value);
-  }
-  // For constants we try to make the representation change at compile
-  // time. When a representation change is not possible without loss of
-  // information we treat constants like normal instructions and insert the
-  // change instructions for them.
-  HInstruction* new_value = NULL;
-  bool is_truncating = use_value->CheckFlag(HValue::kTruncatingToInt32);
-  bool allow_undefined_as_nan =
-      use_value->CheckFlag(HValue::kAllowUndefinedAsNaN);
-  if (value->IsConstant()) {
-    HConstant* constant = HConstant::cast(value);
-    // Try to create a new copy of the constant with the new representation.
-    new_value = (is_truncating && to.IsInteger32())
-        ? constant->CopyToTruncatedInt32(zone())
-        : constant->CopyToRepresentation(to, zone());
-  }
-
-  if (new_value == NULL) {
-    new_value = new(zone()) HChange(value, to,
-                                    is_truncating, allow_undefined_as_nan);
-  }
-
-  new_value->InsertBefore(next);
-  use_value->SetOperandAt(use_index, new_value);
-}
-
-
-void HGraph::InsertRepresentationChangesForValue(HValue* value) {
-  Representation r = value->representation();
-  if (r.IsNone()) return;
-  if (value->HasNoUses()) return;
-
-  for (HUseIterator it(value->uses()); !it.Done(); it.Advance()) {
-    HValue* use_value = it.value();
-    int use_index = it.index();
-    Representation req = use_value->RequiredInputRepresentation(use_index);
-    if (req.IsNone() || req.Equals(r)) continue;
-    InsertRepresentationChangeForUse(value, use_value, use_index, req);
-  }
-  if (value->HasNoUses()) {
-    ASSERT(value->IsConstant());
-    value->DeleteAndReplaceWith(NULL);
-  }
-
-  // The only purpose of a HForceRepresentation is to represent the value
-  // after the (possible) HChange instruction.  We make it disappear.
-  if (value->IsForceRepresentation()) {
-    value->DeleteAndReplaceWith(HForceRepresentation::cast(value)->value());
-  }
-}
-
-
-void HGraph::InsertRepresentationChanges() {
-  HPhase phase("H_Representation changes", this);
-
-  // Compute truncation flag for phis: Initially assume that all
-  // int32-phis allow truncation and iteratively remove the ones that
-  // are used in an operation that does not allow a truncating
-  // conversion.
-  ZoneList<HPhi*> worklist(8, zone());
-
-  for (int i = 0; i < phi_list()->length(); i++) {
-    HPhi* phi = phi_list()->at(i);
-    if (phi->representation().IsInteger32()) {
-      phi->SetFlag(HValue::kTruncatingToInt32);
-    }
-  }
-
-  for (int i = 0; i < phi_list()->length(); i++) {
-    HPhi* phi = phi_list()->at(i);
-    for (HUseIterator it(phi->uses()); !it.Done(); it.Advance()) {
-      // If a Phi is used as a non-truncating int32 or as a double,
-      // clear its "truncating" flag.
-      HValue* use = it.value();
-      Representation input_representation =
-          use->RequiredInputRepresentation(it.index());
-      if (!input_representation.IsInteger32() ||
-          !use->CheckFlag(HValue::kTruncatingToInt32)) {
-        if (FLAG_trace_representation) {
-          PrintF("#%d Phi is not truncating because of #%d %s\n",
-                 phi->id(), it.value()->id(), it.value()->Mnemonic());
-        }
-        phi->ClearFlag(HValue::kTruncatingToInt32);
-        worklist.Add(phi, zone());
-        break;
-      }
-    }
-  }
-
-  while (!worklist.is_empty()) {
-    HPhi* current = worklist.RemoveLast();
-    for (int i = 0; i < current->OperandCount(); ++i) {
-      HValue* input = current->OperandAt(i);
-      if (input->IsPhi() &&
-          input->representation().IsInteger32() &&
-          input->CheckFlag(HValue::kTruncatingToInt32)) {
-        if (FLAG_trace_representation) {
-          PrintF("#%d Phi is not truncating because of #%d %s\n",
-                 input->id(), current->id(), current->Mnemonic());
-        }
-        input->ClearFlag(HValue::kTruncatingToInt32);
-        worklist.Add(HPhi::cast(input), zone());
-      }
-    }
-  }
-
-  for (int i = 0; i < blocks_.length(); ++i) {
-    // Process phi instructions first.
-    const ZoneList<HPhi*>* phis = blocks_[i]->phis();
-    for (int j = 0; j < phis->length(); j++) {
-      InsertRepresentationChangesForValue(phis->at(j));
-    }
-
-    // Process normal instructions.
-    HInstruction* current = blocks_[i]->first();
-    while (current != NULL) {
-      HInstruction* next = current->next();
-      InsertRepresentationChangesForValue(current);
-      current = next;
-    }
-  }
-}
-
-
 void HGraph::RecursivelyMarkPhiDeoptimizeOnUndefined(HPhi* phi) {
   if (!phi->CheckFlag(HValue::kAllowUndefinedAsNaN)) return;
   phi->ClearFlag(HValue::kAllowUndefinedAsNaN);
@@ -2834,32 +2667,6 @@
 }
 
 
-void HGraph::ComputeMinusZeroChecks() {
-  HPhase phase("H_Compute minus zero checks", this);
-  BitVector visited(GetMaximumValueID(), zone());
-  for (int i = 0; i < blocks_.length(); ++i) {
-    for (HInstructionIterator it(blocks_[i]); !it.Done(); it.Advance()) {
-      HInstruction* current = it.Current();
-      if (current->IsChange()) {
-        HChange* change = HChange::cast(current);
-        // Propagate flags for negative zero checks upwards from conversions
-        // int32-to-tagged and int32-to-double.
-        Representation from = change->value()->representation();
-        ASSERT(from.Equals(change->from()));
-        if (from.IsInteger32()) {
-          ASSERT(change->to().IsTagged() ||
-                 change->to().IsDouble() ||
-                 change->to().IsSmi());
-          ASSERT(visited.IsEmpty());
-          PropagateMinusZeroChecks(change->value(), &visited);
-          visited.Clear();
-        }
-      }
-    }
-  }
-}
-
-
 // Implementation of utility class to encapsulate the translation state for
 // a (possibly inlined) function.
 FunctionState::FunctionState(HOptimizedGraphBuilder* owner,
@@ -3333,7 +3140,7 @@
   MergeRemovableSimulates();
 
   MarkDeoptimizeOnUndefined();
-  InsertRepresentationChanges();
+  Run<HRepresentationChangesPhase>();
 
   Run<HInferTypesPhase>();
 
@@ -3350,14 +3157,14 @@
 
   if (FLAG_use_range) Run<HRangeAnalysisPhase>();
 
-  ComputeMinusZeroChecks();
+  Run<HComputeMinusZeroChecksPhase>();
 
   // Eliminate redundant stack checks on backwards branches.
   Run<HStackCheckEliminationPhase>();
 
   if (FLAG_idefs) SetupInformativeDefinitions();
   if (FLAG_array_bounds_checks_elimination && !FLAG_idefs) {
-    EliminateRedundantBoundsChecks();
+    Run<HBoundsCheckEliminationPhase>();
   }
   if (FLAG_array_index_dehoisting) DehoistSimpleArrayIndexComputations();
   if (FLAG_dead_code_elimination) Run<HDeadCodeEliminationPhase>();
@@ -3412,364 +3219,6 @@
 }
 
 
-// We try to "factor up" HBoundsCheck instructions towards the root of the
-// dominator tree.
-// For now we handle checks where the index is like "exp + int32value".
-// If in the dominator tree we check "exp + v1" and later (dominated)
-// "exp + v2", if v2 <= v1 we can safely remove the second check, and if
-// v2 > v1 we can use v2 in the 1st check and again remove the second.
-// To do so we keep a dictionary of all checks where the key if the pair
-// "exp, length".
-// The class BoundsCheckKey represents this key.
-class BoundsCheckKey : public ZoneObject {
- public:
-  HValue* IndexBase() const { return index_base_; }
-  HValue* Length() const { return length_; }
-
-  uint32_t Hash() {
-    return static_cast<uint32_t>(index_base_->Hashcode() ^ length_->Hashcode());
-  }
-
-  static BoundsCheckKey* Create(Zone* zone,
-                                HBoundsCheck* check,
-                                int32_t* offset) {
-    if (!check->index()->representation().IsSmiOrInteger32()) return NULL;
-
-    HValue* index_base = NULL;
-    HConstant* constant = NULL;
-    bool is_sub = false;
-
-    if (check->index()->IsAdd()) {
-      HAdd* index = HAdd::cast(check->index());
-      if (index->left()->IsConstant()) {
-        constant = HConstant::cast(index->left());
-        index_base = index->right();
-      } else if (index->right()->IsConstant()) {
-        constant = HConstant::cast(index->right());
-        index_base = index->left();
-      }
-    } else if (check->index()->IsSub()) {
-      HSub* index = HSub::cast(check->index());
-      is_sub = true;
-      if (index->left()->IsConstant()) {
-        constant = HConstant::cast(index->left());
-        index_base = index->right();
-      } else if (index->right()->IsConstant()) {
-        constant = HConstant::cast(index->right());
-        index_base = index->left();
-      }
-    }
-
-    if (constant != NULL && constant->HasInteger32Value()) {
-      *offset = is_sub ? - constant->Integer32Value()
-                       : constant->Integer32Value();
-    } else {
-      *offset = 0;
-      index_base = check->index();
-    }
-
-    return new(zone) BoundsCheckKey(index_base, check->length());
-  }
-
- private:
-  BoundsCheckKey(HValue* index_base, HValue* length)
-    : index_base_(index_base),
-      length_(length) { }
-
-  HValue* index_base_;
-  HValue* length_;
-};
-
-
-// Data about each HBoundsCheck that can be eliminated or moved.
-// It is the "value" in the dictionary indexed by "base-index, length"
-// (the key is BoundsCheckKey).
-// We scan the code with a dominator tree traversal.
-// Traversing the dominator tree we keep a stack (implemented as a singly
-// linked list) of "data" for each basic block that contains a relevant check
-// with the same key (the dictionary holds the head of the list).
-// We also keep all the "data" created for a given basic block in a list, and
-// use it to "clean up" the dictionary when backtracking in the dominator tree
-// traversal.
-// Doing this each dictionary entry always directly points to the check that
-// is dominating the code being examined now.
-// We also track the current "offset" of the index expression and use it to
-// decide if any check is already "covered" (so it can be removed) or not.
-class BoundsCheckBbData: public ZoneObject {
- public:
-  BoundsCheckKey* Key() const { return key_; }
-  int32_t LowerOffset() const { return lower_offset_; }
-  int32_t UpperOffset() const { return upper_offset_; }
-  HBasicBlock* BasicBlock() const { return basic_block_; }
-  HBoundsCheck* LowerCheck() const { return lower_check_; }
-  HBoundsCheck* UpperCheck() const { return upper_check_; }
-  BoundsCheckBbData* NextInBasicBlock() const { return next_in_bb_; }
-  BoundsCheckBbData* FatherInDominatorTree() const { return father_in_dt_; }
-
-  bool OffsetIsCovered(int32_t offset) const {
-    return offset >= LowerOffset() && offset <= UpperOffset();
-  }
-
-  bool HasSingleCheck() { return lower_check_ == upper_check_; }
-
-  // The goal of this method is to modify either upper_offset_ or
-  // lower_offset_ so that also new_offset is covered (the covered
-  // range grows).
-  //
-  // The precondition is that new_check follows UpperCheck() and
-  // LowerCheck() in the same basic block, and that new_offset is not
-  // covered (otherwise we could simply remove new_check).
-  //
-  // If HasSingleCheck() is true then new_check is added as "second check"
-  // (either upper or lower; note that HasSingleCheck() becomes false).
-  // Otherwise one of the current checks is modified so that it also covers
-  // new_offset, and new_check is removed.
-  //
-  // If the check cannot be modified because the context is unknown it
-  // returns false, otherwise it returns true.
-  bool CoverCheck(HBoundsCheck* new_check,
-                  int32_t new_offset) {
-    ASSERT(new_check->index()->representation().IsSmiOrInteger32());
-    bool keep_new_check = false;
-
-    if (new_offset > upper_offset_) {
-      upper_offset_ = new_offset;
-      if (HasSingleCheck()) {
-        keep_new_check = true;
-        upper_check_ = new_check;
-      } else {
-        bool result = BuildOffsetAdd(upper_check_,
-                                     &added_upper_index_,
-                                     &added_upper_offset_,
-                                     Key()->IndexBase(),
-                                     new_check->index()->representation(),
-                                     new_offset);
-        if (!result) return false;
-        upper_check_->ReplaceAllUsesWith(upper_check_->index());
-        upper_check_->SetOperandAt(0, added_upper_index_);
-      }
-    } else if (new_offset < lower_offset_) {
-      lower_offset_ = new_offset;
-      if (HasSingleCheck()) {
-        keep_new_check = true;
-        lower_check_ = new_check;
-      } else {
-        bool result = BuildOffsetAdd(lower_check_,
-                                     &added_lower_index_,
-                                     &added_lower_offset_,
-                                     Key()->IndexBase(),
-                                     new_check->index()->representation(),
-                                     new_offset);
-        if (!result) return false;
-        lower_check_->ReplaceAllUsesWith(lower_check_->index());
-        lower_check_->SetOperandAt(0, added_lower_index_);
-      }
-    } else {
-      ASSERT(false);
-    }
-
-    if (!keep_new_check) {
-      new_check->DeleteAndReplaceWith(new_check->ActualValue());
-    }
-
-    return true;
-  }
-
-  void RemoveZeroOperations() {
-    RemoveZeroAdd(&added_lower_index_, &added_lower_offset_);
-    RemoveZeroAdd(&added_upper_index_, &added_upper_offset_);
-  }
-
-  BoundsCheckBbData(BoundsCheckKey* key,
-                    int32_t lower_offset,
-                    int32_t upper_offset,
-                    HBasicBlock* bb,
-                    HBoundsCheck* lower_check,
-                    HBoundsCheck* upper_check,
-                    BoundsCheckBbData* next_in_bb,
-                    BoundsCheckBbData* father_in_dt)
-  : key_(key),
-    lower_offset_(lower_offset),
-    upper_offset_(upper_offset),
-    basic_block_(bb),
-    lower_check_(lower_check),
-    upper_check_(upper_check),
-    added_lower_index_(NULL),
-    added_lower_offset_(NULL),
-    added_upper_index_(NULL),
-    added_upper_offset_(NULL),
-    next_in_bb_(next_in_bb),
-    father_in_dt_(father_in_dt) { }
-
- private:
-  BoundsCheckKey* key_;
-  int32_t lower_offset_;
-  int32_t upper_offset_;
-  HBasicBlock* basic_block_;
-  HBoundsCheck* lower_check_;
-  HBoundsCheck* upper_check_;
-  HInstruction* added_lower_index_;
-  HConstant* added_lower_offset_;
-  HInstruction* added_upper_index_;
-  HConstant* added_upper_offset_;
-  BoundsCheckBbData* next_in_bb_;
-  BoundsCheckBbData* father_in_dt_;
-
-  // Given an existing add instruction and a bounds check it tries to
-  // find the current context (either of the add or of the check index).
-  HValue* IndexContext(HInstruction* add, HBoundsCheck* check) {
-    if (add != NULL && add->IsAdd()) {
-      return HAdd::cast(add)->context();
-    }
-    if (check->index()->IsBinaryOperation()) {
-      return HBinaryOperation::cast(check->index())->context();
-    }
-    return NULL;
-  }
-
-  // This function returns false if it cannot build the add because the
-  // current context cannot be determined.
-  bool BuildOffsetAdd(HBoundsCheck* check,
-                      HInstruction** add,
-                      HConstant** constant,
-                      HValue* original_value,
-                      Representation representation,
-                      int32_t new_offset) {
-    HValue* index_context = IndexContext(*add, check);
-    if (index_context == NULL) return false;
-
-    HConstant* new_constant = new(BasicBlock()->zone()) HConstant(
-        new_offset, representation);
-    if (*add == NULL) {
-      new_constant->InsertBefore(check);
-      (*add) = HAdd::New(
-          BasicBlock()->zone(), index_context, original_value, new_constant);
-      (*add)->AssumeRepresentation(representation);
-      (*add)->InsertBefore(check);
-    } else {
-      new_constant->InsertBefore(*add);
-      (*constant)->DeleteAndReplaceWith(new_constant);
-    }
-    *constant = new_constant;
-    return true;
-  }
-
-  void RemoveZeroAdd(HInstruction** add, HConstant** constant) {
-    if (*add != NULL && (*add)->IsAdd() && (*constant)->Integer32Value() == 0) {
-      (*add)->DeleteAndReplaceWith(HAdd::cast(*add)->left());
-      (*constant)->DeleteAndReplaceWith(NULL);
-    }
-  }
-};
-
-
-static bool BoundsCheckKeyMatch(void* key1, void* key2) {
-  BoundsCheckKey* k1 = static_cast<BoundsCheckKey*>(key1);
-  BoundsCheckKey* k2 = static_cast<BoundsCheckKey*>(key2);
-  return k1->IndexBase() == k2->IndexBase() && k1->Length() == k2->Length();
-}
-
-
-class BoundsCheckTable : private ZoneHashMap {
- public:
-  BoundsCheckBbData** LookupOrInsert(BoundsCheckKey* key, Zone* zone) {
-    return reinterpret_cast<BoundsCheckBbData**>(
-        &(Lookup(key, key->Hash(), true, ZoneAllocationPolicy(zone))->value));
-  }
-
-  void Insert(BoundsCheckKey* key, BoundsCheckBbData* data, Zone* zone) {
-    Lookup(key, key->Hash(), true, ZoneAllocationPolicy(zone))->value = data;
-  }
-
-  void Delete(BoundsCheckKey* key) {
-    Remove(key, key->Hash());
-  }
-
-  explicit BoundsCheckTable(Zone* zone)
-      : ZoneHashMap(BoundsCheckKeyMatch, ZoneHashMap::kDefaultHashMapCapacity,
-                    ZoneAllocationPolicy(zone)) { }
-};
-
-
-// Eliminates checks in bb and recursively in the dominated blocks.
-// Also replace the results of check instructions with the original value, if
-// the result is used. This is safe now, since we don't do code motion after
-// this point. It enables better register allocation since the value produced
-// by check instructions is really a copy of the original value.
-void HGraph::EliminateRedundantBoundsChecks(HBasicBlock* bb,
-                                            BoundsCheckTable* table) {
-  BoundsCheckBbData* bb_data_list = NULL;
-
-  for (HInstructionIterator it(bb); !it.Done(); it.Advance()) {
-    HInstruction* i = it.Current();
-    if (!i->IsBoundsCheck()) continue;
-
-    HBoundsCheck* check = HBoundsCheck::cast(i);
-    int32_t offset;
-    BoundsCheckKey* key =
-        BoundsCheckKey::Create(zone(), check, &offset);
-    if (key == NULL) continue;
-    BoundsCheckBbData** data_p = table->LookupOrInsert(key, zone());
-    BoundsCheckBbData* data = *data_p;
-    if (data == NULL) {
-      bb_data_list = new(zone()) BoundsCheckBbData(key,
-                                                   offset,
-                                                   offset,
-                                                   bb,
-                                                   check,
-                                                   check,
-                                                   bb_data_list,
-                                                   NULL);
-      *data_p = bb_data_list;
-    } else if (data->OffsetIsCovered(offset)) {
-      check->DeleteAndReplaceWith(check->ActualValue());
-    } else if (data->BasicBlock() != bb ||
-               !data->CoverCheck(check, offset)) {
-      // If the check is in the current BB we try to modify it by calling
-      // "CoverCheck", but if also that fails we record the current offsets
-      // in a new data instance because from now on they are covered.
-      int32_t new_lower_offset = offset < data->LowerOffset()
-          ? offset
-          : data->LowerOffset();
-      int32_t new_upper_offset = offset > data->UpperOffset()
-          ? offset
-          : data->UpperOffset();
-      bb_data_list = new(zone()) BoundsCheckBbData(key,
-                                                   new_lower_offset,
-                                                   new_upper_offset,
-                                                   bb,
-                                                   data->LowerCheck(),
-                                                   data->UpperCheck(),
-                                                   bb_data_list,
-                                                   data);
-      table->Insert(key, bb_data_list, zone());
-    }
-  }
-
-  for (int i = 0; i < bb->dominated_blocks()->length(); ++i) {
-    EliminateRedundantBoundsChecks(bb->dominated_blocks()->at(i), table);
-  }
-
-  for (BoundsCheckBbData* data = bb_data_list;
-       data != NULL;
-       data = data->NextInBasicBlock()) {
-    data->RemoveZeroOperations();
-    if (data->FatherInDominatorTree()) {
-      table->Insert(data->Key(), data->FatherInDominatorTree(), zone());
-    } else {
-      table->Delete(data->Key());
-    }
-  }
-}
-
-
-void HGraph::EliminateRedundantBoundsChecks() {
-  HPhase phase("H_Eliminate bounds checks", this);
-  BoundsCheckTable checks_table(zone());
-  EliminateRedundantBoundsChecks(entry_block(), &checks_table);
-}
-
-
 static void DehoistArrayIndex(ArrayInstructionInterface* array_operation) {
   HValue* index = array_operation->GetKey()->ActualValue();
   if (!index->representation().IsSmiOrInteger32()) return;
@@ -5015,6 +4464,7 @@
     literal = BuildFastLiteral(context,
                                boilerplate_object,
                                original_boilerplate_object,
+                               Handle<Object>::null(),
                                data_size,
                                pointer_size,
                                DONT_TRACK_ALLOCATION_SITE);
@@ -5122,25 +4572,37 @@
   HValue* context = environment()->LookupContext();
   HInstruction* literal;
 
+  Handle<AllocationSite> site;
   Handle<FixedArray> literals(environment()->closure()->literals(), isolate());
-  Handle<Object> raw_boilerplate(literals->get(expr->literal_index()),
-                                 isolate());
-
   bool uninitialized = false;
-  if (raw_boilerplate->IsUndefined()) {
+  Handle<Object> literals_cell(literals->get(expr->literal_index()),
+                               isolate());
+  Handle<Object> raw_boilerplate;
+  if (literals_cell->IsUndefined()) {
     uninitialized = true;
     raw_boilerplate = Runtime::CreateArrayLiteralBoilerplate(
         isolate(), literals, expr->constant_elements());
     if (raw_boilerplate.is_null()) {
       return Bailout("array boilerplate creation failed");
     }
-    literals->set(expr->literal_index(), *raw_boilerplate);
+
+    site = isolate()->factory()->NewAllocationSite();
+    site->set_transition_info(*raw_boilerplate);
+    literals->set(expr->literal_index(), *site);
+
     if (JSObject::cast(*raw_boilerplate)->elements()->map() ==
         isolate()->heap()->fixed_cow_array_map()) {
       isolate()->counters()->cow_arrays_created_runtime()->Increment();
     }
+  } else {
+    ASSERT(literals_cell->IsAllocationSite());
+    site = Handle<AllocationSite>::cast(literals_cell);
+    raw_boilerplate = Handle<Object>(site->transition_info(), isolate());
   }
 
+  ASSERT(!raw_boilerplate.is_null());
+  ASSERT(site->IsLiteralSite());
+
   Handle<JSObject> original_boilerplate_object =
       Handle<JSObject>::cast(raw_boilerplate);
   ElementsKind boilerplate_elements_kind =
@@ -5149,7 +4611,7 @@
   // TODO(mvstanton): This heuristic is only a temporary solution.  In the
   // end, we want to quit creating allocation site info after a certain number
   // of GCs for a call site.
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(
+  AllocationSiteMode mode = AllocationSite::GetMode(
       boilerplate_elements_kind);
 
   // Check whether to use fast or slow deep-copying for boilerplate.
@@ -5169,6 +4631,7 @@
     literal = BuildFastLiteral(context,
                                boilerplate_object,
                                original_boilerplate_object,
+                               site,
                                data_size,
                                pointer_size,
                                mode);
@@ -5248,6 +4711,7 @@
                                   Handle<String> name,
                                   LookupResult* lookup,
                                   bool is_store) {
+  ASSERT(!is_store || !type->is_observed());
   if (type->has_named_interceptor()) {
     lookup->InterceptorResult(NULL);
     return false;
@@ -5415,6 +4879,17 @@
 }
 
 
+static bool CanLoadPropertyFromPrototype(Handle<Map> map,
+                                         Handle<Name> name,
+                                         LookupResult* lookup) {
+  if (map->has_named_interceptor()) return false;
+  if (map->is_dictionary_map()) return false;
+  map->LookupDescriptor(NULL, *name, lookup);
+  if (lookup->IsFound()) return false;
+  return true;
+}
+
+
 HInstruction* HOptimizedGraphBuilder::TryLoadPolymorphicAsMonomorphic(
     Property* expr,
     HValue* object,
@@ -5452,12 +4927,40 @@
     representation = representation.generalize(new_representation);
   }
 
-  if (count != types->length()) return NULL;
+  if (count == types->length()) {
+    // Everything matched; can use monomorphic load.
+    BuildCheckHeapObject(object);
+    AddInstruction(HCheckMaps::New(object, types, zone()));
+    return BuildLoadNamedField(object, access, representation);
+  }
 
-  // Everything matched; can use monomorphic load.
+  if (count != 0) return NULL;
+
+  // Second chance: the property is on the prototype and all maps have the
+  // same prototype.
+  Handle<Map> map(types->at(0));
+  if (!CanLoadPropertyFromPrototype(map, name, &lookup)) return NULL;
+
+  Handle<Object> prototype(map->prototype(), isolate());
+  for (count = 1; count < types->length(); ++count) {
+    Handle<Map> test_map(types->at(count));
+    if (!CanLoadPropertyFromPrototype(test_map, name, &lookup)) return NULL;
+    if (test_map->prototype() != *prototype) return NULL;
+  }
+
+  LookupInPrototypes(map, name, &lookup);
+  if (!lookup.IsField()) return NULL;
+
   BuildCheckHeapObject(object);
   AddInstruction(HCheckMaps::New(object, types, zone()));
-  return BuildLoadNamedField(object, access, representation);
+  Handle<JSObject> holder(lookup.holder());
+  Handle<Map> holder_map(holder->map());
+  AddInstruction(new(zone()) HCheckPrototypeMaps(
+      Handle<JSObject>::cast(prototype), holder, zone(), top_info()));
+  HValue* holder_value = AddInstruction(new(zone()) HConstant(holder));
+  return BuildLoadNamedField(holder_value,
+      HObjectAccess::ForField(holder_map, &lookup, name),
+      ComputeLoadStoreRepresentation(map, &lookup));
 }
 
 
@@ -5485,7 +4988,8 @@
     int position,
     BailoutId assignment_id,
     HValue* object,
-    HValue* value,
+    HValue* store_value,
+    HValue* result_value,
     SmallMapList* types,
     Handle<String> name) {
   // Use monomorphic store if property lookup results in the same field index
@@ -5502,6 +5006,7 @@
     Handle<Map> map = types->at(count);
     // Pass false to ignore transitions.
     if (!ComputeLoadStoreField(map, name, &lookup, false)) break;
+    ASSERT(!map->is_observed());
 
     HObjectAccess new_access = HObjectAccess::ForField(map, &lookup, name);
     Representation new_representation =
@@ -5531,12 +5036,14 @@
   HInstruction* store;
   CHECK_ALIVE_OR_RETURN(
       store = BuildStoreNamedField(
-          object, name, value, types->at(count - 1), &lookup),
+          object, name, store_value, types->at(count - 1), &lookup),
       true);
-  Push(value);
+  if (result_value != NULL) Push(result_value);
+  Push(store_value);
   store->set_position(position);
   AddInstruction(store);
   AddSimulate(assignment_id);
+  if (result_value != NULL) Drop(1);
   ast_context()->ReturnValue(Pop());
   return true;
 }
@@ -5547,11 +5054,13 @@
     int position,
     BailoutId assignment_id,
     HValue* object,
-    HValue* value,
+    HValue* store_value,
+    HValue* result_value,
     SmallMapList* types,
     Handle<String> name) {
   if (TryStorePolymorphicAsMonomorphic(
-          position, assignment_id, object, value, types, name)) {
+          position, assignment_id, object,
+          store_value, result_value, types, name)) {
     return;
   }
 
@@ -5577,12 +5086,15 @@
 
       set_current_block(if_true);
       HInstruction* instr;
-      CHECK_ALIVE(
-          instr = BuildStoreNamedField(object, name, value, map, &lookup));
+      CHECK_ALIVE(instr = BuildStoreNamedField(
+          object, name, store_value, map, &lookup));
       instr->set_position(position);
       // Goto will add the HSimulate for the store.
       AddInstruction(instr);
-      if (!ast_context()->IsEffect()) Push(value);
+      if (!ast_context()->IsEffect()) {
+        if (result_value != NULL) Push(result_value);
+        Push(store_value);
+      }
       current_block()->Goto(join);
 
       set_current_block(if_false);
@@ -5595,12 +5107,15 @@
   if (count == types->length() && FLAG_deoptimize_uncommon_cases) {
     current_block()->FinishExitWithDeoptimization(HDeoptimize::kNoUses);
   } else {
-    HInstruction* instr = BuildStoreNamedGeneric(object, name, value);
+    HInstruction* instr = BuildStoreNamedGeneric(object, name, store_value);
     instr->set_position(position);
     AddInstruction(instr);
 
     if (join != NULL) {
-      if (!ast_context()->IsEffect()) Push(value);
+      if (!ast_context()->IsEffect()) {
+        if (result_value != NULL) Push(result_value);
+        Push(store_value);
+      }
       current_block()->Goto(join);
     } else {
       // The HSimulate for the store should not see the stored value in
@@ -5610,19 +5125,24 @@
         if (ast_context()->IsEffect()) {
           AddSimulate(id, REMOVABLE_SIMULATE);
         } else {
-          Push(value);
+          if (result_value != NULL) Push(result_value);
+          Push(store_value);
           AddSimulate(id, REMOVABLE_SIMULATE);
-          Drop(1);
+          Drop(result_value != NULL ? 2 : 1);
         }
       }
-      return ast_context()->ReturnValue(value);
+      return ast_context()->ReturnValue(
+          result_value != NULL ? result_value : store_value);
     }
   }
 
   ASSERT(join != NULL);
   join->SetJoinId(id);
   set_current_block(join);
-  if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
+  if (!ast_context()->IsEffect()) {
+    if (result_value != NULL) Drop(1);
+    ast_context()->ReturnValue(Pop());
+  }
 }
 
 
@@ -5711,7 +5231,8 @@
                                              BailoutId assignment_id,
                                              Property* prop,
                                              HValue* object,
-                                             HValue* value) {
+                                             HValue* store_value,
+                                             HValue* result_value) {
   Literal* key = prop->key()->AsLiteral();
   Handle<String> name = Handle<String>::cast(key->value());
   ASSERT(!name.is_null());
@@ -5729,37 +5250,42 @@
     Handle<JSObject> holder;
     if (LookupSetter(map, name, &setter, &holder)) {
       AddCheckConstantFunction(holder, object, map);
-      if (FLAG_inline_accessors &&
-          TryInlineSetter(setter, id, assignment_id, value)) {
+      // Don't try to inline if the result_value is different from the
+      // store_value. That case isn't handled yet by the inlining.
+      if (result_value == NULL &&
+          FLAG_inline_accessors &&
+          TryInlineSetter(setter, id, assignment_id, store_value)) {
         return;
       }
       Drop(2);
       Add<HPushArgument>(object);
-      Add<HPushArgument>(value);
+      Add<HPushArgument>(store_value);
       instr = new(zone()) HCallConstantFunction(setter, 2);
     } else {
       Drop(2);
       CHECK_ALIVE(instr = BuildStoreNamedMonomorphic(object,
                                                      name,
-                                                     value,
+                                                     store_value,
                                                      map));
     }
-
   } else if (types != NULL && types->length() > 1) {
     Drop(2);
     return HandlePolymorphicStoreNamedField(
-        id, position, assignment_id, object, value, types, name);
+        id, position, assignment_id, object,
+        store_value, result_value, types, name);
   } else {
     Drop(2);
-    instr = BuildStoreNamedGeneric(object, name, value);
+    instr = BuildStoreNamedGeneric(object, name, store_value);
   }
 
-  Push(value);
+  if (result_value != NULL) Push(result_value);
+  Push(store_value);
   instr->set_position(position);
   AddInstruction(instr);
   if (instr->HasObservableSideEffects()) {
     AddSimulate(assignment_id, REMOVABLE_SIMULATE);
   }
+  if (result_value != NULL) Drop(1);
   return ast_context()->ReturnValue(Pop());
 }
 
@@ -6777,14 +6303,60 @@
 }
 
 
+bool HOptimizedGraphBuilder::TryCallPolymorphicAsMonomorphic(
+    Call* expr,
+    HValue* receiver,
+    SmallMapList* types,
+    Handle<String> name) {
+  if (types->length() > kMaxCallPolymorphism) return false;
+
+  Handle<Map> map(types->at(0));
+  LookupResult lookup(isolate());
+  if (!CanLoadPropertyFromPrototype(map, name, &lookup)) return false;
+
+  Handle<Object> prototype(map->prototype(), isolate());
+  for (int count = 1; count < types->length(); ++count) {
+    Handle<Map> test_map(types->at(count));
+    if (!CanLoadPropertyFromPrototype(test_map, name, &lookup)) return false;
+    if (test_map->prototype() != *prototype) return false;
+  }
+
+  if (!expr->ComputeTarget(map, name)) return false;
+
+  BuildCheckHeapObject(receiver);
+  AddInstruction(HCheckMaps::New(receiver, types, zone()));
+  AddCheckPrototypeMaps(expr->holder(), map);
+  if (FLAG_trace_inlining) {
+    Handle<JSFunction> caller = current_info()->closure();
+    SmartArrayPointer<char> caller_name =
+        caller->shared()->DebugName()->ToCString();
+    PrintF("Trying to inline the polymorphic call to %s from %s\n",
+           *name->ToCString(), *caller_name);
+  }
+
+  if (!TryInlineCall(expr)) {
+    int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
+    HCallConstantFunction* call =
+        new(zone()) HCallConstantFunction(expr->target(), argument_count);
+    call->set_position(expr->position());
+    PreProcessCall(call);
+    AddInstruction(call);
+    if (!ast_context()->IsEffect()) Push(call);
+    AddSimulate(expr->id(), REMOVABLE_SIMULATE);
+    if (!ast_context()->IsEffect()) ast_context()->ReturnValue(Pop());
+  }
+
+  return true;
+}
+
+
 void HOptimizedGraphBuilder::HandlePolymorphicCallNamed(
     Call* expr,
     HValue* receiver,
     SmallMapList* types,
     Handle<String> name) {
-  // TODO(ager): We should recognize when the prototype chains for different
-  // maps are identical. In that case we can avoid repeatedly generating the
-  // same prototype map checks.
+  if (TryCallPolymorphicAsMonomorphic(expr, receiver, types, name)) return;
+
   int argument_count = expr->arguments()->length() + 1;  // Includes receiver.
   HBasicBlock* join = NULL;
   FunctionSorter order[kMaxCallPolymorphism];
@@ -8069,7 +7641,13 @@
     HValue* key = Pop();
     HValue* obj = Pop();
     HValue* context = environment()->LookupContext();
-    HDeleteProperty* instr = new(zone()) HDeleteProperty(context, obj, key);
+    HValue* function = AddLoadJSBuiltin(Builtins::DELETE, context);
+    Add<HPushArgument>(obj);
+    Add<HPushArgument>(key);
+    Add<HPushArgument>(Add<HConstant>(function_strict_mode_flag()));
+    // TODO(olivf) InvokeFunction produces a check for the parameter count,
+    // even though we are certain to pass the correct number of arguments here.
+    HInstruction* instr = new(zone()) HInvokeFunction(context, function, 3);
     return ast_context()->ReturnInstruction(instr, expr->id());
   } else if (proxy != NULL) {
     Variable* var = proxy->var();
@@ -8324,35 +7902,11 @@
       }
 
       after = BuildIncrement(returns_original_input, expr);
-      input = Pop();
 
-      HInstruction* store;
-      if (!monomorphic || map->is_observed()) {
-        // If we don't know the monomorphic type, do a generic store.
-        CHECK_ALIVE(store = BuildStoreNamedGeneric(object, name, after));
-      } else {
-        Handle<JSFunction> setter;
-        Handle<JSObject> holder;
-        if (LookupSetter(map, name, &setter, &holder)) {
-          store = BuildCallSetter(object, after, map, setter, holder);
-        } else {
-          CHECK_ALIVE(store = BuildStoreNamedMonomorphic(object,
-                                                         name,
-                                                         after,
-                                                         map));
-        }
-      }
-      AddInstruction(store);
+      HValue* result = returns_original_input ? Pop() : NULL;
 
-      // Overwrite the receiver in the bailout environment with the result
-      // of the operation, and the placeholder with the original value if
-      // necessary.
-      environment()->SetExpressionStackAt(0, after);
-      if (returns_original_input) environment()->SetExpressionStackAt(1, input);
-      if (store->HasObservableSideEffects()) {
-        AddSimulate(expr->AssignmentId(), REMOVABLE_SIMULATE);
-      }
-
+      return BuildStoreNamed(prop, expr->id(), expr->position(),
+                             expr->AssignmentId(), prop, object, after, result);
     } else {
       // Keyed property.
       if (returns_original_input) Push(graph()->GetConstantUndefined());
@@ -8882,7 +8436,12 @@
     // Code below assumes that we don't fall through.
     UNREACHABLE();
   } else if (op == Token::IN) {
-    HIn* result = new(zone()) HIn(context, left, right);
+    HValue* function = AddLoadJSBuiltin(Builtins::IN, context);
+    Add<HPushArgument>(left);
+    Add<HPushArgument>(right);
+    // TODO(olivf) InvokeFunction produces a check for the parameter count,
+    // even though we are certain to pass the correct number of arguments here.
+    HInstruction* result = new(zone()) HInvokeFunction(context, function, 2);
     result->set_position(expr->position());
     return ast_context()->ReturnInstruction(result, expr->id());
   }
@@ -8995,6 +8554,7 @@
     HValue* context,
     Handle<JSObject> boilerplate_object,
     Handle<JSObject> original_boilerplate_object,
+    Handle<Object> allocation_site,
     int data_size,
     int pointer_size,
     AllocationSiteMode mode) {
@@ -9032,8 +8592,9 @@
 
   int offset = 0;
   int data_offset = 0;
-  BuildEmitDeepCopy(boilerplate_object, original_boilerplate_object, target,
-                    &offset, data_target, &data_offset, mode);
+  BuildEmitDeepCopy(boilerplate_object, original_boilerplate_object,
+                    allocation_site, target, &offset, data_target,
+                    &data_offset, mode);
   return target;
 }
 
@@ -9041,11 +8602,30 @@
 void HOptimizedGraphBuilder::BuildEmitDeepCopy(
     Handle<JSObject> boilerplate_object,
     Handle<JSObject> original_boilerplate_object,
+    Handle<Object> allocation_site_object,
     HInstruction* target,
     int* offset,
     HInstruction* data_target,
     int* data_offset,
     AllocationSiteMode mode) {
+  Zone* zone = this->zone();
+
+  bool create_allocation_site_info = mode == TRACK_ALLOCATION_SITE &&
+      boilerplate_object->map()->CanTrackAllocationSite();
+
+  // If using allocation sites, then the payload on the site should already
+  // be filled in as a valid (boilerplate) array.
+  ASSERT(!create_allocation_site_info ||
+         AllocationSite::cast(*allocation_site_object)->IsLiteralSite());
+
+  HInstruction* allocation_site = NULL;
+
+  if (create_allocation_site_info) {
+    allocation_site = AddInstruction(new(zone) HConstant(
+        allocation_site_object, Representation::Tagged()));
+  }
+
+  // Only elements backing stores for non-COW arrays need to be copied.
   Handle<FixedArrayBase> elements(boilerplate_object->elements());
   Handle<FixedArrayBase> original_elements(
       original_boilerplate_object->elements());
@@ -9091,9 +8671,7 @@
       boilerplate_object->map()->CanTrackAllocationSite()) {
     elements_offset += AllocationSiteInfo::kSize;
     *offset += AllocationSiteInfo::kSize;
-    HInstruction* original_boilerplate =
-        Add<HConstant>(original_boilerplate_object);
-    BuildCreateAllocationSiteInfo(target, JSArray::kSize, original_boilerplate);
+    BuildCreateAllocationSiteInfo(target, JSArray::kSize, allocation_site);
   }
 }
 
@@ -9191,9 +8769,10 @@
                                                                    *offset);
 
       AddStore(object_properties, access, value_instruction);
-
-      BuildEmitDeepCopy(value_object, original_value_object, target,
-          offset, data_target, data_offset, DONT_TRACK_ALLOCATION_SITE);
+      BuildEmitDeepCopy(value_object, original_value_object,
+                        Handle<Object>::null(), target,
+                        offset, data_target, data_offset,
+                        DONT_TRACK_ALLOCATION_SITE);
     } else {
       Representation representation = details.representation();
       HInstruction* value_instruction = Add<HConstant>(value);
@@ -9300,8 +8879,10 @@
       HInstruction* value_instruction = Add<HInnerAllocatedObject>(target,
                                                                    *offset);
       Add<HStoreKeyed>(object_elements, key_constant, value_instruction, kind);
-      BuildEmitDeepCopy(value_object, original_value_object, target,
-          offset, data_target, data_offset, DONT_TRACK_ALLOCATION_SITE);
+      BuildEmitDeepCopy(value_object, original_value_object,
+                        Handle<Object>::null(), target,
+                        offset, data_target, data_offset,
+                        DONT_TRACK_ALLOCATION_SITE);
     } else {
       HInstruction* value_instruction =
           Add<HLoadKeyed>(boilerplate_elements, key_constant,
diff --git a/src/hydrogen.h b/src/hydrogen.h
index 7e4c691..f811867 100644
--- a/src/hydrogen.h
+++ b/src/hydrogen.h
@@ -293,15 +293,12 @@
   void FinalizeUniqueValueIds();
   void InsertTypeConversions();
   void MergeRemovableSimulates();
-  void InsertRepresentationChanges();
   void MarkDeoptimizeOnUndefined();
-  void ComputeMinusZeroChecks();
   bool ProcessArgumentsObject();
   void Canonicalize();
   void OrderBlocks();
   void AssignDominators();
   void SetupInformativeDefinitions();
-  void EliminateRedundantBoundsChecks();
   void DehoistSimpleArrayIndexComputations();
   void RestoreActualValues();
   void PropagateDeoptimizingMark();
@@ -451,17 +448,10 @@
   void MarkAsDeoptimizingRecursively(HBasicBlock* block);
   void NullifyUnreachableInstructions();
   void InsertTypeConversions(HInstruction* instr);
-  void PropagateMinusZeroChecks(HValue* value, BitVector* visited);
   void RecursivelyMarkPhiDeoptimizeOnUndefined(HPhi* phi);
-  void InsertRepresentationChangeForUse(HValue* value,
-                                        HValue* use_value,
-                                        int use_index,
-                                        Representation to);
-  void InsertRepresentationChangesForValue(HValue* value);
   void CheckForBackEdge(HBasicBlock* block, HBasicBlock* successor);
   void SetupInformativeDefinitionsInBlock(HBasicBlock* block);
   void SetupInformativeDefinitionsRecursively(HBasicBlock* block);
-  void EliminateRedundantBoundsChecks(HBasicBlock* bb, BoundsCheckTable* table);
 
   Isolate* isolate_;
   int next_block_id_;
@@ -1123,7 +1113,7 @@
 
   HLoadNamedField* AddLoadFixedArrayLength(HValue *object);
 
-  HValue* AddLoadJSBuiltin(Builtins::JavaScript builtin, HContext* context);
+  HValue* AddLoadJSBuiltin(Builtins::JavaScript builtin, HValue* context);
 
   enum SoftDeoptimizeMode {
     MUST_EMIT_SOFT_DEOPT,
@@ -1386,6 +1376,7 @@
   HValue* BuildGrowElementsCapacity(HValue* object,
                                     HValue* elements,
                                     ElementsKind kind,
+                                    ElementsKind new_kind,
                                     HValue* length,
                                     HValue* new_capacity);
 
@@ -1405,6 +1396,7 @@
 
   HValue* BuildCloneShallowArray(HContext* context,
                                  HValue* boilerplate,
+                                 HValue* allocation_site,
                                  AllocationSiteMode mode,
                                  ElementsKind kind,
                                  int length);
@@ -1751,18 +1743,24 @@
                                         BailoutId assignment_id,
                                         HValue* object,
                                         HValue* value,
+                                        HValue* result,
                                         SmallMapList* types,
                                         Handle<String> name);
   bool TryStorePolymorphicAsMonomorphic(int position,
                                         BailoutId assignment_id,
                                         HValue* object,
                                         HValue* value,
+                                        HValue* result,
                                         SmallMapList* types,
                                         Handle<String> name);
   void HandlePolymorphicCallNamed(Call* expr,
                                   HValue* receiver,
                                   SmallMapList* types,
                                   Handle<String> name);
+  bool TryCallPolymorphicAsMonomorphic(Call* expr,
+                                       HValue* receiver,
+                                       SmallMapList* types,
+                                       Handle<String> name);
   void HandleLiteralCompareTypeof(CompareOperation* expr,
                                   HTypeof* typeof_expr,
                                   Handle<String> check);
@@ -1836,7 +1834,8 @@
                        BailoutId assignment_id,
                        Property* prop,
                        HValue* object,
-                       HValue* value);
+                       HValue* store_value,
+                       HValue* result_value = NULL);
 
   HInstruction* BuildStoreNamedField(HValue* object,
                                      Handle<String> name,
@@ -1866,12 +1865,14 @@
   HInstruction* BuildFastLiteral(HValue* context,
                                  Handle<JSObject> boilerplate_object,
                                  Handle<JSObject> original_boilerplate_object,
+                                 Handle<Object> allocation_site,
                                  int data_size,
                                  int pointer_size,
                                  AllocationSiteMode mode);
 
   void BuildEmitDeepCopy(Handle<JSObject> boilerplat_object,
                          Handle<JSObject> object,
+                         Handle<Object> allocation_site,
                          HInstruction* target,
                          int* offset,
                          HInstruction* data_target,
diff --git a/src/ia32/code-stubs-ia32.cc b/src/ia32/code-stubs-ia32.cc
index 31f4f4b..89f21e9 100644
--- a/src/ia32/code-stubs-ia32.cc
+++ b/src/ia32/code-stubs-ia32.cc
@@ -65,6 +65,16 @@
 }
 
 
+void CreateAllocationSiteStub::InitializeInterfaceDescriptor(
+    Isolate* isolate,
+    CodeStubInterfaceDescriptor* descriptor) {
+  static Register registers[] = { ebx };
+  descriptor->register_param_count_ = 1;
+  descriptor->register_params_ = registers;
+  descriptor->deoptimization_handler_ = NULL;
+}
+
+
 void KeyedLoadFastElementStub::InitializeInterfaceDescriptor(
     Isolate* isolate,
     CodeStubInterfaceDescriptor* descriptor) {
@@ -2900,7 +2910,8 @@
 
   StubCompiler::GenerateLoadFunctionPrototype(masm, edx, eax, ebx, &miss);
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -2920,7 +2931,8 @@
   StubCompiler::GenerateLoadStringLength(masm, edx, eax, ebx, &miss,
                                          support_wrapper_);
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -2984,7 +2996,8 @@
 
   __ bind(&miss);
 
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -4400,17 +4413,15 @@
   __ cmp(ecx, Immediate(TypeFeedbackCells::MegamorphicSentinel(isolate)));
   __ j(equal, &done);
 
-  // Special handling of the Array() function, which caches not only the
-  // monomorphic Array function but the initial ElementsKind with special
-  // sentinels
-  __ JumpIfNotSmi(ecx, &miss);
-  if (FLAG_debug_code) {
-    Handle<Object> terminal_kind_sentinel =
-        TypeFeedbackCells::MonomorphicArraySentinel(masm->isolate(),
-                                                    LAST_FAST_ELEMENTS_KIND);
-    __ cmp(ecx, Immediate(terminal_kind_sentinel));
-    __ Assert(less_equal, "Array function sentinel is not an ElementsKind");
-  }
+  // If we came here, we need to see if we are the array function.
+  // If we didn't have a matching function, and we didn't find the megamorph
+  // sentinel, then we have in the cell either some other function or an
+  // AllocationSite. Do a map check on the object in ecx.
+  Handle<Map> allocation_site_map(
+      masm->isolate()->heap()->allocation_site_map(),
+      masm->isolate());
+  __ cmp(FieldOperand(ecx, 0), Immediate(allocation_site_map));
+  __ j(not_equal, &miss);
 
   // Load the global or builtins object from the current context
   __ LoadGlobalContext(ecx);
@@ -4442,14 +4453,22 @@
                       Context::SlotOffset(Context::ARRAY_FUNCTION_INDEX)));
   __ j(not_equal, &not_array_function);
 
-  // The target function is the Array constructor, install a sentinel value in
-  // the constructor's type info cell that will track the initial ElementsKind
-  // that should be used for the array when its constructed.
-  Handle<Object> initial_kind_sentinel =
-      TypeFeedbackCells::MonomorphicArraySentinel(isolate,
-          GetInitialFastElementsKind());
-  __ mov(FieldOperand(ebx, Cell::kValueOffset),
-         Immediate(initial_kind_sentinel));
+  // The target function is the Array constructor,
+  // Create an AllocationSite if we don't already have it, store it in the cell
+  {
+    FrameScope scope(masm, StackFrame::INTERNAL);
+
+    __ push(eax);
+    __ push(edi);
+    __ push(ebx);
+
+    CreateAllocationSiteStub create_stub;
+    __ CallStub(&create_stub);
+
+    __ pop(ebx);
+    __ pop(edi);
+    __ pop(eax);
+  }
   __ jmp(&done);
 
   __ bind(&not_array_function);
@@ -4615,6 +4634,7 @@
   // It is important that the store buffer overflow stubs are generated first.
   RecordWriteStub::GenerateFixedRegStubsAheadOfTime(isolate);
   ArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
+  CreateAllocationSiteStub::GenerateAheadOfTime(isolate);
 }
 
 
@@ -7492,18 +7512,20 @@
   __ j(zero, &normal_sequence);
 
   // We are going to create a holey array, but our kind is non-holey.
-  // Fix kind and retry
+  // Fix kind and retry (only if we have an allocation site in the cell).
   __ inc(edx);
   __ cmp(ebx, Immediate(undefined_sentinel));
   __ j(equal, &normal_sequence);
-
-  // The type cell may have gone megamorphic, don't overwrite if so
-  __ mov(ecx, FieldOperand(ebx, kPointerSize));
-  __ JumpIfNotSmi(ecx, &normal_sequence);
+  __ mov(ecx, FieldOperand(ebx, Cell::kValueOffset));
+  Handle<Map> allocation_site_map(
+      masm->isolate()->heap()->allocation_site_map(),
+      masm->isolate());
+  __ cmp(FieldOperand(ecx, 0), Immediate(allocation_site_map));
+  __ j(not_equal, &normal_sequence);
 
   // Save the resulting elements kind in type info
   __ SmiTag(edx);
-  __ mov(FieldOperand(ebx, kPointerSize), edx);
+  __ mov(FieldOperand(ecx, AllocationSite::kTransitionInfoOffset), edx);
   __ SmiUntag(edx);
 
   __ bind(&normal_sequence);
@@ -7532,7 +7554,7 @@
     ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
     T stub(kind);
     stub.GetCode(isolate)->set_is_pregenerated(true);
-    if (AllocationSiteInfo::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
+    if (AllocationSite::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
       T stub1(kind, CONTEXT_CHECK_REQUIRED, DISABLE_ALLOCATION_SITES);
       stub1.GetCode(isolate)->set_is_pregenerated(true);
     }
@@ -7604,7 +7626,17 @@
   __ cmp(ebx, Immediate(undefined_sentinel));
   __ j(equal, &no_info);
   __ mov(edx, FieldOperand(ebx, Cell::kValueOffset));
-  __ JumpIfNotSmi(edx, &no_info);
+
+  // The type cell may have undefined in its value.
+  __ cmp(edx, Immediate(undefined_sentinel));
+  __ j(equal, &no_info);
+
+  // The type cell has either an AllocationSite or a JSFunction
+  __ cmp(FieldOperand(edx, 0), Immediate(Handle<Map>(
+      masm->isolate()->heap()->allocation_site_map())));
+  __ j(not_equal, &no_info);
+
+  __ mov(edx, FieldOperand(edx, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(edx);
   __ jmp(&switch_ready);
   __ bind(&no_info);
diff --git a/src/ia32/ic-ia32.cc b/src/ia32/ic-ia32.cc
index eb6ccd9..59c71de 100644
--- a/src/ia32/ic-ia32.cc
+++ b/src/ia32/ic-ia32.cc
@@ -798,8 +798,8 @@
                                          ebx,
                                          edi,
                                          slow);
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                        FAST_DOUBLE_ELEMENTS);
+  AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                    FAST_DOUBLE_ELEMENTS);
   ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, slow);
   __ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
   __ jmp(&fast_double_without_map_check);
@@ -811,7 +811,7 @@
                                          ebx,
                                          edi,
                                          slow);
-  mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateMapChangeElementsTransition(masm, mode,
                                                                    slow);
   __ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
@@ -827,7 +827,7 @@
                                          ebx,
                                          edi,
                                          slow);
-  mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, slow);
   __ mov(ebx, FieldOperand(edx, JSObject::kElementsOffset));
   __ jmp(&finish_object_store);
@@ -1421,8 +1421,9 @@
   //  -- esp[0] : return address
   // -----------------------------------
 
-  Code::Flags flags =
-      Code::ComputeFlags(Code::STORE_IC, MONOMORPHIC, strict_mode);
+  Code::Flags flags = Code::ComputeFlags(
+      Code::STUB, MONOMORPHIC, strict_mode,
+      Code::NORMAL, Code::STORE_IC);
   Isolate::Current()->stub_cache()->GenerateProbe(masm, flags, edx, ecx, ebx,
                                                   no_reg);
 
@@ -1598,8 +1599,8 @@
   // Must return the modified receiver in eax.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                          FAST_DOUBLE_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                      FAST_DOUBLE_ELEMENTS);
     ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, &fail);
     __ mov(eax, edx);
     __ Ret();
@@ -1626,8 +1627,8 @@
   // Must return the modified receiver in eax.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS,
-                                                          FAST_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS,
+                                                      FAST_ELEMENTS);
     ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, &fail);
     __ mov(eax, edx);
     __ Ret();
diff --git a/src/ia32/lithium-codegen-ia32.cc b/src/ia32/lithium-codegen-ia32.cc
index 0b56e8f..ac82dcf 100644
--- a/src/ia32/lithium-codegen-ia32.cc
+++ b/src/ia32/lithium-codegen-ia32.cc
@@ -4198,7 +4198,7 @@
   __ mov(ebx, instr->hydrogen()->property_cell());
   ElementsKind kind = instr->hydrogen()->elements_kind();
   AllocationSiteOverrideMode override_mode =
-      (AllocationSiteInfo::GetMode(kind) == TRACK_ALLOCATION_SITE)
+      (AllocationSite::GetMode(kind) == TRACK_ALLOCATION_SITE)
           ? DISABLE_ALLOCATION_SITES
           : DONT_OVERRIDE;
   ContextCheckMode context_mode = CONTEXT_CHECK_NOT_REQUIRED;
@@ -6376,24 +6376,6 @@
 }
 
 
-void LCodeGen::DoDeleteProperty(LDeleteProperty* instr) {
-  LOperand* obj = instr->object();
-  LOperand* key = instr->key();
-  __ push(ToOperand(obj));
-  EmitPushTaggedOperand(key);
-  ASSERT(instr->HasPointerMap());
-  LPointerMap* pointers = instr->pointer_map();
-  RecordPosition(pointers->position());
-  // Create safepoint generator that will also ensure enough space in the
-  // reloc info for patching in deoptimization (since this is invoking a
-  // builtin)
-  SafepointGenerator safepoint_generator(
-      this, pointers, Safepoint::kLazyDeopt);
-  __ push(Immediate(Smi::FromInt(strict_mode_flag())));
-  __ InvokeBuiltin(Builtins::DELETE, CALL_FUNCTION, safepoint_generator);
-}
-
-
 void LCodeGen::DoDeferredStackCheck(LStackCheck* instr) {
   PushSafepointRegistersScope scope(this);
   __ mov(esi, Operand(ebp, StandardFrameConstants::kContextOffset));
@@ -6474,20 +6456,6 @@
 }
 
 
-void LCodeGen::DoIn(LIn* instr) {
-  LOperand* obj = instr->object();
-  LOperand* key = instr->key();
-  EmitPushTaggedOperand(key);
-  EmitPushTaggedOperand(obj);
-  ASSERT(instr->HasPointerMap());
-  LPointerMap* pointers = instr->pointer_map();
-  RecordPosition(pointers->position());
-  SafepointGenerator safepoint_generator(
-      this, pointers, Safepoint::kLazyDeopt);
-  __ InvokeBuiltin(Builtins::IN, CALL_FUNCTION, safepoint_generator);
-}
-
-
 void LCodeGen::DoForInPrepareMap(LForInPrepareMap* instr) {
   __ cmp(eax, isolate()->factory()->undefined_value());
   DeoptimizeIf(equal, instr->environment());
diff --git a/src/ia32/lithium-ia32.cc b/src/ia32/lithium-ia32.cc
index 1934e0a..a8905b4 100644
--- a/src/ia32/lithium-ia32.cc
+++ b/src/ia32/lithium-ia32.cc
@@ -350,7 +350,6 @@
   stream->Add(" ");
   constructor()->PrintTo(stream);
   stream->Add(" #%d / ", arity());
-  ASSERT(hydrogen()->property_cell()->value()->IsSmi());
   ElementsKind kind = hydrogen()->elements_kind();
   stream->Add(" (%s) ", ElementsKindToString(kind));
 }
@@ -2581,15 +2580,6 @@
 }
 
 
-LInstruction* LChunkBuilder::DoDeleteProperty(HDeleteProperty* instr) {
-  LOperand* context = UseFixed(instr->context(), esi);
-  LOperand* object = UseAtStart(instr->object());
-  LOperand* key = UseOrConstantAtStart(instr->key());
-  LDeleteProperty* result = new(zone()) LDeleteProperty(context, object, key);
-  return MarkAsCall(DefineFixed(result, eax), instr);
-}
-
-
 LInstruction* LChunkBuilder::DoOsrEntry(HOsrEntry* instr) {
   ASSERT(argument_count_ == 0);
   allocator_->MarkAsOsrEntry();
@@ -2770,15 +2760,6 @@
 }
 
 
-LInstruction* LChunkBuilder::DoIn(HIn* instr) {
-  LOperand* context = UseFixed(instr->context(), esi);
-  LOperand* key = UseOrConstantAtStart(instr->key());
-  LOperand* object = UseOrConstantAtStart(instr->object());
-  LIn* result = new(zone()) LIn(context, key, object);
-  return MarkAsCall(DefineFixed(result, eax), instr);
-}
-
-
 LInstruction* LChunkBuilder::DoForInPrepareMap(HForInPrepareMap* instr) {
   LOperand* context = UseFixed(instr->context(), esi);
   LOperand* object = UseFixed(instr->enumerable(), eax);
diff --git a/src/ia32/lithium-ia32.h b/src/ia32/lithium-ia32.h
index 7b332d2..4efde2e 100644
--- a/src/ia32/lithium-ia32.h
+++ b/src/ia32/lithium-ia32.h
@@ -87,7 +87,6 @@
   V(Context)                                    \
   V(DebugBreak)                                 \
   V(DeclareGlobals)                             \
-  V(DeleteProperty)                             \
   V(Deoptimize)                                 \
   V(DivI)                                       \
   V(DoubleToI)                                  \
@@ -101,7 +100,6 @@
   V(Goto)                                       \
   V(HasCachedArrayIndexAndBranch)               \
   V(HasInstanceTypeAndBranch)                   \
-  V(In)                                         \
   V(InstanceOf)                                 \
   V(InstanceOfKnownGlobal)                      \
   V(InstanceSize)                               \
@@ -2691,22 +2689,6 @@
 };
 
 
-class LDeleteProperty: public LTemplateInstruction<1, 3, 0> {
- public:
-  LDeleteProperty(LOperand* context, LOperand* obj, LOperand* key) {
-    inputs_[0] = context;
-    inputs_[1] = obj;
-    inputs_[2] = key;
-  }
-
-  LOperand* context() { return inputs_[0]; }
-  LOperand* object() { return inputs_[1]; }
-  LOperand* key() { return inputs_[2]; }
-
-  DECLARE_CONCRETE_INSTRUCTION(DeleteProperty, "delete-property")
-};
-
-
 class LOsrEntry: public LTemplateInstruction<0, 0, 0> {
  public:
   LOsrEntry() {}
@@ -2734,22 +2716,6 @@
 };
 
 
-class LIn: public LTemplateInstruction<1, 3, 0> {
- public:
-  LIn(LOperand* context, LOperand* key, LOperand* object) {
-    inputs_[0] = context;
-    inputs_[1] = key;
-    inputs_[2] = object;
-  }
-
-  LOperand* context() { return inputs_[0]; }
-  LOperand* key() { return inputs_[1]; }
-  LOperand* object() { return inputs_[2]; }
-
-  DECLARE_CONCRETE_INSTRUCTION(In, "in")
-};
-
-
 class LForInPrepareMap: public LTemplateInstruction<1, 2, 0> {
  public:
   LForInPrepareMap(LOperand* context, LOperand* object) {
diff --git a/src/ia32/stub-cache-ia32.cc b/src/ia32/stub-cache-ia32.cc
index 28e043d..6633375 100644
--- a/src/ia32/stub-cache-ia32.cc
+++ b/src/ia32/stub-cache-ia32.cc
@@ -779,87 +779,53 @@
 }
 
 
-// Both name_reg and receiver_reg are preserved on jumps to miss_label,
-// but may be destroyed if store is successful.
-void StubCompiler::GenerateStoreTransition(MacroAssembler* masm,
-                                           Handle<JSObject> object,
-                                           LookupResult* lookup,
-                                           Handle<Map> transition,
-                                           Handle<Name> name,
-                                           Register receiver_reg,
-                                           Register name_reg,
-                                           Register value_reg,
-                                           Register scratch1,
-                                           Register scratch2,
-                                           Register unused,
-                                           Label* miss_label,
-                                           Label* miss_restore_name,
-                                           Label* slow) {
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, Handle<Map>(object->map()),
-              miss_label, DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, scratch2, miss_label);
+void BaseStoreStubCompiler::GenerateNegativeHolderLookup(
+    MacroAssembler* masm,
+    Handle<JSObject> holder,
+    Register holder_reg,
+    Handle<Name> name,
+    Label* miss) {
+  if (holder->IsJSGlobalObject()) {
+    GenerateCheckPropertyCell(
+        masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+  } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
+    GenerateDictionaryNegativeLookup(
+        masm, miss, holder_reg, name, scratch1(), scratch2());
   }
+}
 
+
+// Receiver_reg is preserved on jumps to miss_label, but may be destroyed if
+// store is successful.
+void BaseStoreStubCompiler::GenerateStoreTransition(MacroAssembler* masm,
+                                                    Handle<JSObject> object,
+                                                    LookupResult* lookup,
+                                                    Handle<Map> transition,
+                                                    Handle<Name> name,
+                                                    Register receiver_reg,
+                                                    Register storage_reg,
+                                                    Register value_reg,
+                                                    Register scratch1,
+                                                    Register scratch2,
+                                                    Register unused,
+                                                    Label* miss_label,
+                                                    Label* slow) {
   int descriptor = transition->LastAdded();
   DescriptorArray* descriptors = transition->instance_descriptors();
   PropertyDetails details = descriptors->GetDetails(descriptor);
   Representation representation = details.representation();
   ASSERT(!representation.IsNone());
 
-  // Ensure no transitions to deprecated maps are followed.
-  __ CheckMapDeprecated(transition, scratch1, miss_label);
-
-  // Check that we are allowed to write this.
-  if (object->GetPrototype()->IsJSObject()) {
-    JSObject* holder;
-    // holder == object indicates that no property was found.
-    if (lookup->holder() != *object) {
-      holder = lookup->holder();
-    } else {
-      // Find the top object.
-      holder = *object;
-      do {
-        holder = JSObject::cast(holder->GetPrototype());
-      } while (holder->GetPrototype()->IsJSObject());
-    }
-    // We need an extra register, push
-    Register holder_reg = CheckPrototypes(
-        object, receiver_reg, Handle<JSObject>(holder), name_reg,
-        scratch1, scratch2, name, miss_restore_name, SKIP_RECEIVER);
-    // If no property was found, and the holder (the last object in the
-    // prototype chain) is in slow mode, we need to do a negative lookup on the
-    // holder.
-    if (lookup->holder() == *object) {
-      if (holder->IsJSGlobalObject()) {
-        GenerateCheckPropertyCell(
-            masm,
-            Handle<GlobalObject>(GlobalObject::cast(holder)),
-            name,
-            scratch1,
-            miss_restore_name);
-      } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
-        GenerateDictionaryNegativeLookup(
-            masm, miss_restore_name, holder_reg, name, scratch1, scratch2);
-      }
-    }
-  }
-
-  Register storage_reg = name_reg;
-
   if (details.type() == CONSTANT_FUNCTION) {
     Handle<HeapObject> constant(
         HeapObject::cast(descriptors->GetValue(descriptor)));
     __ LoadHeapObject(scratch1, constant);
     __ cmp(value_reg, scratch1);
-    __ j(not_equal, miss_restore_name);
+    __ j(not_equal, miss_label);
   } else if (FLAG_track_fields && representation.IsSmi()) {
-      __ JumpIfNotSmi(value_reg, miss_restore_name);
+      __ JumpIfNotSmi(value_reg, miss_label);
   } else if (FLAG_track_heap_object_fields && representation.IsHeapObject()) {
-    __ JumpIfSmi(value_reg, miss_restore_name);
+    __ JumpIfSmi(value_reg, miss_label);
   } else if (FLAG_track_double_fields && representation.IsDouble()) {
     Label do_store, heap_number;
     __ AllocateHeapNumber(storage_reg, scratch1, scratch2, slow);
@@ -879,7 +845,7 @@
 
     __ bind(&heap_number);
     __ CheckMap(value_reg, masm->isolate()->factory()->heap_number_map(),
-                miss_restore_name, DONT_DO_SMI_CHECK);
+                miss_label, DONT_DO_SMI_CHECK);
     if (CpuFeatures::IsSupported(SSE2)) {
       CpuFeatureScope use_sse2(masm, SSE2);
       __ movdbl(xmm0, FieldOperand(value_reg, HeapNumber::kValueOffset));
@@ -959,15 +925,12 @@
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
       // Update the write barrier for the array address.
-      // Pass the value being stored in the now unused name_reg.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ mov(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ mov(storage_reg, value_reg);
       }
       __ RecordWriteField(receiver_reg,
                           offset,
-                          name_reg,
+                          storage_reg,
                           scratch1,
                           kDontSaveFPRegs,
                           EMIT_REMEMBERED_SET,
@@ -986,15 +949,12 @@
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
       // Update the write barrier for the array address.
-      // Pass the value being stored in the now unused name_reg.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ mov(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ mov(storage_reg, value_reg);
       }
       __ RecordWriteField(scratch1,
                           offset,
-                          name_reg,
+                          storage_reg,
                           receiver_reg,
                           kDontSaveFPRegs,
                           EMIT_REMEMBERED_SET,
@@ -1010,24 +970,15 @@
 
 // Both name_reg and receiver_reg are preserved on jumps to miss_label,
 // but may be destroyed if store is successful.
-void StubCompiler::GenerateStoreField(MacroAssembler* masm,
-                                      Handle<JSObject> object,
-                                      LookupResult* lookup,
-                                      Register receiver_reg,
-                                      Register name_reg,
-                                      Register value_reg,
-                                      Register scratch1,
-                                      Register scratch2,
-                                      Label* miss_label) {
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, Handle<Map>(object->map()),
-              miss_label, DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, scratch2, miss_label);
-  }
-
+void BaseStoreStubCompiler::GenerateStoreField(MacroAssembler* masm,
+                                               Handle<JSObject> object,
+                                               LookupResult* lookup,
+                                               Register receiver_reg,
+                                               Register name_reg,
+                                               Register value_reg,
+                                               Register scratch1,
+                                               Register scratch2,
+                                               Label* miss_label) {
   // Stub never generated for non-global objects that require access
   // checks.
   ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
@@ -1286,7 +1237,8 @@
 }
 
 
-void BaseLoadStubCompiler::HandlerFrontendFooter(Label* success,
+void BaseLoadStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                 Label* success,
                                                  Label* miss) {
   if (!miss->is_unused()) {
     __ jmp(success);
@@ -1296,6 +1248,17 @@
 }
 
 
+void BaseStoreStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                  Label* success,
+                                                  Label* miss) {
+  if (!miss->is_unused()) {
+    __ jmp(success);
+    GenerateRestoreName(masm(), miss, name);
+    TailCallBuiltin(masm(), MissBuiltin(kind()));
+  }
+}
+
+
 Register BaseLoadStubCompiler::CallbackHandlerFrontend(
     Handle<JSObject> object,
     Register object_reg,
@@ -1351,7 +1314,7 @@
     __ j(not_equal, &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
   return reg;
 }
 
@@ -1372,7 +1335,7 @@
     GenerateCheckPropertyCell(masm(), global, name, scratch2(), &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
 }
 
 
@@ -1724,11 +1687,11 @@
     GenerateLoadFunctionFromCell(cell, function, &miss);
   }
 
-  Handle<Smi> kind(Smi::FromInt(GetInitialFastElementsKind()), isolate());
-  Handle<Cell> kind_feedback_cell =
-      isolate()->factory()->NewCell(kind);
+  Handle<AllocationSite> site = isolate()->factory()->NewAllocationSite();
+  site->set_transition_info(Smi::FromInt(GetInitialFastElementsKind()));
+  Handle<Cell> site_feedback_cell = isolate()->factory()->NewCell(site);
   __ mov(eax, Immediate(argc));
-  __ mov(ebx, kind_feedback_cell);
+  __ mov(ebx, site_feedback_cell);
   __ mov(edi, function);
 
   ArrayConstructorStub stub(isolate());
@@ -2899,19 +2862,13 @@
 
 
 Handle<Code> StoreStubCompiler::CompileStoreCallback(
-    Handle<Name> name,
     Handle<JSObject> object,
     Handle<JSObject> holder,
+    Handle<Name> name,
     Handle<ExecutableAccessorInfo> callback) {
-  Label miss, miss_restore_name;
-  // Check that the maps haven't changed, preserving the value register.
-  __ JumpIfSmi(receiver(), &miss);
-  CheckPrototypes(object, receiver(), holder,
-                  scratch1(), this->name(), scratch2(),
-                  name, &miss_restore_name);
-
-  // Stub never generated for non-global objects that require access checks.
-  ASSERT(holder->IsJSGlobalProxy() || !holder->IsAccessCheckNeeded());
+  Label success;
+  HandlerFrontend(object, receiver(), holder, name, &success);
+  __ bind(&success);
 
   __ pop(scratch1());  // remove the return address
   __ push(receiver());
@@ -2925,13 +2882,8 @@
       ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate());
   __ TailCallExternalReference(store_callback_property, 4, 1);
 
-  // Handle store cache miss.
-  GenerateRestoreName(masm(), &miss_restore_name, name);
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
   // Return the generated code.
-  return GetICCode(kind(), Code::CALLBACKS, name);
+  return GetCode(kind(), Code::CALLBACKS, name);
 }
 
 
@@ -2985,20 +2937,6 @@
 Handle<Code> StoreStubCompiler::CompileStoreInterceptor(
     Handle<JSObject> object,
     Handle<Name> name) {
-  Label miss;
-
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver(), Handle<Map>(object->map()), &miss, DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver(), scratch1(), scratch2(), &miss);
-  }
-
-  // Stub never generated for non-global objects that require access
-  // checks.
-  ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
-
   __ pop(scratch1());  // remove the return address
   __ push(receiver());
   __ push(this->name());
@@ -3011,12 +2949,8 @@
       ExternalReference(IC_Utility(IC::kStoreInterceptorProperty), isolate());
   __ TailCallExternalReference(store_ic_property, 4, 1);
 
-  // Handle store cache miss.
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
   // Return the generated code.
-  return GetICCode(kind(), Code::INTERCEPTOR, name);
+  return GetCode(kind(), Code::INTERCEPTOR, name);
 }
 
 
@@ -3220,7 +3154,7 @@
     __ Check(not_equal, "DontDelete cells can't contain the hole");
   }
 
-  HandlerFrontendFooter(&success, &miss);
+  HandlerFrontendFooter(name, &success, &miss);
   __ bind(&success);
 
   Counters* counters = isolate()->counters();
@@ -3233,7 +3167,7 @@
 }
 
 
-Handle<Code> BaseLoadStubCompiler::CompilePolymorphicIC(
+Handle<Code> BaseLoadStoreStubCompiler::CompilePolymorphicIC(
     MapHandleList* receiver_maps,
     CodeHandleList* handlers,
     Handle<Name> name,
diff --git a/src/ic.cc b/src/ic.cc
index 02f2f0f..dc15194 100644
--- a/src/ic.cc
+++ b/src/ic.cc
@@ -217,9 +217,11 @@
   int index = map->IndexInCodeCache(name, target);
   if (index >= 0) {
     map->RemoveFromCodeCache(String::cast(name), target, index);
-    // For loads, handlers are stored in addition to the ICs on the map. Remove
-    // those, too.
-    if (target->is_load_stub() || target->is_keyed_load_stub()) {
+    // For loads and stores, handlers are stored in addition to the ICs on the
+    // map. Remove those, too.
+    if ((target->is_load_stub() || target->is_keyed_load_stub() ||
+         target->is_store_stub() || target->is_keyed_store_stub()) &&
+        target->type() != Code::NORMAL) {
       Code* handler = target->FindFirstCode();
       index = map->IndexInCodeCache(name, handler);
       if (index >= 0) {
@@ -972,10 +974,10 @@
 
 
 bool IC::UpdatePolymorphicIC(State state,
-                             StrictModeFlag strict_mode,
                              Handle<JSObject> receiver,
                              Handle<String> name,
-                             Handle<Code> code) {
+                             Handle<Code> code,
+                             StrictModeFlag strict_mode) {
   if (code->type() == Code::NORMAL) return false;
   if (target()->ic_state() == MONOMORPHIC &&
       target()->type() == Code::NORMAL) {
@@ -1026,18 +1028,39 @@
     handlers.Add(code);
   }
 
-  Handle<Code> ic = isolate()->stub_cache()->ComputePolymorphicIC(
-      &receiver_maps, &handlers, number_of_valid_maps, name);
+  Handle<Code> ic = ComputePolymorphicIC(
+      &receiver_maps, &handlers, number_of_valid_maps, name, strict_mode);
   set_target(*ic);
   return true;
 }
 
 
+Handle<Code> LoadIC::ComputePolymorphicIC(MapHandleList* receiver_maps,
+                                          CodeHandleList* handlers,
+                                          int number_of_valid_maps,
+                                          Handle<Name> name,
+                                          StrictModeFlag strict_mode) {
+  return isolate()->stub_cache()->ComputePolymorphicLoadIC(
+      receiver_maps, handlers, number_of_valid_maps, name);
+}
+
+
+Handle<Code> StoreIC::ComputePolymorphicIC(MapHandleList* receiver_maps,
+                                           CodeHandleList* handlers,
+                                           int number_of_valid_maps,
+                                           Handle<Name> name,
+                                           StrictModeFlag strict_mode) {
+  return isolate()->stub_cache()->ComputePolymorphicStoreIC(
+      receiver_maps, handlers, number_of_valid_maps, name, strict_mode);
+}
+
+
 void LoadIC::UpdateMonomorphicIC(Handle<JSObject> receiver,
                                  Handle<Code> handler,
-                                 Handle<String> name) {
+                                 Handle<String> name,
+                                 StrictModeFlag strict_mode) {
   if (handler->type() == Code::NORMAL) return set_target(*handler);
-  Handle<Code> ic = isolate()->stub_cache()->ComputeMonomorphicIC(
+  Handle<Code> ic = isolate()->stub_cache()->ComputeMonomorphicLoadIC(
       receiver, handler, name);
   set_target(*ic);
 }
@@ -1045,14 +1068,37 @@
 
 void KeyedLoadIC::UpdateMonomorphicIC(Handle<JSObject> receiver,
                                       Handle<Code> handler,
-                                      Handle<String> name) {
+                                      Handle<String> name,
+                                      StrictModeFlag strict_mode) {
   if (handler->type() == Code::NORMAL) return set_target(*handler);
-  Handle<Code> ic = isolate()->stub_cache()->ComputeKeyedMonomorphicIC(
+  Handle<Code> ic = isolate()->stub_cache()->ComputeMonomorphicKeyedLoadIC(
       receiver, handler, name);
   set_target(*ic);
 }
 
 
+void StoreIC::UpdateMonomorphicIC(Handle<JSObject> receiver,
+                                  Handle<Code> handler,
+                                  Handle<String> name,
+                                  StrictModeFlag strict_mode) {
+  if (handler->type() == Code::NORMAL) return set_target(*handler);
+  Handle<Code> ic = isolate()->stub_cache()->ComputeMonomorphicStoreIC(
+      receiver, handler, name, strict_mode);
+  set_target(*ic);
+}
+
+
+void KeyedStoreIC::UpdateMonomorphicIC(Handle<JSObject> receiver,
+                                       Handle<Code> handler,
+                                       Handle<String> name,
+                                       StrictModeFlag strict_mode) {
+  if (handler->type() == Code::NORMAL) return set_target(*handler);
+  Handle<Code> ic = isolate()->stub_cache()->ComputeMonomorphicKeyedStoreIC(
+      receiver, handler, name, strict_mode);
+  set_target(*ic);
+}
+
+
 void IC::CopyICToMegamorphicCache(Handle<String> name) {
   MapHandleList receiver_maps;
   CodeHandleList handlers;
@@ -1094,12 +1140,12 @@
     case UNINITIALIZED:
     case PREMONOMORPHIC:
     case MONOMORPHIC_PROTOTYPE_FAILURE:
-      UpdateMonomorphicIC(receiver, code, name);
+      UpdateMonomorphicIC(receiver, code, name, strict_mode);
       break;
     case MONOMORPHIC:
       // Only move to megamorphic if the target changes.
       if (target() != *code) {
-        if (target()->is_load_stub()) {
+        if (target()->is_load_stub() || target()->is_store_stub()) {
           bool is_same_handler = false;
           {
             DisallowHeapAllocation no_allocation;
@@ -1108,10 +1154,10 @@
           }
           if (is_same_handler
               && IsTransitionedMapOfMonomorphicTarget(receiver->map())) {
-            UpdateMonomorphicIC(receiver, code, name);
+            UpdateMonomorphicIC(receiver, code, name, strict_mode);
             break;
           }
-          if (UpdatePolymorphicIC(state, strict_mode, receiver, name, code)) {
+          if (UpdatePolymorphicIC(state, receiver, name, code, strict_mode)) {
             break;
           }
 
@@ -1131,13 +1177,15 @@
       UpdateMegamorphicCache(receiver->map(), *name, *code);
       break;
     case POLYMORPHIC:
-      if (target()->is_load_stub()) {
-        if (UpdatePolymorphicIC(state, strict_mode, receiver, name, code)) {
+      if (target()->is_load_stub() || target()->is_store_stub()) {
+        if (UpdatePolymorphicIC(state, receiver, name, code, strict_mode)) {
           break;
         }
         CopyICToMegamorphicCache(name);
         UpdateMegamorphicCache(receiver->map(), *name, *code);
-        set_target(*megamorphic_stub());
+        set_target((strict_mode == kStrictMode)
+                   ? *megamorphic_stub_strict()
+                   : *megamorphic_stub());
       } else {
         // When trying to patch a polymorphic keyed load/store element stub
         // with anything other than another polymorphic stub, go generic.
diff --git a/src/ic.h b/src/ic.h
index 61bf848..aa867cc 100644
--- a/src/ic.h
+++ b/src/ic.h
@@ -169,14 +169,25 @@
 
   virtual void UpdateMonomorphicIC(Handle<JSObject> receiver,
                                    Handle<Code> handler,
-                                   Handle<String> name) {
+                                   Handle<String> name,
+                                   StrictModeFlag strict_mode) {
     set_target(*handler);
   }
   bool UpdatePolymorphicIC(State state,
-                           StrictModeFlag strict_mode,
                            Handle<JSObject> receiver,
                            Handle<String> name,
-                           Handle<Code> code);
+                           Handle<Code> code,
+                           StrictModeFlag strict_mode);
+
+  virtual Handle<Code> ComputePolymorphicIC(MapHandleList* receiver_maps,
+                                            CodeHandleList* handlers,
+                                            int number_of_valid_maps,
+                                            Handle<Name> name,
+                                            StrictModeFlag strict_mode) {
+    UNREACHABLE();
+    return Handle<Code>::null();
+  };
+
   void CopyICToMegamorphicCache(Handle<String> name);
   bool IsTransitionedMapOfMonomorphicTarget(Map* receiver_map);
   void PatchCache(State state,
@@ -391,9 +402,18 @@
                     State state,
                     Handle<Object> object,
                     Handle<String> name);
+
   virtual void UpdateMonomorphicIC(Handle<JSObject> receiver,
                                    Handle<Code> handler,
-                                   Handle<String> name);
+                                   Handle<String> name,
+                                   StrictModeFlag strict_mode);
+
+  virtual Handle<Code> ComputePolymorphicIC(MapHandleList* receiver_maps,
+                                            CodeHandleList* handlers,
+                                            int number_of_valid_maps,
+                                            Handle<Name> name,
+                                            StrictModeFlag strict_mode);
+
   virtual Handle<Code> ComputeLoadHandler(LookupResult* lookup,
                                           Handle<JSObject> receiver,
                                           Handle<String> name);
@@ -467,7 +487,8 @@
   // Update the inline cache.
   virtual void UpdateMonomorphicIC(Handle<JSObject> receiver,
                                    Handle<Code> handler,
-                                   Handle<String> name);
+                                   Handle<String> name,
+                                   StrictModeFlag strict_mode);
   virtual Handle<Code> ComputeLoadHandler(LookupResult* lookup,
                                           Handle<JSObject> receiver,
                                           Handle<String> name);
@@ -544,6 +565,16 @@
     return isolate()->builtins()->StoreIC_GlobalProxy_Strict();
   }
 
+  virtual void UpdateMonomorphicIC(Handle<JSObject> receiver,
+                                   Handle<Code> handler,
+                                   Handle<String> name,
+                                   StrictModeFlag strict_mode);
+
+  virtual Handle<Code> ComputePolymorphicIC(MapHandleList* receiver_maps,
+                                            CodeHandleList* handlers,
+                                            int number_of_valid_maps,
+                                            Handle<Name> name,
+                                            StrictModeFlag strict_mode);
 
   // Update the inline cache and the global stub cache based on the
   // lookup result.
@@ -642,6 +673,11 @@
                                 KeyedAccessStoreMode store_mode,
                                 StrictModeFlag strict_mode);
 
+  virtual void UpdateMonomorphicIC(Handle<JSObject> receiver,
+                                   Handle<Code> handler,
+                                   Handle<String> name,
+                                   StrictModeFlag strict_mode);
+
  private:
   void set_target(Code* code) {
     // Strict mode must be preserved across IC patching.
diff --git a/src/icu_util.cc b/src/icu_util.cc
new file mode 100644
index 0000000..aaafadc
--- /dev/null
+++ b/src/icu_util.cc
@@ -0,0 +1,60 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+#include "icu_util.h"
+
+#if defined(_WIN32)
+#include <windows.h>
+
+#include "unicode/putil.h"
+#include "unicode/udata.h"
+
+#define ICU_UTIL_DATA_SYMBOL "icudt" U_ICU_VERSION_SHORT "_dat"
+#define ICU_UTIL_DATA_SHARED_MODULE_NAME "icudt.dll"
+#endif
+
+namespace v8 {
+
+bool InitializeICU() {
+#if defined(_WIN32)
+  // We expect to find the ICU data module alongside the current module.
+  HMODULE module = LoadLibraryA(ICU_UTIL_DATA_SHARED_MODULE_NAME);
+  if (!module) return false;
+
+  FARPROC addr = GetProcAddress(module, ICU_UTIL_DATA_SYMBOL);
+  if (!addr) return false;
+
+  UErrorCode err = U_ZERO_ERROR;
+  udata_setCommonData(reinterpret_cast<void*>(addr), &err);
+  return err == U_ZERO_ERROR;
+#else
+  // Mac/Linux bundle the ICU data in.
+  return true;
+#endif
+}
+
+}  // namespace v8
diff --git a/src/icu_util.h b/src/icu_util.h
new file mode 100644
index 0000000..d7961b9
--- /dev/null
+++ b/src/icu_util.h
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+#ifndef V8_ICU_UTIL_H_
+#define V8_ICU_UTIL_H_
+
+namespace v8 {
+
+// Call this function to load ICU's data tables for the current process.  This
+// function should be called before ICU is used.
+bool InitializeICU();
+
+}  // namespace v8
+
+#endif  // V8_ICU_UTIL_H_
diff --git a/src/jsregexp.cc b/src/jsregexp.cc
index 5da7398..666866e 100644
--- a/src/jsregexp.cc
+++ b/src/jsregexp.cc
@@ -2477,7 +2477,8 @@
                                 QuickCheckDetails* details,
                                 bool fall_through_on_failure) {
   if (details->characters() == 0) return false;
-  GetQuickCheckDetails(details, compiler, 0, trace->at_start() == Trace::FALSE);
+  GetQuickCheckDetails(
+      details, compiler, 0, trace->at_start() == Trace::FALSE_VALUE);
   if (details->cannot_match()) return false;
   if (!details->Rationalize(compiler->ascii())) return false;
   ASSERT(details->characters() == 1 ||
@@ -3066,7 +3067,7 @@
 void AssertionNode::EmitBoundaryCheck(RegExpCompiler* compiler, Trace* trace) {
   RegExpMacroAssembler* assembler = compiler->macro_assembler();
   Trace::TriBool next_is_word_character = Trace::UNKNOWN;
-  bool not_at_start = (trace->at_start() == Trace::FALSE);
+  bool not_at_start = (trace->at_start() == Trace::FALSE_VALUE);
   BoyerMooreLookahead* lookahead = bm_info(not_at_start);
   if (lookahead == NULL) {
     int eats_at_least =
@@ -3077,12 +3078,15 @@
       BoyerMooreLookahead* bm =
           new(zone()) BoyerMooreLookahead(eats_at_least, compiler, zone());
       FillInBMInfo(0, kRecursionBudget, bm, not_at_start);
-      if (bm->at(0)->is_non_word()) next_is_word_character = Trace::FALSE;
-      if (bm->at(0)->is_word()) next_is_word_character = Trace::TRUE;
+      if (bm->at(0)->is_non_word())
+        next_is_word_character = Trace::FALSE_VALUE;
+      if (bm->at(0)->is_word()) next_is_word_character = Trace::TRUE_VALUE;
     }
   } else {
-    if (lookahead->at(0)->is_non_word()) next_is_word_character = Trace::FALSE;
-    if (lookahead->at(0)->is_word()) next_is_word_character = Trace::TRUE;
+    if (lookahead->at(0)->is_non_word())
+      next_is_word_character = Trace::FALSE_VALUE;
+    if (lookahead->at(0)->is_word())
+      next_is_word_character = Trace::TRUE_VALUE;
   }
   bool at_boundary = (assertion_type_ == AssertionNode::AT_BOUNDARY);
   if (next_is_word_character == Trace::UNKNOWN) {
@@ -3102,10 +3106,10 @@
     assembler->Bind(&before_word);
     BacktrackIfPrevious(compiler, trace, at_boundary ? kIsWord : kIsNonWord);
     assembler->Bind(&ok);
-  } else if (next_is_word_character == Trace::TRUE) {
+  } else if (next_is_word_character == Trace::TRUE_VALUE) {
     BacktrackIfPrevious(compiler, trace, at_boundary ? kIsWord : kIsNonWord);
   } else {
-    ASSERT(next_is_word_character == Trace::FALSE);
+    ASSERT(next_is_word_character == Trace::FALSE_VALUE);
     BacktrackIfPrevious(compiler, trace, at_boundary ? kIsNonWord : kIsWord);
   }
 }
@@ -3169,7 +3173,7 @@
       break;
     }
     case AT_START: {
-      if (trace->at_start() == Trace::FALSE) {
+      if (trace->at_start() == Trace::FALSE_VALUE) {
         assembler->GoTo(trace->backtrack());
         return;
       }
@@ -3986,7 +3990,7 @@
 
   int first_normal_choice = greedy_loop ? 1 : 0;
 
-  bool not_at_start = current_trace->at_start() == Trace::FALSE;
+  bool not_at_start = current_trace->at_start() == Trace::FALSE_VALUE;
   const int kEatsAtLeastNotYetInitialized = -1;
   int eats_at_least = kEatsAtLeastNotYetInitialized;
 
@@ -4057,7 +4061,7 @@
       new_trace.set_bound_checked_up_to(preload_characters);
     }
     new_trace.quick_check_performed()->Clear();
-    if (not_at_start_) new_trace.set_at_start(Trace::FALSE);
+    if (not_at_start_) new_trace.set_at_start(Trace::FALSE_VALUE);
     alt_gen->expects_preload = preload_is_current;
     bool generate_full_check_inline = false;
     if (FLAG_regexp_optimization &&
@@ -4157,7 +4161,7 @@
   Trace out_of_line_trace(*trace);
   out_of_line_trace.set_characters_preloaded(preload_characters);
   out_of_line_trace.set_quick_check_performed(&alt_gen->quick_check_details);
-  if (not_at_start_) out_of_line_trace.set_at_start(Trace::FALSE);
+  if (not_at_start_) out_of_line_trace.set_at_start(Trace::FALSE_VALUE);
   ZoneList<Guard*>* guards = alternative.guards();
   int guard_count = (guards == NULL) ? 0 : guards->length();
   if (next_expects_preload) {
diff --git a/src/jsregexp.h b/src/jsregexp.h
index 528a9a2..20c0ac4 100644
--- a/src/jsregexp.h
+++ b/src/jsregexp.h
@@ -1330,7 +1330,7 @@
   // A value for a property that is either known to be true, know to be false,
   // or not known.
   enum TriBool {
-    UNKNOWN = -1, FALSE = 0, TRUE = 1
+    UNKNOWN = -1, FALSE_VALUE = 0, TRUE_VALUE = 1
   };
 
   class DeferredAction {
@@ -1426,7 +1426,9 @@
            at_start_ == UNKNOWN;
   }
   TriBool at_start() { return at_start_; }
-  void set_at_start(bool at_start) { at_start_ = at_start ? TRUE : FALSE; }
+  void set_at_start(bool at_start) {
+    at_start_ = at_start ? TRUE_VALUE : FALSE_VALUE;
+  }
   Label* backtrack() { return backtrack_; }
   Label* loop_label() { return loop_label_; }
   RegExpNode* stop_node() { return stop_node_; }
diff --git a/src/mark-compact.cc b/src/mark-compact.cc
index 6389685..980c039 100644
--- a/src/mark-compact.cc
+++ b/src/mark-compact.cc
@@ -781,10 +781,12 @@
   }
 
   if (FLAG_trace_fragmentation && mode == REDUCE_MEMORY_FOOTPRINT) {
-    PrintF("Estimated over reserved memory: %.1f / %.1f MB (threshold %d)\n",
+    PrintF("Estimated over reserved memory: %.1f / %.1f MB (threshold %d), "
+           "evacuation candidate limit: %d\n",
            static_cast<double>(over_reserved) / MB,
            static_cast<double>(reserved) / MB,
-           static_cast<int>(kFreenessThreshold));
+           static_cast<int>(kFreenessThreshold),
+           max_evacuation_candidates);
   }
 
   intptr_t estimated_release = 0;
@@ -811,7 +813,7 @@
       if ((counter & 1) == (page_number & 1)) fragmentation = 1;
     } else if (mode == REDUCE_MEMORY_FOOTPRINT) {
       // Don't try to release too many pages.
-      if (estimated_release >= ((over_reserved * 3) / 4)) {
+      if (estimated_release >= over_reserved) {
         continue;
       }
 
@@ -828,7 +830,7 @@
       int free_pct = static_cast<int>(free_bytes * 100) / p->area_size();
 
       if (free_pct >= kFreenessThreshold) {
-        estimated_release += 2 * p->area_size() - free_bytes;
+        estimated_release += free_bytes;
         fragmentation = free_pct;
       } else {
         fragmentation = 0;
@@ -1929,7 +1931,8 @@
 static inline int MarkWordToObjectStarts(uint32_t mark_bits, int* starts);
 
 
-static void DiscoverGreyObjectsOnPage(MarkingDeque* marking_deque, Page* p) {
+static void DiscoverGreyObjectsOnPage(MarkingDeque* marking_deque,
+                                      MemoryChunk* p) {
   ASSERT(!marking_deque->IsFull());
   ASSERT(strcmp(Marking::kWhiteBitPattern, "00") == 0);
   ASSERT(strcmp(Marking::kBlackBitPattern, "10") == 0);
@@ -2003,6 +2006,18 @@
 }
 
 
+static void DiscoverGreyObjectsInNewSpace(Heap* heap,
+                                          MarkingDeque* marking_deque) {
+  NewSpace* space = heap->new_space();
+  NewSpacePageIterator it(space->bottom(), space->top());
+  while (it.has_next()) {
+    NewSpacePage* page = it.next();
+    DiscoverGreyObjectsOnPage(marking_deque, page);
+    if (marking_deque->IsFull()) return;
+  }
+}
+
+
 bool MarkCompactCollector::IsUnmarkedHeapObject(Object** p) {
   Object* o = *p;
   if (!o->IsHeapObject()) return false;
@@ -2109,8 +2124,7 @@
 void MarkCompactCollector::RefillMarkingDeque() {
   ASSERT(marking_deque_.overflowed());
 
-  SemiSpaceIterator new_it(heap()->new_space());
-  DiscoverGreyObjectsWithIterator(heap(), &marking_deque_, &new_it);
+  DiscoverGreyObjectsInNewSpace(heap(), &marking_deque_);
   if (marking_deque_.IsFull()) return;
 
   DiscoverGreyObjectsInSpace(heap(),
diff --git a/src/messages.js b/src/messages.js
index 6c9e2d7..35f3255 100644
--- a/src/messages.js
+++ b/src/messages.js
@@ -104,8 +104,6 @@
   observe_perform_non_function:  ["Cannot perform non-function"],
   observe_notify_non_notifier:   ["notify called on non-notifier object"],
   proto_poison_pill:             ["Generic use of __proto__ accessor not allowed"],
-  parameterless_typed_array_constr:
-                                 ["%0"," constructor should have at least one argument."],
   not_typed_array:               ["this is not a typed array."],
   invalid_argument:              ["invalid_argument"],
   data_view_not_array_buffer:    ["First argument to DataView constructor must be an ArrayBuffer"],
diff --git a/src/mips/code-stubs-mips.cc b/src/mips/code-stubs-mips.cc
index 727dee5..29178eb 100644
--- a/src/mips/code-stubs-mips.cc
+++ b/src/mips/code-stubs-mips.cc
@@ -61,6 +61,16 @@
 }
 
 
+void CreateAllocationSiteStub::InitializeInterfaceDescriptor(
+    Isolate* isolate,
+    CodeStubInterfaceDescriptor* descriptor) {
+  static Register registers[] = { a2 };
+  descriptor->register_param_count_ = 1;
+  descriptor->register_params_ = registers;
+  descriptor->deoptimization_handler_ = NULL;
+}
+
+
 void KeyedLoadFastElementStub::InitializeInterfaceDescriptor(
     Isolate* isolate,
     CodeStubInterfaceDescriptor* descriptor) {
@@ -3079,6 +3089,7 @@
   StubFailureTrampolineStub::GenerateAheadOfTime(isolate);
   RecordWriteStub::GenerateFixedRegStubsAheadOfTime(isolate);
   ArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
+  CreateAllocationSiteStub::GenerateAheadOfTime(isolate);
 }
 
 
@@ -3722,7 +3733,8 @@
 
   StubCompiler::GenerateLoadFunctionPrototype(masm, receiver, a3, t0, &miss);
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -3753,7 +3765,8 @@
                                          support_wrapper_);
 
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -3823,7 +3836,8 @@
 
   __ bind(&miss);
 
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -4778,20 +4792,17 @@
   // A monomorphic cache hit or an already megamorphic state: invoke the
   // function without changing the state.
   __ Branch(&done, eq, a3, Operand(a1));
-  __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
-  __ Branch(&done, eq, a3, Operand(at));
 
-  // Special handling of the Array() function, which caches not only the
-  // monomorphic Array function but the initial ElementsKind with special
-  // sentinels
-  __ JumpIfNotSmi(a3, &miss);
-  if (FLAG_debug_code) {
-    Handle<Object> terminal_kind_sentinel =
-    TypeFeedbackCells::MonomorphicArraySentinel(masm->isolate(),
-                                                LAST_FAST_ELEMENTS_KIND);
-    __ Assert(le, "Array function sentinel is not an ElementsKind",
-              a3, Operand(terminal_kind_sentinel));
-  }
+  // If we came here, we need to see if we are the array function.
+  // If we didn't have a matching function, and we didn't find the megamorph
+  // sentinel, then we have in the cell either some other function or an
+  // AllocationSite. Do a map check on the object in a3.
+  Handle<Map> allocation_site_map(
+      masm->isolate()->heap()->allocation_site_map(),
+      masm->isolate());
+  __ lw(t1, FieldMemOperand(a3, 0));
+  __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
+  __ Branch(&miss, ne, t1, Operand(at));
 
   // Make sure the function is the Array() function
   __ LoadArrayFunction(a3);
@@ -4818,14 +4829,22 @@
   __ LoadArrayFunction(a3);
   __ Branch(&not_array_function, ne, a1, Operand(a3));
 
-  // The target function is the Array constructor, install a sentinel value in
-  // the constructor's type info cell that will track the initial ElementsKind
-  // that should be used for the array when its constructed.
-  Handle<Object> initial_kind_sentinel =
-      TypeFeedbackCells::MonomorphicArraySentinel(masm->isolate(),
-          GetInitialFastElementsKind());
-  __ li(a3, Operand(initial_kind_sentinel));
-  __ sw(a3, FieldMemOperand(a2, Cell::kValueOffset));
+  // The target function is the Array constructor.
+  // Create an AllocationSite if we don't already have it, store it in the cell.
+  {
+    FrameScope scope(masm, StackFrame::INTERNAL);
+    const RegList kSavedRegs =
+        1 << 4  |  // a0
+        1 << 5  |  // a1
+        1 << 6;    // a2
+
+    __ MultiPush(kSavedRegs);
+
+    CreateAllocationSiteStub create_stub;
+    __ CallStub(&create_stub);
+
+    __ MultiPop(kSavedRegs);
+  }
   __ Branch(&done);
 
   __ bind(&not_array_function);
@@ -6944,6 +6963,9 @@
     Isolate* isolate) {
   StoreBufferOverflowStub stub1(kDontSaveFPRegs);
   stub1.GetCode(isolate)->set_is_pregenerated(true);
+  // Hydrogen code stubs need stub2 at snapshot time.
+  StoreBufferOverflowStub stub2(kSaveFPRegs);
+  stub2.GetCode(isolate)->set_is_pregenerated(true);
 }
 
 
@@ -7349,10 +7371,6 @@
   ASSERT(FAST_DOUBLE_ELEMENTS == 4);
   ASSERT(FAST_HOLEY_DOUBLE_ELEMENTS == 5);
 
-  Handle<Object> undefined_sentinel(
-      masm->isolate()->heap()->undefined_value(),
-      masm->isolate());
-
   // is the low bit set? If so, we are holey and that is good.
   Label normal_sequence;
   __ And(at, a3, Operand(1));
@@ -7363,17 +7381,19 @@
   __ Branch(&normal_sequence, eq, t1, Operand(zero_reg));
 
   // We are going to create a holey array, but our kind is non-holey.
-  // Fix kind and retry
+  // Fix kind and retry (only if we have an allocation site in the cell).
   __ Addu(a3, a3, Operand(1));
-  __ Branch(&normal_sequence, eq, a2, Operand(undefined_sentinel));
-
-  // The type cell may have gone megamorphic, don't overwrite if so.
-  __ lw(t1, FieldMemOperand(a2, kPointerSize));
-  __ JumpIfNotSmi(t1, &normal_sequence);
+  __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
+  __ Branch(&normal_sequence, eq, a2, Operand(at));
+  __ lw(t1, FieldMemOperand(a2, Cell::kValueOffset));
+  __ lw(t1, FieldMemOperand(t1, 0));
+  __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
+  __ Branch(&normal_sequence, ne, t1, Operand(at));
 
   // Save the resulting elements kind in type info
   __ SmiTag(a3);
-  __ sw(a3, FieldMemOperand(a2, kPointerSize));
+  __ lw(t1, FieldMemOperand(a2, Cell::kValueOffset));
+  __ sw(a3, FieldMemOperand(t1, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(a3);
 
   __ bind(&normal_sequence);
@@ -7401,7 +7421,7 @@
     ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
     T stub(kind);
     stub.GetCode(isolate)->set_is_pregenerated(true);
-    if (AllocationSiteInfo::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
+    if (AllocationSite::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
       T stub1(kind, CONTEXT_CHECK_REQUIRED, DISABLE_ALLOCATION_SITES);
       stub1.GetCode(isolate)->set_is_pregenerated(true);
     }
@@ -7442,10 +7462,6 @@
   //  -- sp[0] : return address
   //  -- sp[4] : last argument
   // -----------------------------------
-  Handle<Object> undefined_sentinel(
-      masm->isolate()->heap()->undefined_value(),
-      masm->isolate());
-
   if (FLAG_debug_code) {
     // The array construct code is only set for the global and natives
     // builtin Array functions which always have maps.
@@ -7460,10 +7476,11 @@
     __ Assert(eq, "Unexpected initial map for Array function",
         t0, Operand(MAP_TYPE));
 
-    // We should either have undefined in a2 or a valid cell
+    // We should either have undefined in a2 or a valid cell.
     Label okay_here;
     Handle<Map> cell_map = masm->isolate()->factory()->cell_map();
-    __ Branch(&okay_here, eq, a2, Operand(undefined_sentinel));
+    __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
+    __ Branch(&okay_here, eq, a2, Operand(at));
     __ lw(a3, FieldMemOperand(a2, 0));
     __ Assert(eq, "Expected property cell in register a2",
         a3, Operand(cell_map));
@@ -7472,9 +7489,20 @@
 
   Label no_info, switch_ready;
   // Get the elements kind and case on that.
-  __ Branch(&no_info, eq, a2, Operand(undefined_sentinel));
+  __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
+  __ Branch(&no_info, eq, a2, Operand(at));
   __ lw(a3, FieldMemOperand(a2, Cell::kValueOffset));
-  __ JumpIfNotSmi(a3, &no_info);
+
+  // The type cell may have undefined in its value.
+  __ LoadRoot(at, Heap::kUndefinedValueRootIndex);
+  __ Branch(&no_info, eq, a3, Operand(at));
+
+  // The type cell has either an AllocationSite or a JSFunction.
+  __ lw(t0, FieldMemOperand(a3, 0));
+  __ LoadRoot(at, Heap::kAllocationSiteMapRootIndex);
+  __ Branch(&no_info, ne, t0, Operand(at));
+
+  __ lw(a3, FieldMemOperand(a3, AllocationSite::kTransitionInfoOffset));
   __ SmiUntag(a3);
   __ jmp(&switch_ready);
   __ bind(&no_info);
diff --git a/src/mips/ic-mips.cc b/src/mips/ic-mips.cc
index 896e030..b500226 100644
--- a/src/mips/ic-mips.cc
+++ b/src/mips/ic-mips.cc
@@ -1261,8 +1261,8 @@
                                          t0,
                                          slow);
   ASSERT(receiver_map.is(a3));  // Transition code expects map in a3
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                        FAST_DOUBLE_ELEMENTS);
+  AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                    FAST_DOUBLE_ELEMENTS);
   ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, slow);
   __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
   __ jmp(&fast_double_without_map_check);
@@ -1275,7 +1275,7 @@
                                          t0,
                                          slow);
   ASSERT(receiver_map.is(a3));  // Transition code expects map in a3
-  mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateMapChangeElementsTransition(masm, mode,
                                                                    slow);
   __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
@@ -1291,7 +1291,7 @@
                                          t0,
                                          slow);
   ASSERT(receiver_map.is(a3));  // Transition code expects map in a3
-  mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, slow);
   __ lw(elements, FieldMemOperand(receiver, JSObject::kElementsOffset));
   __ jmp(&finish_object_store);
@@ -1495,8 +1495,8 @@
   // Must return the modified receiver in v0.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                          FAST_DOUBLE_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                      FAST_DOUBLE_ELEMENTS);
     ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, &fail);
     __ Ret(USE_DELAY_SLOT);
     __ mov(v0, a2);
@@ -1518,8 +1518,8 @@
   // Must return the modified receiver in v0.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS,
-                                                          FAST_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS,
+                                                      FAST_ELEMENTS);
     ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, &fail);
     __ Ret(USE_DELAY_SLOT);
     __ mov(v0, a2);
@@ -1541,8 +1541,9 @@
   // -----------------------------------
 
   // Get the receiver from the stack and probe the stub cache.
-  Code::Flags flags =
-      Code::ComputeFlags(Code::STORE_IC, MONOMORPHIC, strict_mode);
+  Code::Flags flags = Code::ComputeFlags(
+      Code::STUB, MONOMORPHIC, strict_mode,
+      Code::NORMAL, Code::STORE_IC);
   Isolate::Current()->stub_cache()->GenerateProbe(
       masm, flags, a1, a2, a3, t0, t1, t2);
 
diff --git a/src/mips/lithium-codegen-mips.cc b/src/mips/lithium-codegen-mips.cc
index 5dad77e..a096709 100644
--- a/src/mips/lithium-codegen-mips.cc
+++ b/src/mips/lithium-codegen-mips.cc
@@ -4064,7 +4064,7 @@
   __ li(a2, Operand(instr->hydrogen()->property_cell()));
   ElementsKind kind = instr->hydrogen()->elements_kind();
   AllocationSiteOverrideMode override_mode =
-      (AllocationSiteInfo::GetMode(kind) == TRACK_ALLOCATION_SITE)
+      (AllocationSite::GetMode(kind) == TRACK_ALLOCATION_SITE)
           ? DISABLE_ALLOCATION_SITES
           : DONT_OVERRIDE;
   ContextCheckMode context_mode = CONTEXT_CHECK_NOT_REQUIRED;
diff --git a/src/mips/stub-cache-mips.cc b/src/mips/stub-cache-mips.cc
index 5221190..b7ffb4f 100644
--- a/src/mips/stub-cache-mips.cc
+++ b/src/mips/stub-cache-mips.cc
@@ -429,89 +429,56 @@
 }
 
 
+void BaseStoreStubCompiler::GenerateNegativeHolderLookup(
+    MacroAssembler* masm,
+    Handle<JSObject> holder,
+    Register holder_reg,
+    Handle<Name> name,
+    Label* miss) {
+  if (holder->IsJSGlobalObject()) {
+    GenerateCheckPropertyCell(
+        masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+  } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
+    GenerateDictionaryNegativeLookup(
+        masm, miss, holder_reg, name, scratch1(), scratch2());
+  }
+}
+
+
 // Generate StoreTransition code, value is passed in a0 register.
 // After executing generated code, the receiver_reg and name_reg
 // may be clobbered.
-void StubCompiler::GenerateStoreTransition(MacroAssembler* masm,
-                                           Handle<JSObject> object,
-                                           LookupResult* lookup,
-                                           Handle<Map> transition,
-                                           Handle<Name> name,
-                                           Register receiver_reg,
-                                           Register name_reg,
-                                           Register value_reg,
-                                           Register scratch1,
-                                           Register scratch2,
-                                           Register scratch3,
-                                           Label* miss_label,
-                                           Label* miss_restore_name,
-                                           Label* slow) {
+void BaseStoreStubCompiler::GenerateStoreTransition(MacroAssembler* masm,
+                                                    Handle<JSObject> object,
+                                                    LookupResult* lookup,
+                                                    Handle<Map> transition,
+                                                    Handle<Name> name,
+                                                    Register receiver_reg,
+                                                    Register storage_reg,
+                                                    Register value_reg,
+                                                    Register scratch1,
+                                                    Register scratch2,
+                                                    Register scratch3,
+                                                    Label* miss_label,
+                                                    Label* slow) {
   // a0 : value.
   Label exit;
 
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, scratch1, Handle<Map>(object->map()), miss_label,
-              DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, miss_label);
-  }
-
   int descriptor = transition->LastAdded();
   DescriptorArray* descriptors = transition->instance_descriptors();
   PropertyDetails details = descriptors->GetDetails(descriptor);
   Representation representation = details.representation();
   ASSERT(!representation.IsNone());
 
-  // Ensure no transitions to deprecated maps are followed.
-  __ CheckMapDeprecated(transition, scratch1, miss_label);
-
-  // Check that we are allowed to write this.
-  if (object->GetPrototype()->IsJSObject()) {
-    JSObject* holder;
-    // holder == object indicates that no property was found.
-    if (lookup->holder() != *object) {
-      holder = lookup->holder();
-    } else {
-      // Find the top object.
-      holder = *object;
-      do {
-        holder = JSObject::cast(holder->GetPrototype());
-      } while (holder->GetPrototype()->IsJSObject());
-    }
-    Register holder_reg = CheckPrototypes(
-        object, receiver_reg, Handle<JSObject>(holder), name_reg,
-        scratch1, scratch2, name, miss_restore_name, SKIP_RECEIVER);
-    // If no property was found, and the holder (the last object in the
-    // prototype chain) is in slow mode, we need to do a negative lookup on the
-    // holder.
-    if (lookup->holder() == *object) {
-      if (holder->IsJSGlobalObject()) {
-        GenerateCheckPropertyCell(
-            masm,
-            Handle<GlobalObject>(GlobalObject::cast(holder)),
-            name,
-            scratch1,
-            miss_restore_name);
-      } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
-        GenerateDictionaryNegativeLookup(
-            masm, miss_restore_name, holder_reg, name, scratch1, scratch2);
-      }
-    }
-  }
-
-  Register storage_reg = name_reg;
-
   if (details.type() == CONSTANT_FUNCTION) {
     Handle<HeapObject> constant(
         HeapObject::cast(descriptors->GetValue(descriptor)));
     __ LoadHeapObject(scratch1, constant);
-    __ Branch(miss_restore_name, ne, value_reg, Operand(scratch1));
+    __ Branch(miss_label, ne, value_reg, Operand(scratch1));
   } else if (FLAG_track_fields && representation.IsSmi()) {
-    __ JumpIfNotSmi(value_reg, miss_restore_name);
+    __ JumpIfNotSmi(value_reg, miss_label);
   } else if (FLAG_track_heap_object_fields && representation.IsHeapObject()) {
-    __ JumpIfSmi(value_reg, miss_restore_name);
+    __ JumpIfSmi(value_reg, miss_label);
   } else if (FLAG_track_double_fields && representation.IsDouble()) {
     Label do_store, heap_number;
     __ LoadRoot(scratch3, Heap::kHeapNumberMapRootIndex);
@@ -525,7 +492,7 @@
 
     __ bind(&heap_number);
     __ CheckMap(value_reg, scratch1, Heap::kHeapNumberMapRootIndex,
-                miss_restore_name, DONT_DO_SMI_CHECK);
+                miss_label, DONT_DO_SMI_CHECK);
     __ ldc1(f4, FieldMemOperand(value_reg, HeapNumber::kValueOffset));
 
     __ bind(&do_store);
@@ -555,8 +522,7 @@
   __ li(scratch1, Operand(transition));
   __ sw(scratch1, FieldMemOperand(receiver_reg, HeapObject::kMapOffset));
 
-  // Update the write barrier for the map field and pass the now unused
-  // name_reg as scratch register.
+  // Update the write barrier for the map field.
   __ RecordWriteField(receiver_reg,
                       HeapObject::kMapOffset,
                       scratch1,
@@ -594,19 +560,13 @@
     }
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
-      // Skip updating write barrier if storing a smi.
-      __ JumpIfSmi(value_reg, &exit);
-
       // Update the write barrier for the array address.
-      // Pass the now unused name_reg as a scratch register.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ mov(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ mov(storage_reg, value_reg);
       }
       __ RecordWriteField(receiver_reg,
                           offset,
-                          name_reg,
+                          storage_reg,
                           scratch1,
                           kRAHasNotBeenSaved,
                           kDontSaveFPRegs,
@@ -626,19 +586,13 @@
     }
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
-      // Skip updating write barrier if storing a smi.
-      __ JumpIfSmi(value_reg, &exit);
-
       // Update the write barrier for the array address.
-      // Ok to clobber receiver_reg and name_reg, since we return.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ mov(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ mov(storage_reg, value_reg);
       }
       __ RecordWriteField(scratch1,
                           offset,
-                          name_reg,
+                          storage_reg,
                           receiver_reg,
                           kRAHasNotBeenSaved,
                           kDontSaveFPRegs,
@@ -659,27 +613,18 @@
 // When leaving generated code after success, the receiver_reg and name_reg
 // may be clobbered.  Upon branch to miss_label, the receiver and name
 // registers have their original values.
-void StubCompiler::GenerateStoreField(MacroAssembler* masm,
-                                      Handle<JSObject> object,
-                                      LookupResult* lookup,
-                                      Register receiver_reg,
-                                      Register name_reg,
-                                      Register value_reg,
-                                      Register scratch1,
-                                      Register scratch2,
-                                      Label* miss_label) {
+void BaseStoreStubCompiler::GenerateStoreField(MacroAssembler* masm,
+                                               Handle<JSObject> object,
+                                               LookupResult* lookup,
+                                               Register receiver_reg,
+                                               Register name_reg,
+                                               Register value_reg,
+                                               Register scratch1,
+                                               Register scratch2,
+                                               Label* miss_label) {
   // a0 : value
   Label exit;
 
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, scratch1, Handle<Map>(object->map()), miss_label,
-              DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, miss_label);
-  }
-
   // Stub never generated for non-global objects that require access
   // checks.
   ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
@@ -1348,7 +1293,8 @@
 }
 
 
-void BaseLoadStubCompiler::HandlerFrontendFooter(Label* success,
+void BaseLoadStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                 Label* success,
                                                  Label* miss) {
   if (!miss->is_unused()) {
     __ Branch(success);
@@ -1358,6 +1304,17 @@
 }
 
 
+void BaseStoreStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                  Label* success,
+                                                  Label* miss) {
+  if (!miss->is_unused()) {
+    __ b(success);
+    GenerateRestoreName(masm(), miss, name);
+    TailCallBuiltin(masm(), MissBuiltin(kind()));
+  }
+}
+
+
 Register BaseLoadStubCompiler::CallbackHandlerFrontend(
     Handle<JSObject> object,
     Register object_reg,
@@ -1399,7 +1356,7 @@
     __ Branch(&miss, ne, scratch2(), Operand(callback));
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
   return reg;
 }
 
@@ -1420,7 +1377,7 @@
     GenerateCheckPropertyCell(masm(), global, name, scratch2(), &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
 }
 
 
@@ -1744,11 +1701,11 @@
     GenerateLoadFunctionFromCell(cell, function, &miss);
   }
 
-  Handle<Smi> kind(Smi::FromInt(GetInitialFastElementsKind()), isolate());
-  Handle<Cell> kind_feedback_cell =
-      isolate()->factory()->NewCell(kind);
+  Handle<AllocationSite> site = isolate()->factory()->NewAllocationSite();
+  site->set_transition_info(Smi::FromInt(GetInitialFastElementsKind()));
+  Handle<Cell> site_feedback_cell = isolate()->factory()->NewCell(site);
   __ li(a0, Operand(argc));
-  __ li(a2, Operand(kind_feedback_cell));
+  __ li(a2, Operand(site_feedback_cell));
   __ li(a1, Operand(function));
 
   ArrayConstructorStub stub(isolate());
@@ -2866,15 +2823,13 @@
 
 
 Handle<Code> StoreStubCompiler::CompileStoreCallback(
-    Handle<Name> name,
     Handle<JSObject> object,
     Handle<JSObject> holder,
+    Handle<Name> name,
     Handle<ExecutableAccessorInfo> callback) {
-  Label miss;
-  // Check that the maps haven't changed.
-  __ JumpIfSmi(receiver(), &miss);
-  CheckPrototypes(object, receiver(), holder,
-                  scratch1(), scratch2(), scratch3(), name, &miss);
+  Label success;
+  HandlerFrontend(object, receiver(), holder, name, &success);
+  __ bind(&success);
 
   // Stub never generated for non-global objects that require access
   // checks.
@@ -2882,19 +2837,17 @@
 
   __ push(receiver());  // Receiver.
   __ li(at, Operand(callback));  // Callback info.
-  __ Push(at, this->name(), value());
+  __ push(at);
+  __ li(at, Operand(name));
+  __ Push(at, value());
 
   // Do tail-call to the runtime system.
   ExternalReference store_callback_property =
       ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate());
   __ TailCallExternalReference(store_callback_property, 4, 1);
 
-  // Handle store cache miss.
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
   // Return the generated code.
-  return GetICCode(kind(), Code::CALLBACKS, name);
+  return GetCode(kind(), Code::CALLBACKS, name);
 }
 
 
@@ -3144,7 +3097,7 @@
     __ Branch(&miss, eq, t0, Operand(at));
   }
 
-  HandlerFrontendFooter(&success, &miss);
+  HandlerFrontendFooter(name, &success, &miss);
   __ bind(&success);
 
   Counters* counters = isolate()->counters();
@@ -3157,7 +3110,7 @@
 }
 
 
-Handle<Code> BaseLoadStubCompiler::CompilePolymorphicIC(
+Handle<Code> BaseLoadStoreStubCompiler::CompilePolymorphicIC(
     MapHandleList* receiver_maps,
     CodeHandleList* handlers,
     Handle<Name> name,
diff --git a/src/objects-debug.cc b/src/objects-debug.cc
index a7189c5..b42a35a 100644
--- a/src/objects-debug.cc
+++ b/src/objects-debug.cc
@@ -914,10 +914,15 @@
 }
 
 
+void AllocationSite::AllocationSiteVerify() {
+  CHECK(IsAllocationSite());
+}
+
+
 void AllocationSiteInfo::AllocationSiteInfoVerify() {
   CHECK(IsAllocationSiteInfo());
-  VerifyHeapPointer(payload());
-  CHECK(payload()->IsObject());
+  VerifyHeapPointer(allocation_site());
+  CHECK(!IsValid() || GetAllocationSite()->IsAllocationSite());
 }
 
 
diff --git a/src/objects-inl.h b/src/objects-inl.h
index 61ae90e..f251129 100644
--- a/src/objects-inl.h
+++ b/src/objects-inl.h
@@ -1311,7 +1311,7 @@
       return true;
     }
 
-    return AllocationSiteInfo::GetMode(GetElementsKind()) ==
+    return AllocationSite::GetMode(GetElementsKind()) ==
         TRACK_ALLOCATION_SITE;
   }
   return false;
@@ -1320,7 +1320,7 @@
 
 // Heuristic: We only need to create allocation site info if the boilerplate
 // elements kind is the initial elements kind.
-AllocationSiteMode AllocationSiteInfo::GetMode(
+AllocationSiteMode AllocationSite::GetMode(
     ElementsKind boilerplate_elements_kind) {
   if (FLAG_track_allocation_sites &&
       IsFastSmiElementsKind(boilerplate_elements_kind)) {
@@ -1331,8 +1331,8 @@
 }
 
 
-AllocationSiteMode AllocationSiteInfo::GetMode(ElementsKind from,
-                                               ElementsKind to) {
+AllocationSiteMode AllocationSite::GetMode(ElementsKind from,
+                                           ElementsKind to) {
   if (FLAG_track_allocation_sites &&
       IsFastSmiElementsKind(from) &&
       (IsFastObjectElementsKind(to) || IsFastDoubleElementsKind(to))) {
@@ -4448,7 +4448,8 @@
 
 ACCESSORS(TypeSwitchInfo, types, Object, kTypesOffset)
 
-ACCESSORS(AllocationSiteInfo, payload, Object, kPayloadOffset)
+ACCESSORS(AllocationSite, transition_info, Object, kTransitionInfoOffset)
+ACCESSORS(AllocationSiteInfo, allocation_site, Object, kAllocationSiteOffset)
 
 ACCESSORS(Script, source, Object, kSourceOffset)
 ACCESSORS(Script, name, Object, kNameOffset)
diff --git a/src/objects-printer.cc b/src/objects-printer.cc
index 1fae69b..db324d0 100644
--- a/src/objects-printer.cc
+++ b/src/objects-printer.cc
@@ -1117,11 +1117,11 @@
 }
 
 
-void AllocationSiteInfo::AllocationSiteInfoPrint(FILE* out) {
-  HeapObject::PrintHeader(out, "AllocationSiteInfo");
-  PrintF(out, " - payload: ");
-  if (payload()->IsCell()) {
-    Cell* cell = Cell::cast(payload());
+void AllocationSite::AllocationSitePrint(FILE* out) {
+  HeapObject::PrintHeader(out, "AllocationSite");
+  PrintF(out, " - transition_info: ");
+  if (transition_info()->IsCell()) {
+    Cell* cell = Cell::cast(transition_info());
     Object* cell_contents = cell->value();
     if (cell_contents->IsSmi()) {
       ElementsKind kind = static_cast<ElementsKind>(
@@ -1131,19 +1131,30 @@
       PrintF(out, "\n");
       return;
     }
-  } else if (payload()->IsJSArray()) {
+  } else if (transition_info()->IsJSArray()) {
     PrintF(out, "Array literal ");
-    payload()->ShortPrint(out);
+    transition_info()->ShortPrint(out);
     PrintF(out, "\n");
     return;
   }
 
-  PrintF(out, "unknown payload ");
-  payload()->ShortPrint(out);
+  PrintF(out, "unknown transition_info");
+  transition_info()->ShortPrint(out);
   PrintF(out, "\n");
 }
 
 
+void AllocationSiteInfo::AllocationSiteInfoPrint(FILE* out) {
+  HeapObject::PrintHeader(out, "AllocationSiteInfo");
+  PrintF(out, " - allocation site: ");
+  if (IsValid()) {
+    GetAllocationSite()->Print();
+  } else {
+    PrintF(out, "<invalid>\n");
+  }
+}
+
+
 void Script::ScriptPrint(FILE* out) {
   HeapObject::PrintHeader(out, "Script");
   PrintF(out, "\n - source: ");
diff --git a/src/objects.cc b/src/objects.cc
index 2611b57..df042a1 100644
--- a/src/objects.cc
+++ b/src/objects.cc
@@ -8865,21 +8865,6 @@
 }
 
 
-bool AllocationSiteInfo::GetElementsKindPayload(ElementsKind* kind) {
-  ASSERT(kind != NULL);
-  if (payload()->IsCell()) {
-    Cell* cell = Cell::cast(payload());
-    Object* cell_contents = cell->value();
-    if (cell_contents->IsSmi()) {
-      *kind = static_cast<ElementsKind>(
-          Smi::cast(cell_contents)->value());
-      return true;
-    }
-  }
-  return false;
-}
-
-
 uint32_t StringHasher::MakeArrayIndexHash(uint32_t value, int length) {
   // For array indexes mix the length into the hash as an array index could
   // be zero.
@@ -9175,7 +9160,6 @@
 void JSFunction::MarkForInstallingRecompiledCode() {
   // The debugger could have switched the builtin to lazy compile.
   // In that case, simply carry on.  It will be dealt with later.
-  ASSERT(IsInRecompileQueue() || GetIsolate()->DebuggerHasBreakPoints());
   ASSERT(!IsOptimized());
   ASSERT(shared()->allows_lazy_compilation() || code()->optimizable());
   ASSERT(FLAG_parallel_recompilation);
@@ -10270,7 +10254,11 @@
         TypeFeedbackInfo::cast(raw_info)->type_feedback_cells();
     for (int i = 0; i < type_feedback_cells->CellCount(); i++) {
       Cell* cell = type_feedback_cells->GetCell(i);
-      cell->set_value(TypeFeedbackCells::RawUninitializedSentinel(heap));
+      // Don't clear AllocationSites
+      Object* value = cell->value();
+      if (value == NULL || !value->IsAllocationSite()) {
+        cell->set_value(TypeFeedbackCells::RawUninitializedSentinel(heap));
+      }
     }
   }
 }
@@ -11735,7 +11723,7 @@
         ? FAST_HOLEY_DOUBLE_ELEMENTS
         : FAST_DOUBLE_ELEMENTS;
 
-    MaybeObject* maybe_failure = UpdateAllocationSiteInfo(to_kind);
+    MaybeObject* maybe_failure = UpdateAllocationSite(to_kind);
     if (maybe_failure->IsFailure()) return maybe_failure;
 
     MaybeObject* maybe =
@@ -11752,7 +11740,7 @@
         ? FAST_HOLEY_ELEMENTS
         : FAST_ELEMENTS;
 
-    MaybeObject* maybe_failure = UpdateAllocationSiteInfo(kind);
+    MaybeObject* maybe_failure = UpdateAllocationSite(kind);
     if (maybe_failure->IsFailure()) return maybe_failure;
 
     MaybeObject* maybe_new_map = GetElementsTransitionMap(GetIsolate(),
@@ -12315,50 +12303,47 @@
 }
 
 
-MaybeObject* JSObject::UpdateAllocationSiteInfo(ElementsKind to_kind) {
+MaybeObject* JSObject::UpdateAllocationSite(ElementsKind to_kind) {
   if (!FLAG_track_allocation_sites || !IsJSArray()) {
     return this;
   }
 
   AllocationSiteInfo* info = AllocationSiteInfo::FindForJSObject(this);
-  if (info == NULL) {
+  if (info == NULL || !info->IsValid()) {
     return this;
   }
 
-  if (info->payload()->IsJSArray()) {
-    JSArray* payload = JSArray::cast(info->payload());
-    ElementsKind kind = payload->GetElementsKind();
-    if (AllocationSiteInfo::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
+  // Walk through to the Allocation Site
+  AllocationSite* site = info->GetAllocationSite();
+  if (site->IsLiteralSite()) {
+    JSArray* transition_info = JSArray::cast(site->transition_info());
+    ElementsKind kind = transition_info->GetElementsKind();
+    if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
       // If the array is huge, it's not likely to be defined in a local
       // function, so we shouldn't make new instances of it very often.
       uint32_t length = 0;
-      CHECK(payload->length()->ToArrayIndex(&length));
-      if (length <= AllocationSiteInfo::kMaximumArrayBytesToPretransition) {
+      CHECK(transition_info->length()->ToArrayIndex(&length));
+      if (length <= AllocationSite::kMaximumArrayBytesToPretransition) {
         if (FLAG_trace_track_allocation_sites) {
           PrintF(
-              "AllocationSiteInfo: JSArray %p boilerplate updated %s->%s\n",
+              "AllocationSite: JSArray %p boilerplate updated %s->%s\n",
               reinterpret_cast<void*>(this),
               ElementsKindToString(kind),
               ElementsKindToString(to_kind));
         }
-        return payload->TransitionElementsKind(to_kind);
+        return transition_info->TransitionElementsKind(to_kind);
       }
     }
-  } else if (info->payload()->IsCell()) {
-    Cell* cell = Cell::cast(info->payload());
-    Object* cell_contents = cell->value();
-    if (cell_contents->IsSmi()) {
-      ElementsKind kind = static_cast<ElementsKind>(
-          Smi::cast(cell_contents)->value());
-      if (AllocationSiteInfo::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
-        if (FLAG_trace_track_allocation_sites) {
-          PrintF("AllocationSiteInfo: JSArray %p info updated %s->%s\n",
-                 reinterpret_cast<void*>(this),
-                 ElementsKindToString(kind),
-                 ElementsKindToString(to_kind));
-        }
-        cell->set_value(Smi::FromInt(to_kind));
+  } else {
+    ElementsKind kind = site->GetElementsKind();
+    if (AllocationSite::GetMode(kind, to_kind) == TRACK_ALLOCATION_SITE) {
+      if (FLAG_trace_track_allocation_sites) {
+        PrintF("AllocationSite: JSArray %p site updated %s->%s\n",
+               reinterpret_cast<void*>(this),
+               ElementsKindToString(kind),
+               ElementsKindToString(to_kind));
       }
+      site->set_transition_info(Smi::FromInt(to_kind));
     }
   }
   return this;
@@ -12375,7 +12360,7 @@
 
   if (from_kind == to_kind) return this;
 
-  MaybeObject* maybe_failure = UpdateAllocationSiteInfo(to_kind);
+  MaybeObject* maybe_failure = UpdateAllocationSite(to_kind);
   if (maybe_failure->IsFailure()) return maybe_failure;
 
   Isolate* isolate = GetIsolate();
@@ -15864,8 +15849,8 @@
         &PropertyCell::UpdateType,
         Handle<PropertyCell>(this),
         Handle<Object>(value, GetIsolate()));
-    if (maybe_type->IsFailure()) return maybe_type;
-    Type* new_type = static_cast<Type*>(maybe_type);
+    Type* new_type = NULL;
+    if (!maybe_type->To(&new_type)) return maybe_type;
     set_type(new_type);
   }
   return value;
diff --git a/src/objects.h b/src/objects.h
index eb6d882..470d8e8 100644
--- a/src/objects.h
+++ b/src/objects.h
@@ -387,6 +387,7 @@
   V(SIGNATURE_INFO_TYPE)                                                       \
   V(TYPE_SWITCH_INFO_TYPE)                                                     \
   V(ALLOCATION_SITE_INFO_TYPE)                                                 \
+  V(ALLOCATION_SITE_TYPE)                                                      \
   V(SCRIPT_TYPE)                                                               \
   V(CODE_CACHE_TYPE)                                                           \
   V(POLYMORPHIC_CODE_CACHE_TYPE)                                               \
@@ -550,6 +551,7 @@
   V(SIGNATURE_INFO, SignatureInfo, signature_info)                             \
   V(TYPE_SWITCH_INFO, TypeSwitchInfo, type_switch_info)                        \
   V(SCRIPT, Script, script)                                                    \
+  V(ALLOCATION_SITE, AllocationSite, allocation_site)                          \
   V(ALLOCATION_SITE_INFO, AllocationSiteInfo, allocation_site_info)            \
   V(CODE_CACHE, CodeCache, code_cache)                                         \
   V(POLYMORPHIC_CODE_CACHE, PolymorphicCodeCache, polymorphic_code_cache)      \
@@ -709,6 +711,7 @@
   OBJECT_TEMPLATE_INFO_TYPE,
   SIGNATURE_INFO_TYPE,
   TYPE_SWITCH_INFO_TYPE,
+  ALLOCATION_SITE_TYPE,
   ALLOCATION_SITE_INFO_TYPE,
   SCRIPT_TYPE,
   CODE_CACHE_TYPE,
@@ -2210,8 +2213,7 @@
                                                ElementsKind to_kind);
 
   MUST_USE_RESULT MaybeObject* TransitionElementsKind(ElementsKind to_kind);
-  MUST_USE_RESULT MaybeObject* UpdateAllocationSiteInfo(
-      ElementsKind to_kind);
+  MUST_USE_RESULT MaybeObject* UpdateAllocationSite(ElementsKind to_kind);
 
   // Replaces an existing transition with a transition to a map with a FIELD.
   MUST_USE_RESULT MaybeObject* ConvertTransitionToMapTransition(
@@ -7461,26 +7463,67 @@
 };
 
 
+class AllocationSite: public Struct {
+ public:
+  static const int kTransitionInfoOffset = HeapObject::kHeaderSize;
+  static const int kSize = kTransitionInfoOffset + kPointerSize;
+  static const uint32_t kMaximumArrayBytesToPretransition = 8 * 1024;
+
+  DECL_ACCESSORS(transition_info, Object)
+
+  void Initialize() {
+    SetElementsKind(GetInitialFastElementsKind());
+  }
+
+  ElementsKind GetElementsKind() {
+    ASSERT(!IsLiteralSite());
+    return static_cast<ElementsKind>(Smi::cast(transition_info())->value());
+  }
+
+  void SetElementsKind(ElementsKind kind) {
+    set_transition_info(Smi::FromInt(static_cast<int>(kind)));
+  }
+
+  bool IsLiteralSite() {
+    // If transition_info is a smi, then it represents an ElementsKind
+    // for a constructed array. Otherwise, it must be a boilerplate
+    // for an array literal
+    return transition_info()->IsJSArray();
+  }
+
+  DECLARE_PRINTER(AllocationSite)
+  DECLARE_VERIFIER(AllocationSite)
+
+  static inline AllocationSite* cast(Object* obj);
+  static inline AllocationSiteMode GetMode(
+      ElementsKind boilerplate_elements_kind);
+  static inline AllocationSiteMode GetMode(ElementsKind from, ElementsKind to);
+
+ private:
+  DISALLOW_IMPLICIT_CONSTRUCTORS(AllocationSite);
+};
+
+
 class AllocationSiteInfo: public Struct {
  public:
-  DECL_ACCESSORS(payload, Object)
+  static const int kAllocationSiteOffset = HeapObject::kHeaderSize;
+  static const int kSize = kAllocationSiteOffset + kPointerSize;
 
-  static inline AllocationSiteInfo* cast(Object* obj);
+  DECL_ACCESSORS(allocation_site, Object)
+
+  bool IsValid() { return allocation_site()->IsAllocationSite(); }
+  AllocationSite* GetAllocationSite() {
+    ASSERT(IsValid());
+    return AllocationSite::cast(allocation_site());
+  }
 
   DECLARE_PRINTER(AllocationSiteInfo)
   DECLARE_VERIFIER(AllocationSiteInfo)
 
   // Returns NULL if no AllocationSiteInfo is available for object.
   static AllocationSiteInfo* FindForJSObject(JSObject* object);
-  static inline AllocationSiteMode GetMode(
-      ElementsKind boilerplate_elements_kind);
-  static inline AllocationSiteMode GetMode(ElementsKind from, ElementsKind to);
+  static inline AllocationSiteInfo* cast(Object* obj);
 
-  static const int kPayloadOffset = HeapObject::kHeaderSize;
-  static const int kSize = kPayloadOffset + kPointerSize;
-  static const uint32_t kMaximumArrayBytesToPretransition = 8 * 1024;
-
-  bool GetElementsKindPayload(ElementsKind* kind);
  private:
   DISALLOW_IMPLICIT_CONSTRUCTORS(AllocationSiteInfo);
 };
diff --git a/src/runtime.cc b/src/runtime.cc
index 81018fe..6e04560 100644
--- a/src/runtime.cc
+++ b/src/runtime.cc
@@ -501,6 +501,30 @@
 }
 
 
+static Handle<AllocationSite> GetLiteralAllocationSite(
+    Isolate* isolate,
+    Handle<FixedArray> literals,
+    int literals_index,
+    Handle<FixedArray> elements) {
+  // Check if boilerplate exists. If not, create it first.
+  Handle<Object> literal_site(literals->get(literals_index), isolate);
+  Handle<AllocationSite> site;
+  if (*literal_site == isolate->heap()->undefined_value()) {
+    ASSERT(*elements != isolate->heap()->empty_fixed_array());
+    Handle<Object> boilerplate =
+        Runtime::CreateArrayLiteralBoilerplate(isolate, literals, elements);
+    if (boilerplate.is_null()) return site;
+    site = isolate->factory()->NewAllocationSite();
+    site->set_transition_info(*boilerplate);
+    literals->set(literals_index, *site);
+  } else {
+    site = Handle<AllocationSite>::cast(literal_site);
+  }
+
+  return site;
+}
+
+
 RUNTIME_FUNCTION(MaybeObject*, Runtime_CreateArrayLiteral) {
   HandleScope scope(isolate);
   ASSERT(args.length() == 3);
@@ -508,17 +532,12 @@
   CONVERT_SMI_ARG_CHECKED(literals_index, 1);
   CONVERT_ARG_HANDLE_CHECKED(FixedArray, elements, 2);
 
-  // Check if boilerplate exists. If not, create it first.
-  Handle<Object> boilerplate(literals->get(literals_index), isolate);
-  if (*boilerplate == isolate->heap()->undefined_value()) {
-    ASSERT(*elements != isolate->heap()->empty_fixed_array());
-    boilerplate =
-        Runtime::CreateArrayLiteralBoilerplate(isolate, literals, elements);
-    RETURN_IF_EMPTY_HANDLE(isolate, boilerplate);
-    // Update the functions literal and return the boilerplate.
-    literals->set(literals_index, *boilerplate);
-  }
-  return JSObject::cast(*boilerplate)->DeepCopy(isolate);
+  Handle<AllocationSite> site = GetLiteralAllocationSite(isolate, literals,
+      literals_index, elements);
+  RETURN_IF_EMPTY_HANDLE(isolate, site);
+
+  JSObject* boilerplate = JSObject::cast(site->transition_info());
+  return boilerplate->DeepCopy(isolate);
 }
 
 
@@ -529,29 +548,24 @@
   CONVERT_SMI_ARG_CHECKED(literals_index, 1);
   CONVERT_ARG_HANDLE_CHECKED(FixedArray, elements, 2);
 
-  // Check if boilerplate exists. If not, create it first.
-  Handle<Object> boilerplate(literals->get(literals_index), isolate);
-  if (*boilerplate == isolate->heap()->undefined_value()) {
-    ASSERT(*elements != isolate->heap()->empty_fixed_array());
-    boilerplate =
-        Runtime::CreateArrayLiteralBoilerplate(isolate, literals, elements);
-    RETURN_IF_EMPTY_HANDLE(isolate, boilerplate);
-    // Update the functions literal and return the boilerplate.
-    literals->set(literals_index, *boilerplate);
-  }
-  if (JSObject::cast(*boilerplate)->elements()->map() ==
+  Handle<AllocationSite> site = GetLiteralAllocationSite(isolate, literals,
+      literals_index, elements);
+  RETURN_IF_EMPTY_HANDLE(isolate, site);
+
+  JSObject* boilerplate = JSObject::cast(site->transition_info());
+  if (boilerplate->elements()->map() ==
       isolate->heap()->fixed_cow_array_map()) {
     isolate->counters()->cow_arrays_created_runtime()->Increment();
   }
 
-  JSObject* boilerplate_object = JSObject::cast(*boilerplate);
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(
-      boilerplate_object->GetElementsKind());
+  AllocationSiteMode mode = AllocationSite::GetMode(
+      boilerplate->GetElementsKind());
   if (mode == TRACK_ALLOCATION_SITE) {
-    return isolate->heap()->CopyJSObjectWithAllocationSite(boilerplate_object);
+    return isolate->heap()->CopyJSObjectWithAllocationSite(
+        boilerplate, *site);
   }
 
-  return isolate->heap()->CopyJSObject(boilerplate_object);
+  return isolate->heap()->CopyJSObject(boilerplate);
 }
 
 
@@ -5203,8 +5217,15 @@
   CONVERT_ARG_HANDLE_CHECKED(FixedArray, literals, 3);
   CONVERT_SMI_ARG_CHECKED(literal_index, 4);
 
-  Object* raw_boilerplate_object = literals->get(literal_index);
-  Handle<JSArray> boilerplate_object(JSArray::cast(raw_boilerplate_object));
+  Object* raw_literal_cell = literals->get(literal_index);
+  JSArray* boilerplate = NULL;
+  if (raw_literal_cell->IsAllocationSite()) {
+    AllocationSite* site = AllocationSite::cast(raw_literal_cell);
+    boilerplate = JSArray::cast(site->transition_info());
+  } else {
+    boilerplate = JSArray::cast(raw_literal_cell);
+  }
+  Handle<JSArray> boilerplate_object(boilerplate);
   ElementsKind elements_kind = object->GetElementsKind();
   ASSERT(IsFastElementsKind(elements_kind));
   // Smis should never trigger transitions.
@@ -11040,7 +11061,7 @@
   Handle<Object> receiver(it.frame()->receiver(), isolate);
   if (!receiver->IsJSObject() &&
       shared->is_classic_mode() &&
-      !shared->native()) {
+      !function->IsBuiltin()) {
     // If the receiver is not a JSObject and the function is not a
     // builtin or strict-mode we have hit an optimization where a
     // value object is not converted into a wrapped JS objects. To
@@ -11050,6 +11071,7 @@
     it.Advance();
     Handle<Context> calling_frames_native_context(
         Context::cast(Context::cast(it.frame()->context())->native_context()));
+    ASSERT(!receiver->IsUndefined() && !receiver->IsNull());
     receiver =
         isolate->factory()->ToObject(receiver, calling_frames_native_context);
   }
@@ -13818,19 +13840,21 @@
   MaybeObject* maybe_array;
   if (!type_info.is_null() &&
       *type_info != isolate->heap()->undefined_value() &&
-      Cell::cast(*type_info)->value()->IsSmi() &&
+      Cell::cast(*type_info)->value()->IsAllocationSite() &&
       can_use_type_feedback) {
-    Cell* cell = Cell::cast(*type_info);
-    Smi* smi = Smi::cast(cell->value());
-    ElementsKind to_kind = static_cast<ElementsKind>(smi->value());
+    Handle<Cell> cell = Handle<Cell>::cast(type_info);
+    Handle<AllocationSite> site = Handle<AllocationSite>(
+        AllocationSite::cast(cell->value()), isolate);
+    ASSERT(!site->IsLiteralSite());
+    ElementsKind to_kind = site->GetElementsKind();
     if (holey && !IsFastHoleyElementsKind(to_kind)) {
       to_kind = GetHoleyElementsKind(to_kind);
       // Update the allocation site info to reflect the advice alteration.
-      cell->set_value(Smi::FromInt(to_kind));
+      site->SetElementsKind(to_kind);
     }
 
     maybe_array = isolate->heap()->AllocateJSObjectWithAllocationSite(
-        *constructor, type_info);
+        *constructor, site);
     if (!maybe_array->To(&array)) return maybe_array;
   } else {
     maybe_array = isolate->heap()->AllocateJSObject(*constructor);
diff --git a/src/sampler.cc b/src/sampler.cc
index e86cb68..222b318 100644
--- a/src/sampler.cc
+++ b/src/sampler.cc
@@ -658,7 +658,8 @@
       interval_(interval),
       profiling_(false),
       active_(false),
-      samples_taken_(0) {
+      is_counting_samples_(false),
+      js_and_external_sample_count_(0) {
   data_ = new PlatformData;
 }
 
@@ -688,7 +689,11 @@
   TickSample sample_obj;
   if (sample == NULL) sample = &sample_obj;
   sample->Init(isolate_, state);
-  if (++samples_taken_ < 0) samples_taken_ = 0;
+  if (is_counting_samples_) {
+    if (sample->state == JS || sample->state == EXTERNAL) {
+      ++js_and_external_sample_count_;
+    }
+  }
   Tick(sample);
 }
 
diff --git a/src/sampler.h b/src/sampler.h
index a47a363..80ccc08 100644
--- a/src/sampler.h
+++ b/src/sampler.h
@@ -103,8 +103,13 @@
   bool IsActive() const { return NoBarrier_Load(&active_); }
 
   // Used in tests to make sure that stack sampling is performed.
-  int samples_taken() const { return samples_taken_; }
-  void ResetSamplesTaken() { samples_taken_ = 0; }
+  unsigned js_and_external_sample_count() const {
+    return js_and_external_sample_count_;
+  }
+  void StartCountingSamples() {
+      is_counting_samples_ = true;
+      js_and_external_sample_count_ = 0;
+  }
 
   class PlatformData;
   PlatformData* platform_data() const { return data_; }
@@ -122,7 +127,9 @@
   Atomic32 profiling_;
   Atomic32 active_;
   PlatformData* data_;  // Platform specific data.
-  int samples_taken_;  // Counts stack samples taken.
+  bool is_counting_samples_;
+  // Counts stack samples taken in JS VM state.
+  unsigned js_and_external_sample_count_;
   DISALLOW_IMPLICIT_CONSTRUCTORS(Sampler);
 };
 
diff --git a/src/stub-cache.cc b/src/stub-cache.cc
index 0ccd5e6..a687d81 100644
--- a/src/stub-cache.cc
+++ b/src/stub-cache.cc
@@ -133,11 +133,11 @@
 }
 
 
-Handle<Code> StubCache::FindHandler(Handle<Name> name,
-                                    Handle<JSObject> receiver,
-                                    Handle<JSObject> stub_holder,
-                                    Code::Kind kind,
-                                    Code::StubType type) {
+Handle<Code> StubCache::FindLoadHandler(Handle<Name> name,
+                                        Handle<JSObject> receiver,
+                                        Handle<JSObject> stub_holder,
+                                        Code::Kind kind,
+                                        Code::StubType type) {
   Code::ExtraICState extra_ic_state = Code::ComputeExtraICState(
       receiver.is_identical_to(stub_holder) ? Code::OWN_STUB
                                             : Code::PROTOTYPE_STUB);
@@ -151,9 +151,26 @@
 }
 
 
-Handle<Code> StubCache::ComputeMonomorphicIC(Handle<JSObject> receiver,
-                                             Handle<Code> handler,
-                                             Handle<Name> name) {
+Handle<Code> StubCache::FindStoreHandler(Handle<Name> name,
+                                         Handle<JSObject> receiver,
+                                         Code::Kind kind,
+                                         Code::StubType type,
+                                         StrictModeFlag strict_mode) {
+  Code::ExtraICState extra_ic_state = Code::ComputeExtraICState(
+      STANDARD_STORE, strict_mode);
+  ASSERT(type != Code::NORMAL);
+  Code::Flags flags = Code::ComputeMonomorphicFlags(
+      Code::STUB, extra_ic_state, type, kind);
+  Handle<Object> probe(receiver->map()->FindInCodeCache(*name, flags),
+                       isolate_);
+  if (probe->IsCode()) return Handle<Code>::cast(probe);
+  return Handle<Code>::null();
+}
+
+
+Handle<Code> StubCache::ComputeMonomorphicLoadIC(Handle<JSObject> receiver,
+                                                 Handle<Code> handler,
+                                                 Handle<Name> name) {
   Handle<Code> ic = FindIC(name, receiver, Code::LOAD_IC, handler->type());
   if (!ic.is_null()) return ic;
 
@@ -166,9 +183,9 @@
 }
 
 
-Handle<Code> StubCache::ComputeKeyedMonomorphicIC(Handle<JSObject> receiver,
-                                                  Handle<Code> handler,
-                                                  Handle<Name> name) {
+Handle<Code> StubCache::ComputeMonomorphicKeyedLoadIC(Handle<JSObject> receiver,
+                                                      Handle<Code> handler,
+                                                      Handle<Name> name) {
   Handle<Code> ic = FindIC(
       name, receiver, Code::KEYED_LOAD_IC, handler->type());
   if (!ic.is_null()) return ic;
@@ -182,6 +199,41 @@
 }
 
 
+Handle<Code> StubCache::ComputeMonomorphicStoreIC(Handle<JSObject> receiver,
+                                                  Handle<Code> handler,
+                                                  Handle<Name> name,
+                                                  StrictModeFlag strict_mode) {
+  Handle<Code> ic = FindIC(
+      name, receiver, Code::STORE_IC, handler->type(), strict_mode);
+  if (!ic.is_null()) return ic;
+
+  StoreStubCompiler ic_compiler(isolate(), strict_mode);
+  ic = ic_compiler.CompileMonomorphicIC(
+      Handle<Map>(receiver->map()), handler, name);
+
+  JSObject::UpdateMapCodeCache(receiver, name, ic);
+  return ic;
+}
+
+
+Handle<Code> StubCache::ComputeMonomorphicKeyedStoreIC(
+    Handle<JSObject> receiver,
+    Handle<Code> handler,
+    Handle<Name> name,
+    StrictModeFlag strict_mode) {
+  Handle<Code> ic = FindIC(
+      name, receiver, Code::KEYED_STORE_IC, handler->type(), strict_mode);
+  if (!ic.is_null()) return ic;
+
+  KeyedStoreStubCompiler ic_compiler(isolate(), strict_mode, STANDARD_STORE);
+  ic = ic_compiler.CompileMonomorphicIC(
+      Handle<Map>(receiver->map()), handler, name);
+
+  JSObject::UpdateMapCodeCache(receiver, name, ic);
+  return ic;
+}
+
+
 Handle<Code> StubCache::ComputeLoadNonexistent(Handle<Name> name,
                                                Handle<JSObject> receiver) {
   // If no global objects are present in the prototype chain, the load
@@ -207,7 +259,7 @@
 
   // Compile the stub that is either shared for all names or
   // name specific if there are global objects involved.
-  Handle<Code> handler = FindHandler(
+  Handle<Code> handler = FindLoadHandler(
       cache_name, receiver, receiver, Code::LOAD_IC, Code::NONEXISTENT);
   if (!handler.is_null()) return handler;
 
@@ -232,7 +284,7 @@
   }
 
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::LOAD_IC, Code::FIELD);
   if (!stub.is_null()) return stub;
 
@@ -251,7 +303,7 @@
     Handle<ExecutableAccessorInfo> callback) {
   ASSERT(v8::ToCData<Address>(callback->getter()) != 0);
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::LOAD_IC, Code::CALLBACKS);
   if (!stub.is_null()) return stub;
 
@@ -268,7 +320,7 @@
                                              Handle<JSObject> holder,
                                              Handle<JSFunction> getter) {
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::LOAD_IC, Code::CALLBACKS);
   if (!stub.is_null()) return stub;
 
@@ -285,7 +337,7 @@
                                             Handle<JSObject> holder,
                                             Handle<JSFunction> value) {
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> handler = FindHandler(
+  Handle<Code> handler = FindLoadHandler(
       name, receiver, stub_holder, Code::LOAD_IC, Code::CONSTANT_FUNCTION);
   if (!handler.is_null()) return handler;
 
@@ -301,7 +353,7 @@
                                                Handle<JSObject> receiver,
                                                Handle<JSObject> holder) {
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::LOAD_IC, Code::INTERCEPTOR);
   if (!stub.is_null()) return stub;
 
@@ -350,7 +402,7 @@
   }
 
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::KEYED_LOAD_IC, Code::FIELD);
   if (!stub.is_null()) return stub;
 
@@ -367,7 +419,7 @@
                                                  Handle<JSObject> holder,
                                                  Handle<JSFunction> value) {
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> handler = FindHandler(
+  Handle<Code> handler = FindLoadHandler(
       name, receiver, stub_holder, Code::KEYED_LOAD_IC,
       Code::CONSTANT_FUNCTION);
   if (!handler.is_null()) return handler;
@@ -383,7 +435,7 @@
                                                     Handle<JSObject> receiver,
                                                     Handle<JSObject> holder) {
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::KEYED_LOAD_IC, Code::INTERCEPTOR);
   if (!stub.is_null()) return stub;
 
@@ -401,7 +453,7 @@
     Handle<JSObject> holder,
     Handle<ExecutableAccessorInfo> callback) {
   Handle<JSObject> stub_holder = StubHolder(receiver, holder);
-  Handle<Code> stub = FindHandler(
+  Handle<Code> stub = FindLoadHandler(
       name, receiver, stub_holder, Code::KEYED_LOAD_IC, Code::CALLBACKS);
   if (!stub.is_null()) return stub;
 
@@ -417,14 +469,14 @@
                                           Handle<JSObject> receiver,
                                           LookupResult* lookup,
                                           StrictModeFlag strict_mode) {
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::STORE_IC, Code::FIELD, strict_mode);
   if (!stub.is_null()) return stub;
 
   StoreStubCompiler compiler(isolate_, strict_mode);
-  Handle<Code> code = compiler.CompileStoreField(receiver, lookup, name);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  Handle<Code> handler = compiler.CompileStoreField(receiver, lookup, name);
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
@@ -433,15 +485,15 @@
                                                LookupResult* lookup,
                                                Handle<Map> transition,
                                                StrictModeFlag strict_mode) {
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::STORE_IC, Code::MAP_TRANSITION, strict_mode);
   if (!stub.is_null()) return stub;
 
   StoreStubCompiler compiler(isolate_, strict_mode);
-  Handle<Code> code =
+  Handle<Code> handler =
       compiler.CompileStoreTransition(receiver, lookup, transition, name);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
@@ -534,15 +586,15 @@
     Handle<ExecutableAccessorInfo> callback,
     StrictModeFlag strict_mode) {
   ASSERT(v8::ToCData<Address>(callback->setter()) != 0);
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::STORE_IC, Code::CALLBACKS, strict_mode);
   if (!stub.is_null()) return stub;
 
   StoreStubCompiler compiler(isolate_, strict_mode);
-  Handle<Code> code =
-      compiler.CompileStoreCallback(name, receiver, holder, callback);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  Handle<Code> handler = compiler.CompileStoreCallback(
+      receiver, holder, name, callback);
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
@@ -551,29 +603,29 @@
                                               Handle<JSObject> holder,
                                               Handle<JSFunction> setter,
                                               StrictModeFlag strict_mode) {
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::STORE_IC, Code::CALLBACKS, strict_mode);
   if (!stub.is_null()) return stub;
 
   StoreStubCompiler compiler(isolate_, strict_mode);
-  Handle<Code> code =
-      compiler.CompileStoreViaSetter(name, receiver, holder, setter);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  Handle<Code> handler = compiler.CompileStoreViaSetter(
+      receiver, holder, name, setter);
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
 Handle<Code> StubCache::ComputeStoreInterceptor(Handle<Name> name,
                                                 Handle<JSObject> receiver,
                                                 StrictModeFlag strict_mode) {
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::STORE_IC, Code::INTERCEPTOR, strict_mode);
   if (!stub.is_null()) return stub;
 
   StoreStubCompiler compiler(isolate_, strict_mode);
-  Handle<Code> code = compiler.CompileStoreInterceptor(receiver, name);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  Handle<Code> handler = compiler.CompileStoreInterceptor(receiver, name);
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
@@ -581,14 +633,14 @@
                                                Handle<JSObject> receiver,
                                                LookupResult* lookup,
                                                StrictModeFlag strict_mode) {
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::KEYED_STORE_IC, Code::FIELD, strict_mode);
   if (!stub.is_null()) return stub;
 
   KeyedStoreStubCompiler compiler(isolate(), strict_mode, STANDARD_STORE);
-  Handle<Code> code = compiler.CompileStoreField(receiver, lookup, name);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  Handle<Code> handler = compiler.CompileStoreField(receiver, lookup, name);
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
@@ -598,15 +650,15 @@
     LookupResult* lookup,
     Handle<Map> transition,
     StrictModeFlag strict_mode) {
-  Handle<Code> stub = FindIC(
+  Handle<Code> stub = FindStoreHandler(
       name, receiver, Code::KEYED_STORE_IC, Code::MAP_TRANSITION, strict_mode);
   if (!stub.is_null()) return stub;
 
   KeyedStoreStubCompiler compiler(isolate(), strict_mode, STANDARD_STORE);
-  Handle<Code> code =
+  Handle<Code> handler =
       compiler.CompileStoreTransition(receiver, lookup, transition, name);
-  JSObject::UpdateMapCodeCache(receiver, name, code);
-  return code;
+  JSObject::UpdateMapCodeCache(receiver, name, handler);
+  return handler;
 }
 
 
@@ -970,10 +1022,10 @@
 }
 
 
-Handle<Code> StubCache::ComputePolymorphicIC(MapHandleList* receiver_maps,
-                                             CodeHandleList* handlers,
-                                             int number_of_valid_maps,
-                                             Handle<Name> name) {
+Handle<Code> StubCache::ComputePolymorphicLoadIC(MapHandleList* receiver_maps,
+                                                 CodeHandleList* handlers,
+                                                 int number_of_valid_maps,
+                                                 Handle<Name> name) {
   LoadStubCompiler ic_compiler(isolate_);
   Code::StubType type = number_of_valid_maps == 1 ? handlers->at(0)->type()
                                                   : Code::NORMAL;
@@ -983,6 +1035,20 @@
 }
 
 
+Handle<Code> StubCache::ComputePolymorphicStoreIC(MapHandleList* receiver_maps,
+                                                  CodeHandleList* handlers,
+                                                  int number_of_valid_maps,
+                                                  Handle<Name> name,
+                                                  StrictModeFlag strict_mode) {
+  StoreStubCompiler ic_compiler(isolate_, strict_mode);
+  Code::StubType type = number_of_valid_maps == 1 ? handlers->at(0)->type()
+                                                  : Code::NORMAL;
+  Handle<Code> ic = ic_compiler.CompilePolymorphicIC(
+      receiver_maps, handlers, name, type, PROPERTY);
+  return ic;
+}
+
+
 Handle<Code> StubCache::ComputeStoreElementPolymorphic(
     MapHandleList* receiver_maps,
     KeyedAccessStoreMode store_mode,
@@ -1490,28 +1556,42 @@
 #define __ ACCESS_MASM(masm())
 
 
-Register BaseLoadStubCompiler::HandlerFrontendHeader(Handle<JSObject> object,
-                                                     Register object_reg,
-                                                     Handle<JSObject> holder,
-                                                     Handle<Name> name,
-                                                     Label* miss) {
-  // Check the prototype chain.
+Register BaseLoadStubCompiler::HandlerFrontendHeader(
+    Handle<JSObject> object,
+    Register object_reg,
+    Handle<JSObject> holder,
+    Handle<Name> name,
+    Label* miss) {
   return CheckPrototypes(object, object_reg, holder,
                          scratch1(), scratch2(), scratch3(),
                          name, miss, SKIP_RECEIVER);
 }
 
 
-Register BaseLoadStubCompiler::HandlerFrontend(Handle<JSObject> object,
-                                               Register object_reg,
-                                               Handle<JSObject> holder,
-                                               Handle<Name> name,
-                                               Label* success) {
+// HandlerFrontend for store uses the name register. It has to be restored
+// before a miss.
+Register BaseStoreStubCompiler::HandlerFrontendHeader(
+    Handle<JSObject> object,
+    Register object_reg,
+    Handle<JSObject> holder,
+    Handle<Name> name,
+    Label* miss) {
+  return CheckPrototypes(object, object_reg, holder,
+                         this->name(), scratch1(), scratch2(),
+                         name, miss, SKIP_RECEIVER);
+}
+
+
+Register BaseLoadStoreStubCompiler::HandlerFrontend(Handle<JSObject> object,
+                                                    Register object_reg,
+                                                    Handle<JSObject> holder,
+                                                    Handle<Name> name,
+                                                    Label* success) {
   Label miss;
 
   Register reg = HandlerFrontendHeader(object, object_reg, holder, name, &miss);
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
   return reg;
 }
 
@@ -1625,7 +1705,7 @@
 }
 
 
-Handle<Code> BaseLoadStubCompiler::CompileMonomorphicIC(
+Handle<Code> BaseLoadStoreStubCompiler::CompileMonomorphicIC(
     Handle<Map> receiver_map,
     Handle<Code> handler,
     Handle<Name> name) {
@@ -1659,9 +1739,35 @@
     LookupResult* lookup,
     Handle<Map> transition,
     Handle<Name> name) {
-  Label miss, miss_restore_name, slow;
+  Label miss, slow;
 
-  GenerateNameCheck(name, this->name(), &miss);
+  // Ensure no transitions to deprecated maps are followed.
+  __ CheckMapDeprecated(transition, scratch1(), &miss);
+
+  // Check that we are allowed to write this.
+  if (object->GetPrototype()->IsJSObject()) {
+    Handle<JSObject> holder;
+    // holder == object indicates that no property was found.
+    if (lookup->holder() != *object) {
+      holder = Handle<JSObject>(lookup->holder());
+    } else {
+      // Find the top object.
+      holder = object;
+      do {
+        holder = Handle<JSObject>(JSObject::cast(holder->GetPrototype()));
+      } while (holder->GetPrototype()->IsJSObject());
+    }
+
+    Register holder_reg =
+        HandlerFrontendHeader(object, receiver(), holder, name, &miss);
+
+    // If no property was found, and the holder (the last object in the
+    // prototype chain) is in slow mode, we need to do a negative lookup on the
+    // holder.
+    if (lookup->holder() == *object) {
+      GenerateNegativeHolderLookup(masm(), holder, holder_reg, name, &miss);
+    }
+  }
 
   GenerateStoreTransition(masm(),
                           object,
@@ -1671,19 +1777,17 @@
                           receiver(), this->name(), value(),
                           scratch1(), scratch2(), scratch3(),
                           &miss,
-                          &miss_restore_name,
                           &slow);
 
   // Handle store cache miss.
-  GenerateRestoreName(masm(), &miss_restore_name, name);
-  __ bind(&miss);
+  GenerateRestoreName(masm(), &miss, name);
   TailCallBuiltin(masm(), MissBuiltin(kind()));
 
   GenerateRestoreName(masm(), &slow, name);
   TailCallBuiltin(masm(), SlowBuiltin(kind()));
 
   // Return the generated code.
-  return GetICCode(kind(), Code::MAP_TRANSITION, name);
+  return GetCode(kind(), Code::MAP_TRANSITION, name);
 }
 
 
@@ -1692,7 +1796,7 @@
                                                       Handle<Name> name) {
   Label miss;
 
-  GenerateNameCheck(name, this->name(), &miss);
+  HandlerFrontendHeader(object, receiver(), object, name, &miss);
 
   // Generate store field code.
   GenerateStoreField(masm(),
@@ -1706,32 +1810,22 @@
   TailCallBuiltin(masm(), MissBuiltin(kind()));
 
   // Return the generated code.
-  return GetICCode(kind(), Code::FIELD, name);
+  return GetCode(kind(), Code::FIELD, name);
 }
 
 
 Handle<Code> StoreStubCompiler::CompileStoreViaSetter(
-    Handle<Name> name,
     Handle<JSObject> object,
     Handle<JSObject> holder,
+    Handle<Name> name,
     Handle<JSFunction> setter) {
-  Label miss, miss_restore_name;
+  Label success;
+  HandlerFrontend(object, receiver(), holder, name, &success);
 
-  // Check that the maps haven't changed, preserving the name register.
-  __ JumpIfSmi(receiver(), &miss);
-  CheckPrototypes(object, receiver(), holder,
-                  this->name(), scratch1(), scratch2(),
-                  name, &miss_restore_name);
-
+  __ bind(&success);
   GenerateStoreViaSetter(masm(), setter);
 
-  GenerateRestoreName(masm(), &miss_restore_name, name);
-
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
-  // Return the generated code.
-  return GetICCode(kind(), Code::CALLBACKS, name);
+  return GetCode(kind(), Code::CALLBACKS, name);
 }
 
 
@@ -1813,12 +1907,12 @@
 }
 
 
-Handle<Code> BaseLoadStubCompiler::GetICCode(Code::Kind kind,
-                                             Code::StubType type,
-                                             Handle<Name> name,
-                                             InlineCacheState state) {
+Handle<Code> BaseLoadStoreStubCompiler::GetICCode(Code::Kind kind,
+                                                  Code::StubType type,
+                                                  Handle<Name> name,
+                                                  InlineCacheState state) {
   Code::Flags flags = Code::ComputeFlags(
-      kind, state, Code::kNoExtraICState, type);
+      kind, state, extra_state(), type);
   Handle<Code> code = GetCodeWithFlags(flags, name);
   PROFILE(isolate(), CodeCreateEvent(log_kind(code), *code, *name));
   JitEvent(name, code);
@@ -1839,19 +1933,6 @@
 }
 
 
-Handle<Code> BaseStoreStubCompiler::GetICCode(Code::Kind kind,
-                                              Code::StubType type,
-                                              Handle<Name> name,
-                                              InlineCacheState state) {
-  Code::Flags flags = Code::ComputeFlags(
-      kind, state, extra_state(), type);
-  Handle<Code> code = GetCodeWithFlags(flags, name);
-  PROFILE(isolate(), CodeCreateEvent(log_kind(code), *code, *name));
-  JitEvent(name, code);
-  return code;
-}
-
-
 Handle<Code> BaseStoreStubCompiler::GetCode(Code::Kind kind,
                                             Code::StubType type,
                                             Handle<Name> name) {
diff --git a/src/stub-cache.h b/src/stub-cache.h
index 5317ce8..73a1a8a 100644
--- a/src/stub-cache.h
+++ b/src/stub-cache.h
@@ -90,19 +90,35 @@
                       Code::StubType type,
                       Code::ExtraICState extra_state = Code::kNoExtraICState);
 
-  Handle<Code> FindHandler(
-      Handle<Name> name,
-      Handle<JSObject> receiver,
-      Handle<JSObject> stub_holder,
-      Code::Kind kind,
-      Code::StubType type);
+  Handle<Code> FindLoadHandler(Handle<Name> name,
+                               Handle<JSObject> receiver,
+                               Handle<JSObject> stub_holder,
+                               Code::Kind kind,
+                               Code::StubType type);
 
-  Handle<Code> ComputeMonomorphicIC(Handle<JSObject> receiver,
-                                    Handle<Code> handler,
-                                    Handle<Name> name);
-  Handle<Code> ComputeKeyedMonomorphicIC(Handle<JSObject> receiver,
+  Handle<Code> FindStoreHandler(Handle<Name> name,
+                                Handle<JSObject> receiver,
+                                Code::Kind kind,
+                                Code::StubType type,
+                                StrictModeFlag strict_mode);
+
+  Handle<Code> ComputeMonomorphicLoadIC(Handle<JSObject> receiver,
+                                        Handle<Code> handler,
+                                        Handle<Name> name);
+
+  Handle<Code> ComputeMonomorphicKeyedLoadIC(Handle<JSObject> receiver,
+                                             Handle<Code> handler,
+                                             Handle<Name> name);
+
+  Handle<Code> ComputeMonomorphicStoreIC(Handle<JSObject> receiver,
                                          Handle<Code> handler,
-                                         Handle<Name> name);
+                                         Handle<Name> name,
+                                         StrictModeFlag strict_mode);
+
+  Handle<Code> ComputeMonomorphicKeyedStoreIC(Handle<JSObject> receiver,
+                                              Handle<Code> handler,
+                                              Handle<Name> name,
+                                              StrictModeFlag strict_mode);
 
   // Computes the right stub matching. Inserts the result in the
   // cache before returning.  This might compile a stub if needed.
@@ -291,10 +307,16 @@
                                               KeyedAccessStoreMode store_mode,
                                               StrictModeFlag strict_mode);
 
-  Handle<Code> ComputePolymorphicIC(MapHandleList* receiver_maps,
-                                    CodeHandleList* handlers,
-                                    int number_of_valid_maps,
-                                    Handle<Name> name);
+  Handle<Code> ComputePolymorphicLoadIC(MapHandleList* receiver_maps,
+                                        CodeHandleList* handlers,
+                                        int number_of_valid_maps,
+                                        Handle<Name> name);
+
+  Handle<Code> ComputePolymorphicStoreIC(MapHandleList* receiver_maps,
+                                         CodeHandleList* handlers,
+                                         int number_of_valid_maps,
+                                         Handle<Name> name,
+                                         StrictModeFlag strict_mode);
 
   // Finds the Code object stored in the Heap::non_monomorphic_cache().
   Code* FindCallInitialize(int argc, RelocInfo::Mode mode, Code::Kind kind);
@@ -530,49 +552,6 @@
                                             Register scratch2,
                                             Label* miss_label);
 
-  void GenerateStoreTransition(MacroAssembler* masm,
-                               Handle<JSObject> object,
-                               LookupResult* lookup,
-                               Handle<Map> transition,
-                               Handle<Name> name,
-                               Register receiver_reg,
-                               Register name_reg,
-                               Register value_reg,
-                               Register scratch1,
-                               Register scratch2,
-                               Register scratch3,
-                               Label* miss_label,
-                               Label* miss_restore_name,
-                               Label* slow);
-
-  void GenerateStoreField(MacroAssembler* masm,
-                          Handle<JSObject> object,
-                          LookupResult* lookup,
-                          Register receiver_reg,
-                          Register name_reg,
-                          Register value_reg,
-                          Register scratch1,
-                          Register scratch2,
-                          Label* miss_label);
-
-  static Builtins::Name MissBuiltin(Code::Kind kind) {
-    switch (kind) {
-      case Code::LOAD_IC: return Builtins::kLoadIC_Miss;
-      case Code::STORE_IC: return Builtins::kStoreIC_Miss;
-      case Code::KEYED_LOAD_IC: return Builtins::kKeyedLoadIC_Miss;
-      case Code::KEYED_STORE_IC: return Builtins::kKeyedStoreIC_Miss;
-      default: UNREACHABLE();
-    }
-    return Builtins::kLoadIC_Miss;
-  }
-  static Builtins::Name SlowBuiltin(Code::Kind kind) {
-    switch (kind) {
-      case Code::STORE_IC: return Builtins::kStoreIC_Slow;
-      case Code::KEYED_STORE_IC: return Builtins::kKeyedStoreIC_Slow;
-      default: UNREACHABLE();
-    }
-    return Builtins::kStoreIC_Slow;
-  }
   static void TailCallBuiltin(MacroAssembler* masm, Builtins::Name name);
 
   // Generates code that verifies that the property holder has not changed
@@ -642,10 +621,77 @@
 enum FrontendCheckType { PERFORM_INITIAL_CHECKS, SKIP_INITIAL_CHECKS };
 
 
-class BaseLoadStubCompiler: public StubCompiler {
+class BaseLoadStoreStubCompiler: public StubCompiler {
+ public:
+  BaseLoadStoreStubCompiler(Isolate* isolate, Register* registers)
+      : StubCompiler(isolate), registers_(registers) { }
+  virtual ~BaseLoadStoreStubCompiler() { }
+
+  Handle<Code> CompileMonomorphicIC(Handle<Map> receiver_map,
+                                    Handle<Code> handler,
+                                    Handle<Name> name);
+
+  Handle<Code> CompilePolymorphicIC(MapHandleList* receiver_maps,
+                                    CodeHandleList* handlers,
+                                    Handle<Name> name,
+                                    Code::StubType type,
+                                    IcCheckType check);
+
+  virtual void GenerateNameCheck(Handle<Name> name,
+                                 Register name_reg,
+                                 Label* miss) { }
+
+  static Builtins::Name MissBuiltin(Code::Kind kind) {
+    switch (kind) {
+      case Code::LOAD_IC: return Builtins::kLoadIC_Miss;
+      case Code::STORE_IC: return Builtins::kStoreIC_Miss;
+      case Code::KEYED_LOAD_IC: return Builtins::kKeyedLoadIC_Miss;
+      case Code::KEYED_STORE_IC: return Builtins::kKeyedStoreIC_Miss;
+      default: UNREACHABLE();
+    }
+    return Builtins::kLoadIC_Miss;
+  }
+
+ protected:
+  virtual Register HandlerFrontendHeader(Handle<JSObject> object,
+                                         Register object_reg,
+                                         Handle<JSObject> holder,
+                                         Handle<Name> name,
+                                         Label* miss) = 0;
+
+  virtual void HandlerFrontendFooter(Handle<Name> name,
+                                     Label* success,
+                                     Label* miss) = 0;
+
+  Register HandlerFrontend(Handle<JSObject> object,
+                           Register object_reg,
+                           Handle<JSObject> holder,
+                           Handle<Name> name,
+                           Label* success);
+
+  Handle<Code> GetICCode(Code::Kind kind,
+                         Code::StubType type,
+                         Handle<Name> name,
+                         InlineCacheState state = MONOMORPHIC);
+
+  virtual Code::ExtraICState extra_state() { return Code::kNoExtraICState; }
+  virtual Logger::LogEventsAndTags log_kind(Handle<Code> code) = 0;
+  virtual void JitEvent(Handle<Name> name, Handle<Code> code) = 0;
+  virtual Code::Kind kind() = 0;
+  virtual Register receiver() = 0;
+  virtual Register name() = 0;
+  virtual Register scratch1() = 0;
+  virtual Register scratch2() = 0;
+  virtual Register scratch3() = 0;
+
+  Register* registers_;
+};
+
+
+class BaseLoadStubCompiler: public BaseLoadStoreStubCompiler {
  public:
   BaseLoadStubCompiler(Isolate* isolate, Register* registers)
-      : StubCompiler(isolate), registers_(registers) { }
+      : BaseLoadStoreStubCompiler(isolate, registers) { }
   virtual ~BaseLoadStubCompiler() { }
 
   Handle<Code> CompileLoadField(Handle<JSObject> object,
@@ -668,28 +714,17 @@
                                       Handle<JSObject> holder,
                                       Handle<Name> name);
 
-  Handle<Code> CompileMonomorphicIC(Handle<Map> receiver_map,
-                                    Handle<Code> handler,
-                                    Handle<Name> name);
-  Handle<Code> CompilePolymorphicIC(MapHandleList* receiver_maps,
-                                    CodeHandleList* handlers,
-                                    Handle<Name> name,
-                                    Code::StubType type,
-                                    IcCheckType check);
-
  protected:
-  Register HandlerFrontendHeader(Handle<JSObject> object,
-                                 Register object_reg,
-                                 Handle<JSObject> holder,
-                                 Handle<Name> name,
-                                 Label* success);
-  void HandlerFrontendFooter(Label* success, Label* miss);
+  virtual Register HandlerFrontendHeader(Handle<JSObject> object,
+                                         Register object_reg,
+                                         Handle<JSObject> holder,
+                                         Handle<Name> name,
+                                         Label* miss);
 
-  Register HandlerFrontend(Handle<JSObject> object,
-                           Register object_reg,
-                           Handle<JSObject> holder,
-                           Handle<Name> name,
-                           Label* success);
+  virtual void HandlerFrontendFooter(Handle<Name> name,
+                                     Label* success,
+                                     Label* miss);
+
   Register CallbackHandlerFrontend(Handle<JSObject> object,
                                    Register object_reg,
                                    Handle<JSObject> holder,
@@ -719,30 +754,16 @@
                                    Handle<Name> name,
                                    LookupResult* lookup);
 
-  Handle<Code> GetICCode(Code::Kind kind,
-                         Code::StubType type,
-                         Handle<Name> name,
-                         InlineCacheState state = MONOMORPHIC);
-
   Handle<Code> GetCode(Code::Kind kind,
                        Code::StubType type,
                        Handle<Name> name);
 
-  Register receiver() { return registers_[0]; }
-  Register name()     { return registers_[1]; }
-  Register scratch1() { return registers_[2]; }
-  Register scratch2() { return registers_[3]; }
-  Register scratch3() { return registers_[4]; }
+  virtual Register receiver() { return registers_[0]; }
+  virtual Register name()     { return registers_[1]; }
+  virtual Register scratch1() { return registers_[2]; }
+  virtual Register scratch2() { return registers_[3]; }
+  virtual Register scratch3() { return registers_[4]; }
   Register scratch4() { return registers_[5]; }
-
- private:
-  virtual Code::Kind kind() = 0;
-  virtual Logger::LogEventsAndTags log_kind(Handle<Code> code) = 0;
-  virtual void JitEvent(Handle<Name> name, Handle<Code> code) = 0;
-  virtual void GenerateNameCheck(Handle<Name> name,
-                                 Register name_reg,
-                                 Label* miss) { }
-  Register* registers_;
 };
 
 
@@ -770,8 +791,6 @@
                                  Handle<Name> name,
                                  bool is_dont_delete);
 
-  static Register receiver() { return registers()[0]; }
-
  private:
   static Register* registers();
   virtual Code::Kind kind() { return Code::LOAD_IC; }
@@ -796,8 +815,6 @@
 
   static void GenerateLoadDictionaryElement(MacroAssembler* masm);
 
-  static Register receiver() { return registers()[0]; }
-
  private:
   static Register* registers();
   virtual Code::Kind kind() { return Code::KEYED_LOAD_IC; }
@@ -813,14 +830,13 @@
 };
 
 
-class BaseStoreStubCompiler: public StubCompiler {
+class BaseStoreStubCompiler: public BaseLoadStoreStubCompiler {
  public:
   BaseStoreStubCompiler(Isolate* isolate,
                         StrictModeFlag strict_mode,
                         Register* registers)
-      : StubCompiler(isolate),
-        strict_mode_(strict_mode),
-        registers_(registers) { }
+      : BaseLoadStoreStubCompiler(isolate, registers),
+        strict_mode_(strict_mode) { }
 
   virtual ~BaseStoreStubCompiler() { }
 
@@ -833,12 +849,65 @@
                                  LookupResult* lookup,
                                  Handle<Name> name);
 
- protected:
-  Handle<Code> GetICCode(Code::Kind kind,
-                         Code::StubType type,
-                         Handle<Name> name,
-                         InlineCacheState state = MONOMORPHIC);
+  void GenerateNegativeHolderLookup(MacroAssembler* masm,
+                                    Handle<JSObject> holder,
+                                    Register holder_reg,
+                                    Handle<Name> name,
+                                    Label* miss);
 
+  void GenerateStoreTransition(MacroAssembler* masm,
+                               Handle<JSObject> object,
+                               LookupResult* lookup,
+                               Handle<Map> transition,
+                               Handle<Name> name,
+                               Register receiver_reg,
+                               Register name_reg,
+                               Register value_reg,
+                               Register scratch1,
+                               Register scratch2,
+                               Register scratch3,
+                               Label* miss_label,
+                               Label* slow);
+
+  void GenerateStoreField(MacroAssembler* masm,
+                          Handle<JSObject> object,
+                          LookupResult* lookup,
+                          Register receiver_reg,
+                          Register name_reg,
+                          Register value_reg,
+                          Register scratch1,
+                          Register scratch2,
+                          Label* miss_label);
+
+  static Builtins::Name MissBuiltin(Code::Kind kind) {
+    switch (kind) {
+      case Code::LOAD_IC: return Builtins::kLoadIC_Miss;
+      case Code::STORE_IC: return Builtins::kStoreIC_Miss;
+      case Code::KEYED_LOAD_IC: return Builtins::kKeyedLoadIC_Miss;
+      case Code::KEYED_STORE_IC: return Builtins::kKeyedStoreIC_Miss;
+      default: UNREACHABLE();
+    }
+    return Builtins::kLoadIC_Miss;
+  }
+  static Builtins::Name SlowBuiltin(Code::Kind kind) {
+    switch (kind) {
+      case Code::STORE_IC: return Builtins::kStoreIC_Slow;
+      case Code::KEYED_STORE_IC: return Builtins::kKeyedStoreIC_Slow;
+      default: UNREACHABLE();
+    }
+    return Builtins::kStoreIC_Slow;
+  }
+
+ protected:
+  virtual Register HandlerFrontendHeader(Handle<JSObject> object,
+                                         Register object_reg,
+                                         Handle<JSObject> holder,
+                                         Handle<Name> name,
+                                         Label* miss);
+
+  virtual void HandlerFrontendFooter(Handle<Name> name,
+                                     Label* success,
+                                     Label* miss);
   Handle<Code> GetCode(Code::Kind kind,
                        Code::StubType type,
                        Handle<Name> name);
@@ -847,24 +916,17 @@
                            Label* label,
                            Handle<Name> name);
 
-  Register receiver() { return registers_[0]; }
-  Register name()     { return registers_[1]; }
+  virtual Register receiver() { return registers_[0]; }
+  virtual Register name()     { return registers_[1]; }
   Register value()    { return registers_[2]; }
-  Register scratch1() { return registers_[3]; }
-  Register scratch2() { return registers_[4]; }
-  Register scratch3() { return registers_[5]; }
+  virtual Register scratch1() { return registers_[3]; }
+  virtual Register scratch2() { return registers_[4]; }
+  virtual Register scratch3() { return registers_[5]; }
   StrictModeFlag strict_mode() { return strict_mode_; }
   virtual Code::ExtraICState extra_state() { return strict_mode_; }
 
  private:
-  virtual Code::Kind kind() = 0;
-  virtual Logger::LogEventsAndTags log_kind(Handle<Code> code) = 0;
-  virtual void JitEvent(Handle<Name> name, Handle<Code> code) = 0;
-  virtual void GenerateNameCheck(Handle<Name> name,
-                                 Register name_reg,
-                                 Label* miss) { }
   StrictModeFlag strict_mode_;
-  Register* registers_;
 };
 
 
@@ -874,17 +936,17 @@
       : BaseStoreStubCompiler(isolate, strict_mode, registers()) { }
 
 
-  Handle<Code> CompileStoreCallback(Handle<Name> name,
-                                    Handle<JSObject> object,
+  Handle<Code> CompileStoreCallback(Handle<JSObject> object,
                                     Handle<JSObject> holder,
+                                    Handle<Name> name,
                                     Handle<ExecutableAccessorInfo> callback);
 
   static void GenerateStoreViaSetter(MacroAssembler* masm,
                                      Handle<JSFunction> setter);
 
-  Handle<Code> CompileStoreViaSetter(Handle<Name> name,
-                                     Handle<JSObject> object,
+  Handle<Code> CompileStoreViaSetter(Handle<JSObject> object,
                                      Handle<JSObject> holder,
+                                     Handle<Name> name,
                                      Handle<JSFunction> setter);
 
   Handle<Code> CompileStoreInterceptor(Handle<JSObject> object,
diff --git a/src/third_party/vtune/v8vtune.gyp b/src/third_party/vtune/v8vtune.gyp
index 6c3de3e..6adf365 100644
--- a/src/third_party/vtune/v8vtune.gyp
+++ b/src/third_party/vtune/v8vtune.gyp
@@ -29,7 +29,7 @@
   'variables': {
     'v8_code': 1,
   },
-  'includes': ['../../../build/common.gypi'],
+  'includes': ['../../../build/toolchain.gypi', '../../../build/features.gypi'],
   'targets': [
     {
       'target_name': 'v8_vtune',
diff --git a/src/type-info.cc b/src/type-info.cc
index e2be3aa..4a10caf 100644
--- a/src/type-info.cc
+++ b/src/type-info.cc
@@ -170,14 +170,14 @@
 }
 
 
-bool TypeFeedbackOracle::StoreIsPolymorphic(TypeFeedbackId ast_id) {
+bool TypeFeedbackOracle::StoreIsKeyedPolymorphic(TypeFeedbackId ast_id) {
   Handle<Object> map_or_code = GetInfo(ast_id);
   if (map_or_code->IsCode()) {
     Handle<Code> code = Handle<Code>::cast(map_or_code);
     bool standard_store = FLAG_compiled_keyed_stores ||
         (Code::GetKeyedAccessStoreMode(code->extra_ic_state()) ==
          STANDARD_STORE);
-    return code->is_keyed_store_stub() && standard_store  &&
+    return code->is_keyed_store_stub() && standard_store &&
         code->ic_state() == POLYMORPHIC;
   }
   return false;
@@ -186,13 +186,14 @@
 
 bool TypeFeedbackOracle::CallIsMonomorphic(Call* expr) {
   Handle<Object> value = GetInfo(expr->CallFeedbackId());
-  return value->IsMap() || value->IsSmi() || value->IsJSFunction();
+  return value->IsMap() || value->IsAllocationSite() || value->IsJSFunction() ||
+      value->IsSmi();
 }
 
 
 bool TypeFeedbackOracle::CallNewIsMonomorphic(CallNew* expr) {
   Handle<Object> info = GetInfo(expr->CallNewFeedbackId());
-  return info->IsSmi() || info->IsJSFunction();
+  return info->IsAllocationSite() || info->IsJSFunction();
 }
 
 
@@ -266,7 +267,9 @@
 void TypeFeedbackOracle::StoreReceiverTypes(Assignment* expr,
                                             Handle<String> name,
                                             SmallMapList* types) {
-  Code::Flags flags = Code::ComputeMonomorphicFlags(Code::STORE_IC);
+  Code::Flags flags = Code::ComputeFlags(
+      Code::STUB, MONOMORPHIC, Code::kNoExtraICState,
+      Code::NORMAL, Code::STORE_IC);
   CollectReceiverTypes(expr->AssignmentFeedbackId(), name, flags, types);
 }
 
@@ -302,9 +305,7 @@
 
 Handle<JSFunction> TypeFeedbackOracle::GetCallTarget(Call* expr) {
   Handle<Object> info = GetInfo(expr->CallFeedbackId());
-  if (info->IsSmi()) {
-    ASSERT(static_cast<ElementsKind>(Smi::cast(*info)->value()) <=
-           LAST_FAST_ELEMENTS_KIND);
+  if (info->IsAllocationSite()) {
     return Handle<JSFunction>(isolate_->global_context()->array_function());
   } else {
     return Handle<JSFunction>::cast(info);
@@ -314,9 +315,7 @@
 
 Handle<JSFunction> TypeFeedbackOracle::GetCallNewTarget(CallNew* expr) {
   Handle<Object> info = GetInfo(expr->CallNewFeedbackId());
-  if (info->IsSmi()) {
-    ASSERT(static_cast<ElementsKind>(Smi::cast(*info)->value()) <=
-           LAST_FAST_ELEMENTS_KIND);
+  if (info->IsAllocationSite()) {
     return Handle<JSFunction>(isolate_->global_context()->array_function());
   } else {
     return Handle<JSFunction>::cast(info);
@@ -554,6 +553,18 @@
 }
 
 
+void TypeFeedbackOracle::CollectPolymorphicStoreReceiverTypes(
+    TypeFeedbackId ast_id,
+    SmallMapList* types) {
+  Handle<Object> object = GetInfo(ast_id);
+  if (!object->IsCode()) return;
+  Handle<Code> code = Handle<Code>::cast(object);
+  if (code->kind() == Code::STORE_IC && code->ic_state() == POLYMORPHIC) {
+    CollectPolymorphicMaps(code, types);
+  }
+}
+
+
 byte TypeFeedbackOracle::ToBooleanTypes(TypeFeedbackId id) {
   Handle<Object> object = GetInfo(id);
   return object->IsCode() ? Handle<Code>::cast(object)->to_boolean_state() : 0;
@@ -675,6 +686,7 @@
     Cell* cell = cache->GetCell(i);
     Object* value = cell->value();
     if (value->IsSmi() ||
+        value->IsAllocationSite() ||
         (value->IsJSFunction() &&
          !CanRetainOtherContext(JSFunction::cast(value),
                                 *native_context_))) {
diff --git a/src/type-info.h b/src/type-info.h
index aa1f509..1a7c67d 100644
--- a/src/type-info.h
+++ b/src/type-info.h
@@ -246,7 +246,7 @@
   bool LoadIsPolymorphic(Property* expr);
   bool StoreIsUninitialized(TypeFeedbackId ast_id);
   bool StoreIsMonomorphicNormal(TypeFeedbackId ast_id);
-  bool StoreIsPolymorphic(TypeFeedbackId ast_id);
+  bool StoreIsKeyedPolymorphic(TypeFeedbackId ast_id);
   bool CallIsMonomorphic(Call* expr);
   bool CallNewIsMonomorphic(CallNew* expr);
   bool ObjectLiteralStoreIsMonomorphic(ObjectLiteralProperty* prop);
@@ -272,6 +272,8 @@
                          SmallMapList* types);
   void CollectKeyedReceiverTypes(TypeFeedbackId ast_id,
                                  SmallMapList* types);
+  void CollectPolymorphicStoreReceiverTypes(TypeFeedbackId ast_id,
+                                            SmallMapList* types);
 
   static bool CanRetainOtherContext(Map* map, Context* native_context);
   static bool CanRetainOtherContext(JSFunction* function,
diff --git a/src/typedarray.js b/src/typedarray.js
index 0d90355..57d0c60 100644
--- a/src/typedarray.js
+++ b/src/typedarray.js
@@ -89,12 +89,11 @@
     if (%_IsConstructCall()) {
       if (IS_ARRAYBUFFER(arg1)) {
         ConstructByArrayBuffer(this, arg1, arg2, arg3);
-      } else if (IS_NUMBER(arg1) || IS_STRING(arg1) || IS_BOOLEAN(arg1)) {
+      } else if (IS_NUMBER(arg1) || IS_STRING(arg1) ||
+                 IS_BOOLEAN(arg1) || IS_UNDEFINED(arg1)) {
         ConstructByLength(this, arg1);
-      } else if (!IS_UNDEFINED(arg1)){
-        ConstructByArrayLike(this, arg1);
       } else {
-        throw MakeTypeError("parameterless_typed_array_constr", [name]);
+        ConstructByArrayLike(this, arg1);
       }
     } else {
       throw MakeTypeError("constructor_not_function", [name])
diff --git a/src/types.cc b/src/types.cc
index ed98480..e88f9f6 100644
--- a/src/types.cc
+++ b/src/types.cc
@@ -26,6 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 #include "types.h"
+#include "string-stream.h"
 
 namespace v8 {
 namespace internal {
@@ -486,4 +487,49 @@
 }
 
 
+#ifdef OBJECT_PRINT
+void Type::TypePrint() {
+  TypePrint(stdout);
+  PrintF(stdout, "\n");
+  Flush(stdout);
+}
+
+
+void Type::TypePrint(FILE* out) {
+  if (is_bitset()) {
+    int val = as_bitset();
+    const char* composed_name = GetComposedName(val);
+    if (composed_name != NULL) {
+      PrintF(out, "%s", composed_name);
+      return;
+    }
+    bool first_entry = true;
+    PrintF(out, "{");
+    for (unsigned i = 0; i < sizeof(val)*8; ++i) {
+      int mask = (1 << i);
+      if ((val & mask) != 0) {
+        if (!first_entry) PrintF(out, ",");
+        first_entry = false;
+        PrintF(out, "%s", GetPrimitiveName(mask));
+      }
+    }
+    PrintF(out, "}");
+  } else if (is_constant()) {
+    PrintF(out, "Constant(%p)", reinterpret_cast<void*>(*as_constant()));
+  } else if (is_class()) {
+    PrintF(out, "Class(%p)", reinterpret_cast<void*>(*as_class()));
+  } else if (is_union()) {
+    PrintF(out, "{");
+    Handle<Unioned> unioned = as_union();
+    for (int i = 0; i < unioned->length(); ++i) {
+      Handle<Type> type_i = union_get(unioned, i);
+      if (i > 0) PrintF(out, ",");
+      type_i->TypePrint(out);
+    }
+    PrintF(out, "}");
+  }
+}
+#endif
+
+
 } }  // namespace v8::internal
diff --git a/src/types.h b/src/types.h
index a2bcda6..bc6e580 100644
--- a/src/types.h
+++ b/src/types.h
@@ -94,39 +94,54 @@
 // The type representation is heap-allocated, so cannot (currently) be used in
 // a parallel compilation context.
 
+
+#define PRIMITIVE_TYPE_LIST(V)           \
+  V(None,                0)              \
+  V(Null,                1 << 0)         \
+  V(Undefined,           1 << 1)         \
+  V(Boolean,             1 << 2)         \
+  V(Smi,                 1 << 3)         \
+  V(OtherSigned32,       1 << 4)         \
+  V(Unsigned32,          1 << 5)         \
+  V(Double,              1 << 6)         \
+  V(Symbol,              1 << 7)         \
+  V(InternalizedString,  1 << 8)         \
+  V(OtherString,         1 << 9)         \
+  V(Undetectable,        1 << 10)        \
+  V(Array,               1 << 11)        \
+  V(Function,            1 << 12)        \
+  V(RegExp,              1 << 13)        \
+  V(OtherObject,         1 << 14)        \
+  V(Proxy,               1 << 15)        \
+  V(Internal,            1 << 16)
+
+#define COMPOSED_TYPE_LIST(V)                                       \
+  V(Oddball,         kBoolean | kNull | kUndefined)                 \
+  V(Signed32,        kSmi | kOtherSigned32)                         \
+  V(Number,          kSigned32 | kUnsigned32 | kDouble)             \
+  V(String,          kInternalizedString | kOtherString)            \
+  V(UniqueName,      kSymbol | kInternalizedString)                 \
+  V(Name,            kSymbol | kString)                             \
+  V(NumberOrString,  kNumber | kString)                             \
+  V(Object,          kUndetectable | kArray | kFunction |           \
+                     kRegExp | kOtherObject)                        \
+  V(Receiver,        kObject | kProxy)                              \
+  V(Allocated,       kDouble | kName | kReceiver)                   \
+  V(Any,             kOddball | kNumber | kAllocated | kInternal)   \
+  V(Detectable,      kAllocated - kUndetectable)
+
+#define TYPE_LIST(V)     \
+  PRIMITIVE_TYPE_LIST(V) \
+  COMPOSED_TYPE_LIST(V)
+
+
+
 class Type : public Object {
  public:
-  static Type* None() { return from_bitset(kNone); }
-  static Type* Any() { return from_bitset(kAny); }
-  static Type* Allocated() { return from_bitset(kAllocated); }
-  static Type* Detectable() { return from_bitset(kDetectable); }
-
-  static Type* Oddball() { return from_bitset(kOddball); }
-  static Type* Boolean() { return from_bitset(kBoolean); }
-  static Type* Null() { return from_bitset(kNull); }
-  static Type* Undefined() { return from_bitset(kUndefined); }
-
-  static Type* Number() { return from_bitset(kNumber); }
-  static Type* Smi() { return from_bitset(kSmi); }
-  static Type* Signed32() { return from_bitset(kSigned32); }
-  static Type* Unsigned32() { return from_bitset(kUnsigned32); }
-  static Type* Double() { return from_bitset(kDouble); }
-  static Type* NumberOrString() { return from_bitset(kNumberOrString); }
-
-  static Type* Name() { return from_bitset(kName); }
-  static Type* UniqueName() { return from_bitset(kUniqueName); }
-  static Type* String() { return from_bitset(kString); }
-  static Type* InternalizedString() { return from_bitset(kInternalizedString); }
-  static Type* Symbol() { return from_bitset(kSymbol); }
-
-  static Type* Receiver() { return from_bitset(kReceiver); }
-  static Type* Object() { return from_bitset(kObject); }
-  static Type* Undetectable() { return from_bitset(kUndetectable); }
-  static Type* Array() { return from_bitset(kArray); }
-  static Type* Function() { return from_bitset(kFunction); }
-  static Type* RegExp() { return from_bitset(kRegExp); }
-  static Type* Proxy() { return from_bitset(kProxy); }
-  static Type* Internal() { return from_bitset(kInternal); }
+  #define DEFINE_TYPE_CONSTRUCTOR(type, value)           \
+    static Type* type() { return from_bitset(k##type); }
+  TYPE_LIST(DEFINE_TYPE_CONSTRUCTOR)
+  #undef DEFINE_TYPE_CONSTRUCTOR
 
   static Type* Class(Handle<Map> map) { return from_handle(map); }
   static Type* Constant(Handle<HeapObject> value) {
@@ -184,6 +199,18 @@
     return Iterator<v8::internal::Object>(this->handle());
   }
 
+  static Type* cast(v8::internal::Object* object) {
+    Type* t = static_cast<Type*>(object);
+    ASSERT(t->is_bitset() || t->is_class() ||
+           t->is_constant() || t->is_union());
+    return t;
+  }
+
+#ifdef OBJECT_PRINT
+  void TypePrint();
+  void TypePrint(FILE* out);
+#endif
+
  private:
   // A union is a fixed array containing types. Invariants:
   // - its length is at least 2
@@ -192,37 +219,10 @@
   typedef FixedArray Unioned;
 
   enum {
-    kNull = 1 << 0,
-    kUndefined = 1 << 1,
-    kBoolean = 1 << 2,
-    kSmi = 1 << 3,
-    kOtherSigned32 = 1 << 4,
-    kUnsigned32 = 1 << 5,
-    kDouble = 1 << 6,
-    kSymbol = 1 << 7,
-    kInternalizedString = 1 << 8,
-    kOtherString = 1 << 9,
-    kUndetectable = 1 << 10,
-    kArray = 1 << 11,
-    kFunction = 1 << 12,
-    kRegExp = 1 << 13,
-    kOtherObject = 1 << 14,
-    kProxy = 1 << 15,
-    kInternal = 1 << 16,
-
-    kOddball = kBoolean | kNull | kUndefined,
-    kSigned32 = kSmi | kOtherSigned32,
-    kNumber = kSigned32 | kUnsigned32 | kDouble,
-    kString = kInternalizedString | kOtherString,
-    kUniqueName = kSymbol | kInternalizedString,
-    kName = kSymbol | kString,
-    kNumberOrString = kNumber | kString,
-    kObject = kUndetectable | kArray | kFunction | kRegExp | kOtherObject,
-    kReceiver = kObject | kProxy,
-    kAllocated = kDouble | kName | kReceiver,
-    kAny = kOddball | kNumber | kAllocated | kInternal,
-    kDetectable = kAllocated - kUndetectable,
-    kNone = 0
+    #define DECLARE_TYPE(type, value) k##type = (value),
+    TYPE_LIST(DECLARE_TYPE)
+    #undef DECLARE_TYPE
+    kUnusedEOL = 0
   };
 
   bool is_bitset() { return this->IsSmi(); }
@@ -265,6 +265,30 @@
   int ExtendUnion(Handle<Unioned> unioned, int current_size);
   int ExtendIntersection(
       Handle<Unioned> unioned, Handle<Type> type, int current_size);
+
+  static const char* GetComposedName(int type) {
+    switch (type) {
+      #define PRINT_COMPOSED_TYPE(type, value)  \
+      case k##type:                             \
+        return # type;
+      COMPOSED_TYPE_LIST(PRINT_COMPOSED_TYPE)
+      #undef PRINT_COMPOSED_TYPE
+    }
+    return NULL;
+  }
+
+  static const char* GetPrimitiveName(int type) {
+    switch (type) {
+      #define PRINT_PRIMITIVE_TYPE(type, value)  \
+      case k##type:                              \
+        return # type;
+      PRIMITIVE_TYPE_LIST(PRINT_PRIMITIVE_TYPE)
+      #undef PRINT_PRIMITIVE_TYPE
+      default:
+        UNREACHABLE();
+        return "InvalidType";
+    }
+  }
 };
 
 } }  // namespace v8::internal
diff --git a/src/typing.cc b/src/typing.cc
index 3f3ff60..4645950 100644
--- a/src/typing.cc
+++ b/src/typing.cc
@@ -45,13 +45,13 @@
 }
 
 
-#define CHECK_ALIVE(call)                     \
+#define RECURSE(call)                         \
   do {                                        \
+    ASSERT(!visitor->HasStackOverflow());     \
     call;                                     \
     if (visitor->HasStackOverflow()) return;  \
   } while (false)
 
-
 void AstTyper::Run(CompilationInfo* info) {
   AstTyper* visitor = new(info->zone()) AstTyper(info);
   Scope* scope = info->scope();
@@ -59,52 +59,48 @@
   // Handle implicit declaration of the function name in named function
   // expressions before other declarations.
   if (scope->is_function_scope() && scope->function() != NULL) {
-    CHECK_ALIVE(visitor->VisitVariableDeclaration(scope->function()));
+    RECURSE(visitor->VisitVariableDeclaration(scope->function()));
   }
-  CHECK_ALIVE(visitor->VisitDeclarations(scope->declarations()));
-  CHECK_ALIVE(visitor->VisitStatements(info->function()->body()));
+  RECURSE(visitor->VisitDeclarations(scope->declarations()));
+  RECURSE(visitor->VisitStatements(info->function()->body()));
 }
 
+#undef RECURSE
 
-#undef CHECK_ALIVE
-#define CHECK_ALIVE(call)            \
+#define RECURSE(call)                \
   do {                               \
+    ASSERT(!HasStackOverflow());     \
     call;                            \
     if (HasStackOverflow()) return;  \
   } while (false)
 
 
 void AstTyper::VisitStatements(ZoneList<Statement*>* stmts) {
-  ASSERT(!HasStackOverflow());
   for (int i = 0; i < stmts->length(); ++i) {
     Statement* stmt = stmts->at(i);
-    CHECK_ALIVE(Visit(stmt));
+    RECURSE(Visit(stmt));
   }
 }
 
 
 void AstTyper::VisitBlock(Block* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(VisitStatements(stmt->statements()));
+  RECURSE(VisitStatements(stmt->statements()));
 }
 
 
 void AstTyper::VisitExpressionStatement(ExpressionStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->expression()));
+  RECURSE(Visit(stmt->expression()));
 }
 
 
 void AstTyper::VisitEmptyStatement(EmptyStatement* stmt) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitIfStatement(IfStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->condition()));
-  CHECK_ALIVE(Visit(stmt->then_statement()));
-  CHECK_ALIVE(Visit(stmt->else_statement()));
+  RECURSE(Visit(stmt->condition()));
+  RECURSE(Visit(stmt->then_statement()));
+  RECURSE(Visit(stmt->else_statement()));
 
   if (!stmt->condition()->ToBooleanIsTrue() &&
       !stmt->condition()->ToBooleanIsFalse()) {
@@ -114,18 +110,15 @@
 
 
 void AstTyper::VisitContinueStatement(ContinueStatement* stmt) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitBreakStatement(BreakStatement* stmt) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitReturnStatement(ReturnStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->expression()));
+  RECURSE(Visit(stmt->expression()));
 
   // TODO(rossberg): we only need this for inlining into test contexts...
   stmt->expression()->RecordToBooleanTypeFeedback(oracle());
@@ -133,22 +126,20 @@
 
 
 void AstTyper::VisitWithStatement(WithStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(stmt->expression());
-  CHECK_ALIVE(stmt->statement());
+  RECURSE(stmt->expression());
+  RECURSE(stmt->statement());
 }
 
 
 void AstTyper::VisitSwitchStatement(SwitchStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->tag()));
+  RECURSE(Visit(stmt->tag()));
   ZoneList<CaseClause*>* clauses = stmt->cases();
   SwitchStatement::SwitchType switch_type = stmt->switch_type();
   for (int i = 0; i < clauses->length(); ++i) {
     CaseClause* clause = clauses->at(i);
     if (!clause->is_default()) {
       Expression* label = clause->label();
-      CHECK_ALIVE(Visit(label));
+      RECURSE(Visit(label));
 
       SwitchStatement::SwitchType label_switch_type =
           label->IsSmiLiteral() ? SwitchStatement::SMI_SWITCH :
@@ -159,7 +150,7 @@
       else if (switch_type != label_switch_type)
         switch_type = SwitchStatement::GENERIC_SWITCH;
     }
-    CHECK_ALIVE(VisitStatements(clause->statements()));
+    RECURSE(VisitStatements(clause->statements()));
   }
   if (switch_type == SwitchStatement::UNKNOWN_SWITCH)
     switch_type = SwitchStatement::GENERIC_SWITCH;
@@ -177,9 +168,8 @@
 
 
 void AstTyper::VisitDoWhileStatement(DoWhileStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->body()));
-  CHECK_ALIVE(Visit(stmt->cond()));
+  RECURSE(Visit(stmt->body()));
+  RECURSE(Visit(stmt->cond()));
 
   if (!stmt->cond()->ToBooleanIsTrue()) {
     stmt->cond()->RecordToBooleanTypeFeedback(oracle());
@@ -188,9 +178,8 @@
 
 
 void AstTyper::VisitWhileStatement(WhileStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->cond()));
-  CHECK_ALIVE(Visit(stmt->body()));
+  RECURSE(Visit(stmt->cond()));
+  RECURSE(Visit(stmt->body()));
 
   if (!stmt->cond()->ToBooleanIsTrue()) {
     stmt->cond()->RecordToBooleanTypeFeedback(oracle());
@@ -199,171 +188,185 @@
 
 
 void AstTyper::VisitForStatement(ForStatement* stmt) {
-  ASSERT(!HasStackOverflow());
   if (stmt->init() != NULL) {
-    CHECK_ALIVE(Visit(stmt->init()));
+    RECURSE(Visit(stmt->init()));
   }
   if (stmt->cond() != NULL) {
-    CHECK_ALIVE(Visit(stmt->cond()));
+    RECURSE(Visit(stmt->cond()));
 
     stmt->cond()->RecordToBooleanTypeFeedback(oracle());
   }
-  CHECK_ALIVE(Visit(stmt->body()));
+  RECURSE(Visit(stmt->body()));
   if (stmt->next() != NULL) {
-    CHECK_ALIVE(Visit(stmt->next()));
+    RECURSE(Visit(stmt->next()));
   }
 }
 
 
 void AstTyper::VisitForInStatement(ForInStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->enumerable()));
-  CHECK_ALIVE(Visit(stmt->body()));
+  RECURSE(Visit(stmt->enumerable()));
+  RECURSE(Visit(stmt->body()));
 
   stmt->RecordTypeFeedback(oracle());
 }
 
 
 void AstTyper::VisitForOfStatement(ForOfStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->iterable()));
-  CHECK_ALIVE(Visit(stmt->body()));
+  RECURSE(Visit(stmt->iterable()));
+  RECURSE(Visit(stmt->body()));
 }
 
 
 void AstTyper::VisitTryCatchStatement(TryCatchStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->try_block()));
-  CHECK_ALIVE(Visit(stmt->catch_block()));
+  RECURSE(Visit(stmt->try_block()));
+  RECURSE(Visit(stmt->catch_block()));
 }
 
 
 void AstTyper::VisitTryFinallyStatement(TryFinallyStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->try_block()));
-  CHECK_ALIVE(Visit(stmt->finally_block()));
+  RECURSE(Visit(stmt->try_block()));
+  RECURSE(Visit(stmt->finally_block()));
 }
 
 
 void AstTyper::VisitDebuggerStatement(DebuggerStatement* stmt) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitFunctionLiteral(FunctionLiteral* expr) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitSharedFunctionInfoLiteral(SharedFunctionInfoLiteral* expr) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitConditional(Conditional* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->condition()));
-  CHECK_ALIVE(Visit(expr->then_expression()));
-  CHECK_ALIVE(Visit(expr->else_expression()));
+  RECURSE(Visit(expr->condition()));
+  RECURSE(Visit(expr->then_expression()));
+  RECURSE(Visit(expr->else_expression()));
 
   expr->condition()->RecordToBooleanTypeFeedback(oracle());
+
+  MergeLowerType(expr, Type::Intersect(
+      expr->then_expression()->lower_type(),
+      expr->else_expression()->lower_type()));
+  MergeUpperType(expr, Type::Union(
+      expr->then_expression()->upper_type(),
+      expr->else_expression()->upper_type()));
 }
 
 
 void AstTyper::VisitVariableProxy(VariableProxy* expr) {
-  ASSERT(!HasStackOverflow());
+  // TODO(rossberg): typing of variables
 }
 
 
 void AstTyper::VisitLiteral(Literal* expr) {
-  ASSERT(!HasStackOverflow());
+  Type* type = Type::Constant(expr->value(), isolate_);
+  MergeLowerType(expr, type);
+  MergeUpperType(expr, type);
 }
 
 
 void AstTyper::VisitRegExpLiteral(RegExpLiteral* expr) {
-  ASSERT(!HasStackOverflow());
+  MergeLowerType(expr, Type::RegExp());
+  MergeUpperType(expr, Type::RegExp());
 }
 
 
 void AstTyper::VisitObjectLiteral(ObjectLiteral* expr) {
-  ASSERT(!HasStackOverflow());
   ZoneList<ObjectLiteral::Property*>* properties = expr->properties();
   for (int i = 0; i < properties->length(); ++i) {
     ObjectLiteral::Property* prop = properties->at(i);
-    CHECK_ALIVE(Visit(prop->value()));
+    RECURSE(Visit(prop->value()));
 
     if ((prop->kind() == ObjectLiteral::Property::MATERIALIZED_LITERAL &&
         !CompileTimeValue::IsCompileTimeValue(prop->value())) ||
         prop->kind() == ObjectLiteral::Property::COMPUTED) {
-      if (prop->key()->value()->IsInternalizedString() && prop->emit_store())
+      if (prop->key()->value()->IsInternalizedString() && prop->emit_store()) {
         prop->RecordTypeFeedback(oracle());
+      }
     }
   }
+
+  MergeLowerType(expr, Type::Object());
+  MergeUpperType(expr, Type::Object());
 }
 
 
 void AstTyper::VisitArrayLiteral(ArrayLiteral* expr) {
-  ASSERT(!HasStackOverflow());
   ZoneList<Expression*>* values = expr->values();
   for (int i = 0; i < values->length(); ++i) {
     Expression* value = values->at(i);
-    CHECK_ALIVE(Visit(value));
+    RECURSE(Visit(value));
   }
+
+  MergeLowerType(expr, Type::Array());
+  MergeUpperType(expr, Type::Array());
 }
 
 
 void AstTyper::VisitAssignment(Assignment* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->target()));
-  CHECK_ALIVE(Visit(expr->value()));
-
   // TODO(rossberg): Can we clean this up?
   if (expr->is_compound()) {
-    CHECK_ALIVE(Visit(expr->binary_operation()));
+    RECURSE(Visit(expr->binary_operation()));
 
     Expression* target = expr->target();
     Property* prop = target->AsProperty();
     if (prop != NULL) {
       prop->RecordTypeFeedback(oracle(), zone());
-      if (!prop->key()->IsPropertyName())  // i.e., keyed
+      if (!prop->key()->IsPropertyName()) {  // i.e., keyed
         expr->RecordTypeFeedback(oracle(), zone());
+      }
     }
-    return;
+  } else {
+    RECURSE(Visit(expr->target()));
+    RECURSE(Visit(expr->value()));
+
+    if (expr->target()->AsProperty()) {
+      expr->RecordTypeFeedback(oracle(), zone());
+    }
+
+    MergeLowerType(expr, expr->value()->lower_type());
+    MergeUpperType(expr, expr->value()->upper_type());
   }
-  if (expr->target()->AsProperty())
-    expr->RecordTypeFeedback(oracle(), zone());
+  // TODO(rossberg): handle target variables
 }
 
 
 void AstTyper::VisitYield(Yield* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->generator_object()));
-  CHECK_ALIVE(Visit(expr->expression()));
+  RECURSE(Visit(expr->generator_object()));
+  RECURSE(Visit(expr->expression()));
+
+  // We don't know anything about the type.
 }
 
 
 void AstTyper::VisitThrow(Throw* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->exception()));
+  RECURSE(Visit(expr->exception()));
+
+  // Lower type is None already.
+  MergeUpperType(expr, Type::None());
 }
 
 
 void AstTyper::VisitProperty(Property* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->obj()));
-  CHECK_ALIVE(Visit(expr->key()));
+  RECURSE(Visit(expr->obj()));
+  RECURSE(Visit(expr->key()));
 
   expr->RecordTypeFeedback(oracle(), zone());
+
+  // We don't know anything about the type.
 }
 
 
 void AstTyper::VisitCall(Call* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->expression()));
+  RECURSE(Visit(expr->expression()));
   ZoneList<Expression*>* args = expr->arguments();
   for (int i = 0; i < args->length(); ++i) {
     Expression* arg = args->at(i);
-    CHECK_ALIVE(Visit(arg));
+    RECURSE(Visit(arg));
   }
 
   Expression* callee = expr->expression();
@@ -374,35 +377,38 @@
   } else {
     expr->RecordTypeFeedback(oracle(), CALL_AS_FUNCTION);
   }
+
+  // We don't know anything about the type.
 }
 
 
 void AstTyper::VisitCallNew(CallNew* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->expression()));
+  RECURSE(Visit(expr->expression()));
   ZoneList<Expression*>* args = expr->arguments();
   for (int i = 0; i < args->length(); ++i) {
     Expression* arg = args->at(i);
-    CHECK_ALIVE(Visit(arg));
+    RECURSE(Visit(arg));
   }
 
   expr->RecordTypeFeedback(oracle());
+
+  // We don't know anything about the type.
 }
 
 
 void AstTyper::VisitCallRuntime(CallRuntime* expr) {
-  ASSERT(!HasStackOverflow());
   ZoneList<Expression*>* args = expr->arguments();
   for (int i = 0; i < args->length(); ++i) {
     Expression* arg = args->at(i);
-    CHECK_ALIVE(Visit(arg));
+    RECURSE(Visit(arg));
   }
+
+  // We don't know anything about the type.
 }
 
 
 void AstTyper::VisitUnaryOperation(UnaryOperation* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->expression()));
+  RECURSE(Visit(expr->expression()));
 
   // Collect type feedback.
   Handle<Type> op_type = oracle()->UnaryType(expr->UnaryOperationFeedbackId());
@@ -411,25 +417,55 @@
     // TODO(rossberg): only do in test or value context.
     expr->expression()->RecordToBooleanTypeFeedback(oracle());
   }
+
+  switch (expr->op()) {
+    case Token::NOT:
+    case Token::DELETE:
+      MergeLowerType(expr, Type::Boolean());
+      MergeUpperType(expr, Type::Boolean());
+      break;
+    case Token::VOID:
+      MergeLowerType(expr, Type::Undefined());
+      MergeUpperType(expr, Type::Undefined());
+      break;
+    case Token::ADD:
+    case Token::SUB: {
+      MergeLowerType(expr, Type::Smi());
+      Type* upper = *expr->expression()->upper_type();
+      MergeUpperType(expr, upper->Is(Type::Number()) ? upper : Type::Number());
+      break;
+    }
+    case Token::BIT_NOT:
+      MergeLowerType(expr, Type::Smi());
+      MergeUpperType(expr, Type::Signed32());
+      break;
+    case Token::TYPEOF:
+      MergeLowerType(expr, Type::InternalizedString());
+      MergeUpperType(expr, Type::InternalizedString());
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 
 void AstTyper::VisitCountOperation(CountOperation* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->expression()));
+  RECURSE(Visit(expr->expression()));
 
   expr->RecordTypeFeedback(oracle(), zone());
   Property* prop = expr->expression()->AsProperty();
   if (prop != NULL) {
     prop->RecordTypeFeedback(oracle(), zone());
   }
+
+  MergeLowerType(expr, Type::Smi());
+  MergeUpperType(expr, Type::Number());
 }
 
 
 void AstTyper::VisitBinaryOperation(BinaryOperation* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->left()));
-  CHECK_ALIVE(Visit(expr->right()));
+  RECURSE(Visit(expr->left()));
+  RECURSE(Visit(expr->right()));
 
   // Collect type feedback.
   Handle<Type> type, left_type, right_type;
@@ -443,13 +479,69 @@
   if (expr->op() == Token::OR || expr->op() == Token::AND) {
     expr->left()->RecordToBooleanTypeFeedback(oracle());
   }
+
+  switch (expr->op()) {
+    case Token::COMMA:
+      MergeLowerType(expr, expr->right()->lower_type());
+      MergeUpperType(expr, expr->right()->upper_type());
+      break;
+    case Token::OR:
+    case Token::AND:
+      MergeLowerType(expr, Type::Intersect(
+          expr->left()->lower_type(), expr->right()->lower_type()));
+      MergeUpperType(expr, Type::Union(
+          expr->left()->upper_type(), expr->right()->upper_type()));
+      break;
+    case Token::BIT_OR:
+    case Token::BIT_AND: {
+      MergeLowerType(expr, Type::Smi());
+      Type* upper =
+          Type::Union(expr->left()->upper_type(), expr->right()->upper_type());
+      MergeUpperType(expr,
+          upper->Is(Type::Signed32()) ? upper : Type::Signed32());
+      break;
+    }
+    case Token::BIT_XOR:
+    case Token::SHL:
+    case Token::SAR:
+      MergeLowerType(expr, Type::Smi());
+      MergeUpperType(expr, Type::Signed32());
+      break;
+    case Token::SHR:
+      MergeLowerType(expr, Type::Smi());
+      MergeUpperType(expr, Type::Unsigned32());
+      break;
+    case Token::ADD: {
+      Handle<Type> l = expr->left()->lower_type();
+      Handle<Type> r = expr->right()->lower_type();
+      MergeLowerType(expr,
+          l->Is(Type::Number()) && r->Is(Type::Number()) ? Type::Smi() :
+          l->Is(Type::String()) || r->Is(Type::String()) ? Type::String() :
+              Type::None());
+      l = expr->left()->upper_type();
+      r = expr->right()->upper_type();
+      MergeUpperType(expr,
+          l->Is(Type::Number()) && r->Is(Type::Number()) ? Type::Number() :
+          l->Is(Type::String()) || r->Is(Type::String()) ? Type::String() :
+              Type::NumberOrString());
+      break;
+    }
+    case Token::SUB:
+    case Token::MUL:
+    case Token::DIV:
+    case Token::MOD:
+      MergeLowerType(expr, Type::Smi());
+      MergeUpperType(expr, Type::Number());
+      break;
+    default:
+      UNREACHABLE();
+  }
 }
 
 
 void AstTyper::VisitCompareOperation(CompareOperation* expr) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(expr->left()));
-  CHECK_ALIVE(Visit(expr->right()));
+  RECURSE(Visit(expr->left()));
+  RECURSE(Visit(expr->right()));
 
   // Collect type feedback.
   Handle<Type> left_type, right_type, combined_type;
@@ -458,76 +550,67 @@
   MergeLowerType(expr->left(), left_type);
   MergeLowerType(expr->right(), right_type);
   expr->set_combined_type(combined_type);
+
+  MergeLowerType(expr, Type::Boolean());
+  MergeUpperType(expr, Type::Boolean());
 }
 
 
 void AstTyper::VisitThisFunction(ThisFunction* expr) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitDeclarations(ZoneList<Declaration*>* decls) {
-  ASSERT(!HasStackOverflow());
   for (int i = 0; i < decls->length(); ++i) {
     Declaration* decl = decls->at(i);
-    CHECK_ALIVE(Visit(decl));
+    RECURSE(Visit(decl));
   }
 }
 
 
 void AstTyper::VisitVariableDeclaration(VariableDeclaration* declaration) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitFunctionDeclaration(FunctionDeclaration* declaration) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(declaration->fun()));
+  RECURSE(Visit(declaration->fun()));
 }
 
 
 void AstTyper::VisitModuleDeclaration(ModuleDeclaration* declaration) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(declaration->module()));
+  RECURSE(Visit(declaration->module()));
 }
 
 
 void AstTyper::VisitImportDeclaration(ImportDeclaration* declaration) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(declaration->module()));
+  RECURSE(Visit(declaration->module()));
 }
 
 
 void AstTyper::VisitExportDeclaration(ExportDeclaration* declaration) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitModuleLiteral(ModuleLiteral* module) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(module->body()));
+  RECURSE(Visit(module->body()));
 }
 
 
 void AstTyper::VisitModuleVariable(ModuleVariable* module) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitModulePath(ModulePath* module) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(module->module()));
+  RECURSE(Visit(module->module()));
 }
 
 
 void AstTyper::VisitModuleUrl(ModuleUrl* module) {
-  ASSERT(!HasStackOverflow());
 }
 
 
 void AstTyper::VisitModuleStatement(ModuleStatement* stmt) {
-  ASSERT(!HasStackOverflow());
-  CHECK_ALIVE(Visit(stmt->body()));
+  RECURSE(Visit(stmt->body()));
 }
 
 
diff --git a/src/typing.h b/src/typing.h
index 2d3fac0..b37a0cb 100644
--- a/src/typing.h
+++ b/src/typing.h
@@ -68,6 +68,12 @@
   void MergeUpperType(Expression* e, Handle<Type> t) {
     e->set_upper_type(handle(Type::Intersect(e->upper_type(), t), isolate_));
   }
+  void MergeLowerType(Expression* e, Type* t) {
+    MergeLowerType(e, handle(t, isolate_));
+  }
+  void MergeUpperType(Expression* e, Type* t) {
+    MergeUpperType(e, handle(t, isolate_));
+  }
 
   void VisitDeclarations(ZoneList<Declaration*>* declarations);
   void VisitStatements(ZoneList<Statement*>* statements);
diff --git a/src/version.cc b/src/version.cc
index 4ded5d2..1c6cc68 100644
--- a/src/version.cc
+++ b/src/version.cc
@@ -34,7 +34,7 @@
 // system so their names cannot be changed without changing the scripts.
 #define MAJOR_VERSION     3
 #define MINOR_VERSION     20
-#define BUILD_NUMBER      3
+#define BUILD_NUMBER      4
 #define PATCH_LEVEL       0
 // Use 1 for candidates and 0 otherwise.
 // (Boolean macro values are not supported by all preprocessors.)
diff --git a/src/win32-headers.h b/src/win32-headers.h
index 5d9c89e..2b5d7d7 100644
--- a/src/win32-headers.h
+++ b/src/win32-headers.h
@@ -89,8 +89,6 @@
 #undef THIS
 #undef CONST
 #undef NAN
-#undef TRUE
-#undef FALSE
 #undef UNKNOWN
 #undef NONE
 #undef ANY
diff --git a/src/x64/code-stubs-x64.cc b/src/x64/code-stubs-x64.cc
index e4136ba..0c0c272 100644
--- a/src/x64/code-stubs-x64.cc
+++ b/src/x64/code-stubs-x64.cc
@@ -61,6 +61,16 @@
 }
 
 
+void CreateAllocationSiteStub::InitializeInterfaceDescriptor(
+    Isolate* isolate,
+    CodeStubInterfaceDescriptor* descriptor) {
+  static Register registers[] = { rbx };
+  descriptor->register_param_count_ = 1;
+  descriptor->register_params_ = registers;
+  descriptor->deoptimization_handler_ = NULL;
+}
+
+
 void KeyedLoadFastElementStub::InitializeInterfaceDescriptor(
     Isolate* isolate,
     CodeStubInterfaceDescriptor* descriptor) {
@@ -2035,7 +2045,8 @@
 
   StubCompiler::GenerateLoadFunctionPrototype(masm, receiver, r8, r9, &miss);
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -2064,7 +2075,8 @@
   StubCompiler::GenerateLoadStringLength(masm, receiver, r8, r9, &miss,
                                          support_wrapper_);
   __ bind(&miss);
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -2127,7 +2139,8 @@
 
   __ bind(&miss);
 
-  StubCompiler::TailCallBuiltin(masm, StubCompiler::MissBuiltin(kind()));
+  StubCompiler::TailCallBuiltin(
+      masm, BaseLoadStoreStubCompiler::MissBuiltin(kind()));
 }
 
 
@@ -3505,17 +3518,15 @@
   __ Cmp(rcx, TypeFeedbackCells::MegamorphicSentinel(isolate));
   __ j(equal, &done);
 
-  // Special handling of the Array() function, which caches not only the
-  // monomorphic Array function but the initial ElementsKind with special
-  // sentinels
-  __ JumpIfNotSmi(rcx, &miss);
-  if (FLAG_debug_code) {
-    Handle<Object> terminal_kind_sentinel =
-        TypeFeedbackCells::MonomorphicArraySentinel(masm->isolate(),
-                                                    LAST_FAST_ELEMENTS_KIND);
-    __ Cmp(rcx, terminal_kind_sentinel);
-    __ Assert(less_equal, "Array function sentinel is not an ElementsKind");
-  }
+  // If we came here, we need to see if we are the array function.
+  // If we didn't have a matching function, and we didn't find the megamorph
+  // sentinel, then we have in the cell either some other function or an
+  // AllocationSite. Do a map check on the object in rcx.
+  Handle<Map> allocation_site_map(
+      masm->isolate()->heap()->allocation_site_map(),
+      masm->isolate());
+  __ Cmp(FieldOperand(rcx, 0), allocation_site_map);
+  __ j(not_equal, &miss);
 
   // Make sure the function is the Array() function
   __ LoadArrayFunction(rcx);
@@ -3534,7 +3545,7 @@
   __ bind(&megamorphic);
   __ Move(FieldOperand(rbx, Cell::kValueOffset),
           TypeFeedbackCells::MegamorphicSentinel(isolate));
-  __ jmp(&done, Label::kNear);
+  __ jmp(&done);
 
   // An uninitialized cache is patched with the function or sentinel to
   // indicate the ElementsKind if function is the Array constructor.
@@ -3544,14 +3555,22 @@
   __ cmpq(rdi, rcx);
   __ j(not_equal, &not_array_function);
 
-  // The target function is the Array constructor, install a sentinel value in
-  // the constructor's type info cell that will track the initial ElementsKind
-  // that should be used for the array when its constructed.
-  Handle<Object> initial_kind_sentinel =
-      TypeFeedbackCells::MonomorphicArraySentinel(isolate,
-          GetInitialFastElementsKind());
-  __ Move(FieldOperand(rbx, Cell::kValueOffset),
-          initial_kind_sentinel);
+  // The target function is the Array constructor,
+  // Create an AllocationSite if we don't already have it, store it in the cell
+  {
+    FrameScope scope(masm, StackFrame::INTERNAL);
+
+    __ push(rax);
+    __ push(rdi);
+    __ push(rbx);
+
+    CreateAllocationSiteStub create_stub;
+    __ CallStub(&create_stub);
+
+    __ pop(rbx);
+    __ pop(rdi);
+    __ pop(rax);
+  }
   __ jmp(&done);
 
   __ bind(&not_array_function);
@@ -3721,6 +3740,7 @@
   // It is important that the store buffer overflow stubs are generated first.
   RecordWriteStub::GenerateFixedRegStubsAheadOfTime(isolate);
   ArrayConstructorStubBase::GenerateStubsAheadOfTime(isolate);
+  CreateAllocationSiteStub::GenerateAheadOfTime(isolate);
 }
 
 
@@ -6536,18 +6556,20 @@
   __ j(zero, &normal_sequence);
 
   // We are going to create a holey array, but our kind is non-holey.
-  // Fix kind and retry
+  // Fix kind and retry (only if we have an allocation site in the cell).
   __ incl(rdx);
   __ Cmp(rbx, undefined_sentinel);
   __ j(equal, &normal_sequence);
-
-  // The type cell may have gone megamorphic, don't overwrite if so
-  __ movq(rcx, FieldOperand(rbx, kPointerSize));
-  __ JumpIfNotSmi(rcx, &normal_sequence);
+  __ movq(rcx, FieldOperand(rbx, Cell::kValueOffset));
+  Handle<Map> allocation_site_map(
+      masm->isolate()->heap()->allocation_site_map(),
+      masm->isolate());
+  __ Cmp(FieldOperand(rcx, 0), allocation_site_map);
+  __ j(not_equal, &normal_sequence);
 
   // Save the resulting elements kind in type info
   __ Integer32ToSmi(rdx, rdx);
-  __ movq(FieldOperand(rbx, kPointerSize), rdx);
+  __ movq(FieldOperand(rcx, AllocationSite::kTransitionInfoOffset), rdx);
   __ SmiToInteger32(rdx, rdx);
 
   __ bind(&normal_sequence);
@@ -6576,7 +6598,7 @@
     ElementsKind kind = GetFastElementsKindFromSequenceIndex(i);
     T stub(kind);
     stub.GetCode(isolate)->set_is_pregenerated(true);
-    if (AllocationSiteInfo::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
+    if (AllocationSite::GetMode(kind) != DONT_TRACK_ALLOCATION_SITE) {
       T stub1(kind, CONTEXT_CHECK_REQUIRED, DISABLE_ALLOCATION_SITES);
       stub1.GetCode(isolate)->set_is_pregenerated(true);
     }
@@ -6649,7 +6671,17 @@
   __ Cmp(rbx, undefined_sentinel);
   __ j(equal, &no_info);
   __ movq(rdx, FieldOperand(rbx, Cell::kValueOffset));
-  __ JumpIfNotSmi(rdx, &no_info);
+
+  // The type cell may have undefined in its value.
+  __ Cmp(rdx, undefined_sentinel);
+  __ j(equal, &no_info);
+
+  // The type cell has either an AllocationSite or a JSFunction
+  __ Cmp(FieldOperand(rdx, 0),
+         Handle<Map>(masm->isolate()->heap()->allocation_site_map()));
+  __ j(not_equal, &no_info);
+
+  __ movq(rdx, FieldOperand(rdx, AllocationSite::kTransitionInfoOffset));
   __ SmiToInteger32(rdx, rdx);
   __ jmp(&switch_ready);
   __ bind(&no_info);
diff --git a/src/x64/ic-x64.cc b/src/x64/ic-x64.cc
index a8de443..22b403c 100644
--- a/src/x64/ic-x64.cc
+++ b/src/x64/ic-x64.cc
@@ -673,8 +673,8 @@
                                          rbx,
                                          rdi,
                                          slow);
-  AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                        FAST_DOUBLE_ELEMENTS);
+  AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                    FAST_DOUBLE_ELEMENTS);
   ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, slow);
   __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
   __ jmp(&fast_double_without_map_check);
@@ -686,7 +686,7 @@
                                          rbx,
                                          rdi,
                                          slow);
-  mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateMapChangeElementsTransition(masm, mode,
                                                                    slow);
   __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
@@ -702,7 +702,7 @@
                                          rbx,
                                          rdi,
                                          slow);
-  mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
+  mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS, FAST_ELEMENTS);
   ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, slow);
   __ movq(rbx, FieldOperand(rdx, JSObject::kElementsOffset));
   __ jmp(&finish_object_store);
@@ -1449,8 +1449,9 @@
   // -----------------------------------
 
   // Get the receiver from the stack and probe the stub cache.
-  Code::Flags flags =
-      Code::ComputeFlags(Code::STORE_IC, MONOMORPHIC, strict_mode);
+  Code::Flags flags = Code::ComputeFlags(
+      Code::STUB, MONOMORPHIC, strict_mode,
+      Code::NORMAL, Code::STORE_IC);
   Isolate::Current()->stub_cache()->GenerateProbe(masm, flags, rdx, rcx, rbx,
                                                   no_reg);
 
@@ -1618,8 +1619,8 @@
   // Must return the modified receiver in eax.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_SMI_ELEMENTS,
-                                                          FAST_DOUBLE_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_SMI_ELEMENTS,
+                                                      FAST_DOUBLE_ELEMENTS);
     ElementsTransitionGenerator::GenerateSmiToDouble(masm, mode, &fail);
     __ movq(rax, rdx);
     __ Ret();
@@ -1643,8 +1644,8 @@
   // Must return the modified receiver in eax.
   if (!FLAG_trace_elements_transitions) {
     Label fail;
-    AllocationSiteMode mode = AllocationSiteInfo::GetMode(FAST_DOUBLE_ELEMENTS,
-                                                          FAST_ELEMENTS);
+    AllocationSiteMode mode = AllocationSite::GetMode(FAST_DOUBLE_ELEMENTS,
+                                                      FAST_ELEMENTS);
     ElementsTransitionGenerator::GenerateDoubleToObject(masm, mode, &fail);
     __ movq(rax, rdx);
     __ Ret();
diff --git a/src/x64/lithium-codegen-x64.cc b/src/x64/lithium-codegen-x64.cc
index 8a2a086..9dfc972 100644
--- a/src/x64/lithium-codegen-x64.cc
+++ b/src/x64/lithium-codegen-x64.cc
@@ -3890,7 +3890,7 @@
   __ Move(rbx, instr->hydrogen()->property_cell());
   ElementsKind kind = instr->hydrogen()->elements_kind();
   AllocationSiteOverrideMode override_mode =
-      (AllocationSiteInfo::GetMode(kind) == TRACK_ALLOCATION_SITE)
+      (AllocationSite::GetMode(kind) == TRACK_ALLOCATION_SITE)
           ? DISABLE_ALLOCATION_SITES
           : DONT_OVERRIDE;
   ContextCheckMode context_mode = CONTEXT_CHECK_NOT_REQUIRED;
@@ -5472,38 +5472,6 @@
 }
 
 
-void LCodeGen::DoDeleteProperty(LDeleteProperty* instr) {
-  LOperand* obj = instr->object();
-  LOperand* key = instr->key();
-  EmitPushTaggedOperand(obj);
-  EmitPushTaggedOperand(key);
-  ASSERT(instr->HasPointerMap());
-  LPointerMap* pointers = instr->pointer_map();
-  RecordPosition(pointers->position());
-  // Create safepoint generator that will also ensure enough space in the
-  // reloc info for patching in deoptimization (since this is invoking a
-  // builtin)
-  SafepointGenerator safepoint_generator(
-      this, pointers, Safepoint::kLazyDeopt);
-  __ Push(Smi::FromInt(strict_mode_flag()));
-  __ InvokeBuiltin(Builtins::DELETE, CALL_FUNCTION, safepoint_generator);
-}
-
-
-void LCodeGen::DoIn(LIn* instr) {
-  LOperand* obj = instr->object();
-  LOperand* key = instr->key();
-  EmitPushTaggedOperand(key);
-  EmitPushTaggedOperand(obj);
-  ASSERT(instr->HasPointerMap());
-  LPointerMap* pointers = instr->pointer_map();
-  RecordPosition(pointers->position());
-  SafepointGenerator safepoint_generator(
-      this, pointers, Safepoint::kLazyDeopt);
-  __ InvokeBuiltin(Builtins::IN, CALL_FUNCTION, safepoint_generator);
-}
-
-
 void LCodeGen::DoDeferredStackCheck(LStackCheck* instr) {
   PushSafepointRegistersScope scope(this);
   __ movq(rsi, Operand(rbp, StandardFrameConstants::kContextOffset));
diff --git a/src/x64/lithium-x64.cc b/src/x64/lithium-x64.cc
index 950bf4d..4fa0683 100644
--- a/src/x64/lithium-x64.cc
+++ b/src/x64/lithium-x64.cc
@@ -2367,14 +2367,6 @@
 }
 
 
-LInstruction* LChunkBuilder::DoDeleteProperty(HDeleteProperty* instr) {
-  LOperand* object = UseAtStart(instr->object());
-  LOperand* key = UseOrConstantAtStart(instr->key());
-  LDeleteProperty* result = new(zone()) LDeleteProperty(object, key);
-  return MarkAsCall(DefineFixed(result, rax), instr);
-}
-
-
 LInstruction* LChunkBuilder::DoOsrEntry(HOsrEntry* instr) {
   ASSERT(argument_count_ == 0);
   allocator_->MarkAsOsrEntry();
@@ -2548,14 +2540,6 @@
 }
 
 
-LInstruction* LChunkBuilder::DoIn(HIn* instr) {
-  LOperand* key = UseOrConstantAtStart(instr->key());
-  LOperand* object = UseOrConstantAtStart(instr->object());
-  LIn* result = new(zone()) LIn(key, object);
-  return MarkAsCall(DefineFixed(result, rax), instr);
-}
-
-
 LInstruction* LChunkBuilder::DoForInPrepareMap(HForInPrepareMap* instr) {
   LOperand* object = UseFixed(instr->enumerable(), rax);
   LForInPrepareMap* result = new(zone()) LForInPrepareMap(object);
diff --git a/src/x64/lithium-x64.h b/src/x64/lithium-x64.h
index 6efa9d3..b065c8c 100644
--- a/src/x64/lithium-x64.h
+++ b/src/x64/lithium-x64.h
@@ -92,7 +92,6 @@
   V(Context)                                    \
   V(DebugBreak)                                 \
   V(DeclareGlobals)                             \
-  V(DeleteProperty)                             \
   V(Deoptimize)                                 \
   V(DivI)                                       \
   V(DoubleToI)                                  \
@@ -107,7 +106,6 @@
   V(Goto)                                       \
   V(HasCachedArrayIndexAndBranch)               \
   V(HasInstanceTypeAndBranch)                   \
-  V(In)                                         \
   V(InstanceOf)                                 \
   V(InstanceOfKnownGlobal)                      \
   V(InstanceSize)                               \
@@ -1033,20 +1031,6 @@
 };
 
 
-class LIn: public LTemplateInstruction<1, 2, 0> {
- public:
-  LIn(LOperand* key, LOperand* object) {
-    inputs_[0] = key;
-    inputs_[1] = object;
-  }
-
-  LOperand* key() { return inputs_[0]; }
-  LOperand* object() { return inputs_[1]; }
-
-  DECLARE_CONCRETE_INSTRUCTION(In, "in")
-};
-
-
 class LInstanceOf: public LTemplateInstruction<1, 2, 0> {
  public:
   LInstanceOf(LOperand* left, LOperand* right) {
@@ -2481,20 +2465,6 @@
 };
 
 
-class LDeleteProperty: public LTemplateInstruction<1, 2, 0> {
- public:
-  LDeleteProperty(LOperand* obj, LOperand* key) {
-    inputs_[0] = obj;
-    inputs_[1] = key;
-  }
-
-  LOperand* object() { return inputs_[0]; }
-  LOperand* key() { return inputs_[1]; }
-
-  DECLARE_CONCRETE_INSTRUCTION(DeleteProperty, "delete-property")
-};
-
-
 class LOsrEntry: public LTemplateInstruction<0, 0, 0> {
  public:
   LOsrEntry() {}
diff --git a/src/x64/stub-cache-x64.cc b/src/x64/stub-cache-x64.cc
index 4b3ee40..bde1d0b 100644
--- a/src/x64/stub-cache-x64.cc
+++ b/src/x64/stub-cache-x64.cc
@@ -757,86 +757,53 @@
 }
 
 
-// Both name_reg and receiver_reg are preserved on jumps to miss_label,
-// but may be destroyed if store is successful.
-void StubCompiler::GenerateStoreTransition(MacroAssembler* masm,
-                                           Handle<JSObject> object,
-                                           LookupResult* lookup,
-                                           Handle<Map> transition,
-                                           Handle<Name> name,
-                                           Register receiver_reg,
-                                           Register name_reg,
-                                           Register value_reg,
-                                           Register scratch1,
-                                           Register scratch2,
-                                           Register unused,
-                                           Label* miss_label,
-                                           Label* miss_restore_name,
-                                           Label* slow) {
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, Handle<Map>(object->map()),
-              miss_label, DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, miss_label);
+void BaseStoreStubCompiler::GenerateNegativeHolderLookup(
+    MacroAssembler* masm,
+    Handle<JSObject> holder,
+    Register holder_reg,
+    Handle<Name> name,
+    Label* miss) {
+  if (holder->IsJSGlobalObject()) {
+    GenerateCheckPropertyCell(
+        masm, Handle<GlobalObject>::cast(holder), name, scratch1(), miss);
+  } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
+    GenerateDictionaryNegativeLookup(
+        masm, miss, holder_reg, name, scratch1(), scratch2());
   }
+}
 
+
+// Receiver_reg is preserved on jumps to miss_label, but may be destroyed if
+// store is successful.
+void BaseStoreStubCompiler::GenerateStoreTransition(MacroAssembler* masm,
+                                                    Handle<JSObject> object,
+                                                    LookupResult* lookup,
+                                                    Handle<Map> transition,
+                                                    Handle<Name> name,
+                                                    Register receiver_reg,
+                                                    Register storage_reg,
+                                                    Register value_reg,
+                                                    Register scratch1,
+                                                    Register scratch2,
+                                                    Register unused,
+                                                    Label* miss_label,
+                                                    Label* slow) {
   int descriptor = transition->LastAdded();
   DescriptorArray* descriptors = transition->instance_descriptors();
   PropertyDetails details = descriptors->GetDetails(descriptor);
   Representation representation = details.representation();
   ASSERT(!representation.IsNone());
 
-  // Ensure no transitions to deprecated maps are followed.
-  __ CheckMapDeprecated(transition, scratch1, miss_label);
-
-  // Check that we are allowed to write this.
-  if (object->GetPrototype()->IsJSObject()) {
-    JSObject* holder;
-    // holder == object indicates that no property was found.
-    if (lookup->holder() != *object) {
-      holder = lookup->holder();
-    } else {
-      // Find the top object.
-      holder = *object;
-      do {
-        holder = JSObject::cast(holder->GetPrototype());
-      } while (holder->GetPrototype()->IsJSObject());
-    }
-    Register holder_reg = CheckPrototypes(
-        object, receiver_reg, Handle<JSObject>(holder), name_reg,
-        scratch1, scratch2, name, miss_restore_name, SKIP_RECEIVER);
-    // If no property was found, and the holder (the last object in the
-    // prototype chain) is in slow mode, we need to do a negative lookup on the
-    // holder.
-    if (lookup->holder() == *object) {
-      if (holder->IsJSGlobalObject()) {
-        GenerateCheckPropertyCell(
-            masm,
-            Handle<GlobalObject>(GlobalObject::cast(holder)),
-            name,
-            scratch1,
-            miss_restore_name);
-      } else if (!holder->HasFastProperties() && !holder->IsJSGlobalProxy()) {
-        GenerateDictionaryNegativeLookup(
-            masm, miss_restore_name, holder_reg, name, scratch1, scratch2);
-      }
-    }
-  }
-
-  Register storage_reg = name_reg;
-
   if (details.type() == CONSTANT_FUNCTION) {
     Handle<HeapObject> constant(
         HeapObject::cast(descriptors->GetValue(descriptor)));
     __ LoadHeapObject(scratch1, constant);
     __ cmpq(value_reg, scratch1);
-    __ j(not_equal, miss_restore_name);
+    __ j(not_equal, miss_label);
   } else if (FLAG_track_fields && representation.IsSmi()) {
-    __ JumpIfNotSmi(value_reg, miss_restore_name);
+    __ JumpIfNotSmi(value_reg, miss_label);
   } else if (FLAG_track_heap_object_fields && representation.IsHeapObject()) {
-    __ JumpIfSmi(value_reg, miss_restore_name);
+    __ JumpIfSmi(value_reg, miss_label);
   } else if (FLAG_track_double_fields && representation.IsDouble()) {
     Label do_store, heap_number;
     __ AllocateHeapNumber(storage_reg, scratch1, slow);
@@ -848,7 +815,7 @@
 
     __ bind(&heap_number);
     __ CheckMap(value_reg, masm->isolate()->factory()->heap_number_map(),
-                miss_restore_name, DONT_DO_SMI_CHECK);
+                miss_label, DONT_DO_SMI_CHECK);
     __ movsd(xmm0, FieldOperand(value_reg, HeapNumber::kValueOffset));
 
     __ bind(&do_store);
@@ -918,14 +885,11 @@
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
       // Update the write barrier for the array address.
-      // Pass the value being stored in the now unused name_reg.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ movq(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ movq(storage_reg, value_reg);
       }
       __ RecordWriteField(
-          receiver_reg, offset, name_reg, scratch1, kDontSaveFPRegs,
+          receiver_reg, offset, storage_reg, scratch1, kDontSaveFPRegs,
           EMIT_REMEMBERED_SET, smi_check);
     }
   } else {
@@ -941,14 +905,11 @@
 
     if (!FLAG_track_fields || !representation.IsSmi()) {
       // Update the write barrier for the array address.
-      // Pass the value being stored in the now unused name_reg.
       if (!FLAG_track_double_fields || !representation.IsDouble()) {
-        __ movq(name_reg, value_reg);
-      } else {
-        ASSERT(storage_reg.is(name_reg));
+        __ movq(storage_reg, value_reg);
       }
       __ RecordWriteField(
-          scratch1, offset, name_reg, receiver_reg, kDontSaveFPRegs,
+          scratch1, offset, storage_reg, receiver_reg, kDontSaveFPRegs,
           EMIT_REMEMBERED_SET, smi_check);
     }
   }
@@ -961,24 +922,15 @@
 
 // Both name_reg and receiver_reg are preserved on jumps to miss_label,
 // but may be destroyed if store is successful.
-void StubCompiler::GenerateStoreField(MacroAssembler* masm,
-                                      Handle<JSObject> object,
-                                      LookupResult* lookup,
-                                      Register receiver_reg,
-                                      Register name_reg,
-                                      Register value_reg,
-                                      Register scratch1,
-                                      Register scratch2,
-                                      Label* miss_label) {
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver_reg, Handle<Map>(object->map()),
-              miss_label, DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver_reg, scratch1, miss_label);
-  }
-
+void BaseStoreStubCompiler::GenerateStoreField(MacroAssembler* masm,
+                                               Handle<JSObject> object,
+                                               LookupResult* lookup,
+                                               Register receiver_reg,
+                                               Register name_reg,
+                                               Register value_reg,
+                                               Register scratch1,
+                                               Register scratch2,
+                                               Label* miss_label) {
   // Stub never generated for non-global objects that require access
   // checks.
   ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
@@ -1212,7 +1164,8 @@
 }
 
 
-void BaseLoadStubCompiler::HandlerFrontendFooter(Label* success,
+void BaseLoadStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                 Label* success,
                                                  Label* miss) {
   if (!miss->is_unused()) {
     __ jmp(success);
@@ -1222,6 +1175,17 @@
 }
 
 
+void BaseStoreStubCompiler::HandlerFrontendFooter(Handle<Name> name,
+                                                  Label* success,
+                                                  Label* miss) {
+  if (!miss->is_unused()) {
+    __ jmp(success);
+    GenerateRestoreName(masm(), miss, name);
+    TailCallBuiltin(masm(), MissBuiltin(kind()));
+  }
+}
+
+
 Register BaseLoadStubCompiler::CallbackHandlerFrontend(
     Handle<JSObject> object,
     Register object_reg,
@@ -1268,7 +1232,7 @@
     __ j(not_equal, &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
   return reg;
 }
 
@@ -1289,7 +1253,7 @@
     GenerateCheckPropertyCell(masm(), global, name, scratch2(), &miss);
   }
 
-  HandlerFrontendFooter(success, &miss);
+  HandlerFrontendFooter(name, success, &miss);
 }
 
 
@@ -1641,11 +1605,11 @@
     GenerateLoadFunctionFromCell(cell, function, &miss);
   }
 
-  Handle<Smi> kind(Smi::FromInt(GetInitialFastElementsKind()), isolate());
-  Handle<Cell> kind_feedback_cell =
-      isolate()->factory()->NewCell(kind);
+  Handle<AllocationSite> site = isolate()->factory()->NewAllocationSite();
+  site->set_transition_info(Smi::FromInt(GetInitialFastElementsKind()));
+  Handle<Cell> site_feedback_cell = isolate()->factory()->NewCell(site);
   __ movq(rax, Immediate(argc));
-  __ Move(rbx, kind_feedback_cell);
+  __ Move(rbx, site_feedback_cell);
   __ Move(rdi, function);
 
   ArrayConstructorStub stub(isolate());
@@ -2674,23 +2638,18 @@
 
 
 Handle<Code> StoreStubCompiler::CompileStoreCallback(
-    Handle<Name> name,
     Handle<JSObject> object,
     Handle<JSObject> holder,
+    Handle<Name> name,
     Handle<ExecutableAccessorInfo> callback) {
-  Label miss;
-  // Check that the maps haven't changed.
-  __ JumpIfSmi(receiver(), &miss);
-  CheckPrototypes(object, receiver(), holder,
-                  scratch1(), scratch2(), scratch3(), name, &miss);
-
-  // Stub never generated for non-global objects that require access checks.
-  ASSERT(holder->IsJSGlobalProxy() || !holder->IsAccessCheckNeeded());
+  Label success;
+  HandlerFrontend(object, receiver(), holder, name, &success);
+  __ bind(&success);
 
   __ pop(scratch1());  // remove the return address
   __ push(receiver());
   __ Push(callback);  // callback info
-  __ push(this->name());
+  __ Push(name);
   __ push(value());
   __ push(scratch1());  // restore return address
 
@@ -2699,12 +2658,8 @@
       ExternalReference(IC_Utility(IC::kStoreCallbackProperty), isolate());
   __ TailCallExternalReference(store_callback_property, 4, 1);
 
-  // Handle store cache miss.
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
   // Return the generated code.
-  return GetICCode(kind(), Code::CALLBACKS, name);
+  return GetCode(kind(), Code::CALLBACKS, name);
 }
 
 
@@ -2758,20 +2713,6 @@
 Handle<Code> StoreStubCompiler::CompileStoreInterceptor(
     Handle<JSObject> object,
     Handle<Name> name) {
-  Label miss;
-
-  // Check that the map of the object hasn't changed.
-  __ CheckMap(receiver(), Handle<Map>(object->map()), &miss, DO_SMI_CHECK);
-
-  // Perform global security token check if needed.
-  if (object->IsJSGlobalProxy()) {
-    __ CheckAccessGlobalProxy(receiver(), scratch1(), &miss);
-  }
-
-  // Stub never generated for non-global objects that require access
-  // checks.
-  ASSERT(object->IsJSGlobalProxy() || !object->IsAccessCheckNeeded());
-
   __ pop(scratch1());  // remove the return address
   __ push(receiver());
   __ push(this->name());
@@ -2784,12 +2725,8 @@
       ExternalReference(IC_Utility(IC::kStoreInterceptorProperty), isolate());
   __ TailCallExternalReference(store_ic_property, 4, 1);
 
-  // Handle store cache miss.
-  __ bind(&miss);
-  TailCallBuiltin(masm(), MissBuiltin(kind()));
-
   // Return the generated code.
-  return GetICCode(kind(), Code::INTERCEPTOR, name);
+  return GetCode(kind(), Code::INTERCEPTOR, name);
 }
 
 
@@ -3000,7 +2937,7 @@
     __ Check(not_equal, "DontDelete cells can't contain the hole");
   }
 
-  HandlerFrontendFooter(&success, &miss);
+  HandlerFrontendFooter(name, &success, &miss);
   __ bind(&success);
 
   Counters* counters = isolate()->counters();
@@ -3013,7 +2950,7 @@
 }
 
 
-Handle<Code> BaseLoadStubCompiler::CompilePolymorphicIC(
+Handle<Code> BaseLoadStoreStubCompiler::CompilePolymorphicIC(
     MapHandleList* receiver_maps,
     CodeHandleList* handlers,
     Handle<Name> name,
diff --git a/test/cctest/cctest.gyp b/test/cctest/cctest.gyp
index a65de86..4e5d649 100644
--- a/test/cctest/cctest.gyp
+++ b/test/cctest/cctest.gyp
@@ -30,7 +30,7 @@
     'v8_code': 1,
     'generated_file': '<(SHARED_INTERMEDIATE_DIR)/resources.cc',
   },
-  'includes': ['../../build/common.gypi'],
+  'includes': ['../../build/toolchain.gypi', '../../build/features.gypi'],
   'targets': [
     {
       'target_name': 'cctest',
diff --git a/test/cctest/test-cpu-profiler.cc b/test/cctest/test-cpu-profiler.cc
index e880d17..8168a61 100644
--- a/test/cctest/test-cpu-profiler.cc
+++ b/test/cctest/test-cpu-profiler.cc
@@ -40,6 +40,7 @@
 using i::CpuProfile;
 using i::CpuProfiler;
 using i::CpuProfilesCollection;
+using i::Heap;
 using i::ProfileGenerator;
 using i::ProfileNode;
 using i::ProfilerEventsProcessor;
@@ -412,6 +413,33 @@
 }
 
 
+static const v8::CpuProfile* RunProfiler(
+    LocalContext& env, v8::Handle<v8::Function> function,
+    v8::Handle<v8::Value> argv[], int argc,
+    unsigned min_js_samples) {
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
+  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
+
+  cpu_profiler->StartCpuProfiling(profile_name);
+
+  i::Sampler* sampler =
+      reinterpret_cast<i::Isolate*>(env->GetIsolate())->logger()->sampler();
+  sampler->StartCountingSamples();
+  do {
+    function->Call(env->Global(), argc, argv);
+  } while (sampler->js_and_external_sample_count() < min_js_samples);
+
+  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
+
+  CHECK_NE(NULL, profile);
+  // Dump collected profile to have a better diagnostic in case of failure.
+  reinterpret_cast<i::CpuProfile*>(
+      const_cast<v8::CpuProfile*>(profile))->Print();
+
+  return profile;
+}
+
+
 static bool ContainsString(v8::Handle<v8::String> string,
                            const Vector<v8::Handle<v8::String> >& vector) {
   for (int i = 0; i < vector.length(); i++) {
@@ -525,24 +553,11 @@
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t profiling_interval_ms = 200;
-#if defined(_WIN32) || defined(_WIN64)
-  // 200ms is not enough on Windows. See
-  // https://code.google.com/p/v8/issues/detail?id=2628
-  profiling_interval_ms = 500;
-#endif
   v8::Handle<v8::Value> args[] = { v8::Integer::New(profiling_interval_ms) };
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 200);
   function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
 
@@ -565,6 +580,7 @@
   const char* delayBranch[] = { "delay", "loop" };
   CheckSimpleBranch(fooNode, delayBranch, ARRAY_SIZE(delayBranch));
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -598,23 +614,14 @@
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t repeat_count = 100;
 #if defined(USE_SIMULATOR)
   // Simulators are much slower.
   repeat_count = 1;
 #endif
   v8::Handle<v8::Value> args[] = { v8::Integer::New(repeat_count) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 100);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
 
@@ -636,6 +643,7 @@
     }
   }
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -728,25 +736,17 @@
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t repeat_count = 1;
   v8::Handle<v8::Value> args[] = { v8::Integer::New(repeat_count) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 180);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   const v8::CpuProfileNode* startNode = GetChild(root, "start");
   GetChild(startNode, "get foo");
   GetChild(startNode, "set foo");
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -786,25 +786,17 @@
     accessors.set_warming_up(false);
   }
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t repeat_count = 100;
   v8::Handle<v8::Value> args[] = { v8::Integer::New(repeat_count) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 200);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   const v8::CpuProfileNode* startNode = GetChild(root, "start");
   GetChild(startNode, "get foo");
   GetChild(startNode, "set foo");
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -839,24 +831,16 @@
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t repeat_count = 1;
   v8::Handle<v8::Value> args[] = { v8::Integer::New(repeat_count) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 100);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   const v8::CpuProfileNode* startNode = GetChild(root, "start");
   GetChild(startNode, "fooMethod");
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -893,25 +877,17 @@
     callbacks.set_warming_up(false);
   }
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t repeat_count = 100;
   v8::Handle<v8::Value> args[] = { v8::Integer::New(repeat_count) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 100);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   GetChild(root, "start");
   const v8::CpuProfileNode* startNode = GetChild(root, "start");
   GetChild(startNode, "fooMethod");
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -938,19 +914,10 @@
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t duration_ms = 100;
   v8::Handle<v8::Value> args[] = { v8::Integer::New(duration_ms) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 100);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   ScopedVector<v8::Handle<v8::String> > names(3);
@@ -963,6 +930,7 @@
   const v8::CpuProfileNode* startNode = GetChild(root, "start");
   GetChild(startNode, "foo");
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -995,28 +963,17 @@
   LocalContext env;
   v8::HandleScope scope(env->GetIsolate());
 
+  // Collect garbage that might have be generated while installing extensions.
+  HEAP->CollectAllGarbage(Heap::kNoGCFlags);
+
   v8::Script::Compile(v8::String::New(call_function_test_source))->Run();
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t duration_ms = 100;
-#if defined(_WIN32) || defined(_WIN64)
-  // 100ms is not enough on Windows. See
-  // https://code.google.com/p/v8/issues/detail?id=2628
-  duration_ms = 400;
-#endif
   v8::Handle<v8::Value> args[] = { v8::Integer::New(duration_ms) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
-
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 100);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   {
@@ -1050,6 +1007,7 @@
     CheckChildrenNames(unresolvedNode, names);
   }
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
 
@@ -1087,24 +1045,11 @@
   v8::Local<v8::Function> function = v8::Local<v8::Function>::Cast(
       env->Global()->Get(v8::String::New("start")));
 
-  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
-  v8::Local<v8::String> profile_name = v8::String::New("my_profile");
-
-  cpu_profiler->StartCpuProfiling(profile_name);
   int32_t duration_ms = 100;
-#if defined(_WIN32) || defined(_WIN64)
-  // 100ms is not enough on Windows. See
-  // https://code.google.com/p/v8/issues/detail?id=2628
-  duration_ms = 400;
-#endif
   v8::Handle<v8::Value> args[] = { v8::Integer::New(duration_ms) };
-  function->Call(env->Global(), ARRAY_SIZE(args), args);
-  const v8::CpuProfile* profile = cpu_profiler->StopCpuProfiling(profile_name);
 
-  CHECK_NE(NULL, profile);
-  // Dump collected profile to have a better diagnostic in case of failure.
-  reinterpret_cast<i::CpuProfile*>(
-      const_cast<v8::CpuProfile*>(profile))->Print();
+  const v8::CpuProfile* profile =
+      RunProfiler(env, function, args, ARRAY_SIZE(args), 100);
 
   const v8::CpuProfileNode* root = profile->GetTopDownRoot();
   {
@@ -1142,5 +1087,6 @@
     }
   }
 
+  v8::CpuProfiler* cpu_profiler = env->GetIsolate()->GetCpuProfiler();
   cpu_profiler->DeleteAllCpuProfiles();
 }
diff --git a/test/cctest/test-heap-profiler.cc b/test/cctest/test-heap-profiler.cc
index ba6a97a..edcfff2 100644
--- a/test/cctest/test-heap-profiler.cc
+++ b/test/cctest/test-heap-profiler.cc
@@ -127,6 +127,43 @@
 }
 
 
+static bool AddressesMatch(void* key1, void* key2) {
+  return key1 == key2;
+}
+
+
+// Check that snapshot has no unretained entries except root.
+static bool ValidateSnapshot(const v8::HeapSnapshot* snapshot, int depth) {
+  i::HeapSnapshot* heap_snapshot = const_cast<i::HeapSnapshot*>(
+      reinterpret_cast<const i::HeapSnapshot*>(snapshot));
+
+  i::HashMap visited(AddressesMatch);
+  i::List<i::HeapGraphEdge>& edges = heap_snapshot->edges();
+  for (int i = 0; i < edges.length(); ++i) {
+    i::HashMap::Entry* entry = visited.Lookup(
+        reinterpret_cast<void*>(edges[i].to()),
+        static_cast<uint32_t>(reinterpret_cast<uintptr_t>(edges[i].to())),
+        true);
+    uint32_t ref_count = static_cast<uint32_t>(
+        reinterpret_cast<uintptr_t>(entry->value));
+    entry->value = reinterpret_cast<void*>(ref_count + 1);
+  }
+  uint32_t unretained_entries_count = 0;
+  i::List<i::HeapEntry>& entries = heap_snapshot->entries();
+  for (int i = 0; i < entries.length(); ++i) {
+    i::HashMap::Entry* entry = visited.Lookup(
+        reinterpret_cast<void*>(&entries[i]),
+        static_cast<uint32_t>(reinterpret_cast<uintptr_t>(&entries[i])),
+        false);
+    if (!entry && entries[i].id() != 1) {
+        entries[i].Print("entry with no retainer", "", depth, 0);
+        ++unretained_entries_count;
+    }
+  }
+  return unretained_entries_count > 1 ? false : true;
+}
+
+
 TEST(HeapSnapshot) {
   LocalContext env2;
   v8::HandleScope scope(env2->GetIsolate());
@@ -141,6 +178,7 @@
       "var c2 = new C2(a2);");
   const v8::HeapSnapshot* snapshot_env2 =
       heap_profiler->TakeHeapSnapshot(v8_str("env2"));
+  CHECK(ValidateSnapshot(snapshot_env2, 3));
   const v8::HeapGraphNode* global_env2 = GetGlobalObject(snapshot_env2);
 
   // Verify, that JS global object of env2 has '..2' properties.
@@ -176,6 +214,7 @@
       "(function() { x.a.a = x.b; })();");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("sizes"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* x =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "x");
@@ -204,6 +243,7 @@
       "boundFunction = myFunction.bind(new AAAAA(), 20, new Number(12)); \n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("sizes"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* f =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "boundFunction");
@@ -242,6 +282,7 @@
       "a = new A;");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("children"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   for (int i = 0, count = global->GetChildrenCount(); i < count; ++i) {
     const v8::HeapGraphEdge* prop = global->GetChild(i);
@@ -269,6 +310,7 @@
       "compiled(1)");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("code"));
+  CHECK(ValidateSnapshot(snapshot, 3));
 
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* compiled =
@@ -332,6 +374,7 @@
       "b = 2.5;  // b is HeapNumber");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("numbers"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_EQ(NULL, GetProperty(global, v8::HeapGraphEdge::kProperty, "a"));
   const v8::HeapGraphNode* b =
@@ -353,6 +396,7 @@
       "child_string = parent_string.slice(100);");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("strings"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* parent_string =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "parent_string");
@@ -381,6 +425,7 @@
   v8::HeapProfiler* heap_profiler = isolate->GetHeapProfiler();
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("internals"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global_node = GetGlobalObject(snapshot);
   // The first reference will not present, because it's a Smi.
   CHECK_EQ(NULL, GetProperty(global_node, v8::HeapGraphEdge::kInternal, "0"));
@@ -409,6 +454,7 @@
       "  a[i] = new A();\n");
   const v8::HeapSnapshot* snapshot1 =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot1"));
+  CHECK(ValidateSnapshot(snapshot1, 3));
   v8::SnapshotObjectId maxId1 = snapshot1->GetMaxSnapshotJSObjectId();
 
   CompileRun(
@@ -418,6 +464,7 @@
 
   const v8::HeapSnapshot* snapshot2 =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot2"));
+  CHECK(ValidateSnapshot(snapshot2, 3));
   const v8::HeapGraphNode* global2 = GetGlobalObject(snapshot2);
 
   const v8::HeapGraphNode* array_node =
@@ -451,6 +498,7 @@
       "  a.push(new AnObject());\n");
   const v8::HeapSnapshot* snapshot1 =
       heap_profiler->TakeHeapSnapshot(v8_str("s1"));
+  CHECK(ValidateSnapshot(snapshot1, 3));
 
   CompileRun(
       "for (var i = 0; i < 1; ++i)\n"
@@ -460,6 +508,7 @@
 
   const v8::HeapSnapshot* snapshot2 =
       heap_profiler->TakeHeapSnapshot(v8_str("s2"));
+  CHECK(ValidateSnapshot(snapshot2, 3));
 
   const v8::HeapGraphNode* global1 = GetGlobalObject(snapshot1);
   const v8::HeapGraphNode* global2 = GetGlobalObject(snapshot2);
@@ -498,11 +547,13 @@
   v8::Local<v8::String> s2_str = v8_str("s2");
   const v8::HeapSnapshot* snapshot1 =
       heap_profiler->TakeHeapSnapshot(s1_str);
+  CHECK(ValidateSnapshot(snapshot1, 3));
 
   HEAP->CollectAllGarbage(i::Heap::kNoGCFlags);
 
   const v8::HeapSnapshot* snapshot2 =
       heap_profiler->TakeHeapSnapshot(s2_str);
+  CHECK(ValidateSnapshot(snapshot2, 3));
 
   CHECK_GT(snapshot1->GetMaxSnapshotJSObjectId(), 7000);
   CHECK(snapshot1->GetMaxSnapshotJSObjectId() <=
@@ -553,6 +604,7 @@
   v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("s"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* root1 = snapshot->GetRoot();
   const_cast<i::HeapSnapshot*>(reinterpret_cast<const i::HeapSnapshot*>(
       snapshot))->GetSortedEntriesList();
@@ -620,6 +672,8 @@
       "var b = new B(a);");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("json"));
+  CHECK(ValidateSnapshot(snapshot, 3));
+
   TestJSONStream stream;
   snapshot->Serialize(&stream, v8::HeapSnapshot::kJSON);
   CHECK_GT(stream.size(), 0);
@@ -716,6 +770,7 @@
   v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("abort"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   TestJSONStream stream(5);
   snapshot->Serialize(&stream, v8::HeapSnapshot::kJSON);
   CHECK_GT(stream.size(), 0);
@@ -955,6 +1010,7 @@
 
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("id"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* root = snapshot->GetRoot();
   CheckChildrenIds(snapshot, root, 0, 3);
   // Check a big id, which should not exist yet.
@@ -969,6 +1025,7 @@
   CompileRun("globalObject = {};\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("get_snapshot_object_id"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* global_object =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "globalObject");
@@ -993,6 +1050,7 @@
   CompileRun("globalObject = {};\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("unknown_object_id"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* node =
       snapshot->GetNodeById(v8::HeapProfiler::kUnknownObjectId);
   CHECK_EQ(NULL, node);
@@ -1039,6 +1097,8 @@
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("full"),
                                      &control);
+  CHECK(ValidateSnapshot(snapshot, 3));
+
   CHECK_NE(NULL, snapshot);
   CHECK_EQ(snapshots_count + 1, heap_profiler->GetSnapshotCount());
   CHECK_EQ(control.total(), control.done());
@@ -1149,6 +1209,7 @@
   CHECK_EQ(0, TestRetainedObjectInfo::instances.length());
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("retained"));
+  CHECK(ValidateSnapshot(snapshot, 3));
 
   CHECK_EQ(3, TestRetainedObjectInfo::instances.length());
   for (int i = 0; i < TestRetainedObjectInfo::instances.length(); ++i) {
@@ -1241,6 +1302,7 @@
 
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("implicit_refs"));
+  CHECK(ValidateSnapshot(snapshot, 3));
 
   const v8::HeapGraphNode* global_object = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* obj0 = GetProperty(
@@ -1305,6 +1367,7 @@
   CHECK_EQ(0, heap_profiler->GetSnapshotCount());
   const v8::HeapSnapshot* s1 =
       heap_profiler->TakeHeapSnapshot(v8_str("1"));
+
   CHECK_NE(NULL, s1);
   CHECK_EQ(1, heap_profiler->GetSnapshotCount());
   unsigned uid1 = s1->GetUid();
@@ -1357,6 +1420,7 @@
       heap_profiler->TakeHeapSnapshot(v8_str("document"),
       NULL,
       &name_resolver);
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_NE(NULL, global);
   CHECK_EQ("Object / Global object name" ,
@@ -1387,6 +1451,7 @@
   v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("iteration"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_NE(NULL, global);
   // Verify that we can find this object by iteration.
@@ -1408,6 +1473,7 @@
   CompileRun("a = { s_prop: \'value\', n_prop: 0.1 };");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("value"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK(global->GetHeapValue()->IsObject());
   v8::Local<v8::Object> js_global =
@@ -1442,6 +1508,7 @@
   CompileRun("a = { p: { r: {} } };");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* obj = GetProperty(
       global, v8::HeapGraphEdge::kProperty, "a");
@@ -1528,6 +1595,7 @@
              "});\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("fastCaseAccessors"));
+  CHECK(ValidateSnapshot(snapshot, 3));
 
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_NE(NULL, global);
@@ -1561,6 +1629,7 @@
              "});\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("slowCaseAccessors"));
+  CHECK(ValidateSnapshot(snapshot, 3));
 
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_NE(NULL, global);
@@ -1589,6 +1658,7 @@
       "c = new C(2012);\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("HiddenPropertiesFastCase1"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* c =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "c");
@@ -1603,6 +1673,7 @@
 
   snapshot = heap_profiler->TakeHeapSnapshot(
       v8_str("HiddenPropertiesFastCase2"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   global = GetGlobalObject(snapshot);
   c = GetProperty(global, v8::HeapGraphEdge::kProperty, "c");
   CHECK_NE(NULL, c);
@@ -1626,6 +1697,7 @@
   v8::HeapProfiler* heap_profiler = isolate->GetHeapProfiler();
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("weaks"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* gc_roots = GetNode(
       snapshot->GetRoot(), v8::HeapGraphNode::kSynthetic, "(GC roots)");
   CHECK_NE(NULL, gc_roots);
@@ -1663,6 +1735,7 @@
 
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("weaks"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* gc_roots = GetNode(
       snapshot->GetRoot(), v8::HeapGraphNode::kSynthetic, "(GC roots)");
   CHECK_NE(NULL, gc_roots);
@@ -1685,6 +1758,7 @@
       "fun = (function (x) { return function () { return x + 1; } })(1);");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("fun"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_NE(NULL, global);
   const v8::HeapGraphNode* fun =
@@ -1706,6 +1780,7 @@
   CompileRun("foo = {};");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* root = snapshot->GetRoot();
   int globals_count = 0;
   for (int i = 0; i < root->GetChildrenCount(); ++i) {
@@ -1731,6 +1806,7 @@
   CompileRun("foo = {};");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* gc_roots = GetNode(
       snapshot->GetRoot(), v8::HeapGraphNode::kSynthetic, "(GC roots)");
   CHECK_NE(NULL, gc_roots);
@@ -1753,6 +1829,7 @@
   CompileRun("global_object = {};\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* global_object =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "global_object");
@@ -1773,6 +1850,7 @@
   CompileRun("obj = { a: 10 };\n");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   const v8::HeapGraphNode* global_object =
       GetProperty(global, v8::HeapGraphEdge::kProperty, "obj");
@@ -1811,6 +1889,8 @@
       "var ok = eval(result.join('\\n'));");
   const v8::HeapSnapshot* snapshot =
       heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
+
   const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
   CHECK_NE(NULL, global);
   const v8::HeapGraphNode* ok_object =
@@ -1832,3 +1912,54 @@
     CHECK_NE(NULL, f_object);
   }
 }
+
+
+TEST(AllocationSitesAreVisible) {
+  LocalContext env;
+  v8::HandleScope scope(env->GetIsolate());
+  v8::HeapProfiler* heap_profiler = env->GetIsolate()->GetHeapProfiler();
+  CompileRun(
+      "fun = function () { var a = [3, 2, 1]; return a; }\n"
+      "fun();");
+  const v8::HeapSnapshot* snapshot =
+      heap_profiler->TakeHeapSnapshot(v8_str("snapshot"));
+  CHECK(ValidateSnapshot(snapshot, 3));
+
+  const v8::HeapGraphNode* global = GetGlobalObject(snapshot);
+  CHECK_NE(NULL, global);
+  const v8::HeapGraphNode* fun_code =
+      GetProperty(global, v8::HeapGraphEdge::kProperty, "fun");
+  CHECK_NE(NULL, fun_code);
+  const v8::HeapGraphNode* literals =
+      GetProperty(fun_code, v8::HeapGraphEdge::kInternal, "literals");
+  CHECK_NE(NULL, literals);
+  CHECK_EQ(v8::HeapGraphNode::kArray, literals->GetType());
+  CHECK_EQ(2, literals->GetChildrenCount());
+
+  // The second value in the literals array should be the boilerplate,
+  // after an AllocationSite.
+  const v8::HeapGraphEdge* prop = literals->GetChild(1);
+  const v8::HeapGraphNode* allocation_site = prop->GetToNode();
+  v8::String::Utf8Value name(allocation_site->GetName());
+  CHECK_EQ("system / AllocationSite", *name);
+  const v8::HeapGraphNode* transition_info =
+      GetProperty(allocation_site, v8::HeapGraphEdge::kInternal,
+                  "transition_info");
+  CHECK_NE(NULL, transition_info);
+
+  const v8::HeapGraphNode* elements =
+      GetProperty(transition_info, v8::HeapGraphEdge::kInternal,
+                  "elements");
+  CHECK_NE(NULL, elements);
+  CHECK_EQ(v8::HeapGraphNode::kArray, elements->GetType());
+  CHECK_EQ(v8::internal::FixedArray::SizeFor(3), elements->GetSelfSize());
+
+  CHECK(transition_info->GetHeapValue()->IsArray());
+  v8::Handle<v8::Array> array = v8::Handle<v8::Array>::Cast(
+      transition_info->GetHeapValue());
+  // Verify the array is "a" in the code above.
+  CHECK_EQ(3, array->Length());
+  CHECK_EQ(v8::Integer::New(3), array->Get(v8::Integer::New(0)));
+  CHECK_EQ(v8::Integer::New(2), array->Get(v8::Integer::New(1)));
+  CHECK_EQ(v8::Integer::New(1), array->Get(v8::Integer::New(2)));
+}
diff --git a/test/cctest/test-heap.cc b/test/cctest/test-heap.cc
index be1098c..cc1e042 100644
--- a/test/cctest/test-heap.cc
+++ b/test/cctest/test-heap.cc
@@ -1327,6 +1327,11 @@
   for (int i = 0; i < kNumTestContexts; i++) {
     ctx[i] = v8::Context::New(v8::Isolate::GetCurrent());
 
+    // Collect garbage that might have been created by one of the
+    // installed extensions.
+    isolate->compilation_cache()->Clear();
+    heap->CollectAllGarbage(Heap::kNoGCFlags);
+
     bool opt = (FLAG_always_opt && i::V8::UseCrankshaft());
 
     CHECK_EQ(i + 1, CountNativeContexts());
@@ -1388,6 +1393,7 @@
   }
 
   // Force compilation cache cleanup.
+  HEAP->NotifyContextDisposed();
   HEAP->CollectAllGarbage(Heap::kNoGCFlags);
 
   // Dispose the native contexts one by one.
@@ -3011,6 +3017,10 @@
   i::FLAG_harmony_typed_arrays = false;
   i::FLAG_harmony_array_buffer = false;
 
+  // Disable loading the i18n extension which breaks the assumptions of this
+  // test about the heap layout.
+  i::FLAG_enable_i18n = false;
+
   CcTest::InitializeVM();
   Isolate* isolate = Isolate::Current();
   Heap* heap = isolate->heap();
diff --git a/test/intl/assert.js b/test/intl/assert.js
new file mode 100644
index 0000000..3180e6f
--- /dev/null
+++ b/test/intl/assert.js
@@ -0,0 +1,184 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Some methods are taken from v8/test/mjsunit/mjsunit.js
+
+/**
+ * Compares two objects for key/value equality.
+ * Returns true if they are equal, false otherwise.
+ */
+function deepObjectEquals(a, b) {
+  var aProps = Object.keys(a);
+  aProps.sort();
+  var bProps = Object.keys(b);
+  bProps.sort();
+  if (!deepEquals(aProps, bProps)) {
+    return false;
+  }
+  for (var i = 0; i < aProps.length; i++) {
+    if (!deepEquals(a[aProps[i]], b[aProps[i]])) {
+      return false;
+    }
+  }
+  return true;
+}
+
+
+/**
+ * Compares two JavaScript values for type and value equality.
+ * It checks internals of arrays and objects.
+ */
+function deepEquals(a, b) {
+  if (a === b) {
+    // Check for -0.
+    if (a === 0) return (1 / a) === (1 / b);
+    return true;
+  }
+  if (typeof a != typeof b) return false;
+  if (typeof a == 'number') return isNaN(a) && isNaN(b);
+  if (typeof a !== 'object' && typeof a !== 'function') return false;
+  // Neither a nor b is primitive.
+  var objectClass = classOf(a);
+  if (objectClass !== classOf(b)) return false;
+  if (objectClass === 'RegExp') {
+    // For RegExp, just compare pattern and flags using its toString.
+    return (a.toString() === b.toString());
+  }
+  // Functions are only identical to themselves.
+  if (objectClass === 'Function') return false;
+  if (objectClass === 'Array') {
+    var elementCount = 0;
+    if (a.length != b.length) {
+      return false;
+    }
+    for (var i = 0; i < a.length; i++) {
+      if (!deepEquals(a[i], b[i])) return false;
+    }
+    return true;
+  }
+  if (objectClass == 'String' || objectClass == 'Number' ||
+      objectClass == 'Boolean' || objectClass == 'Date') {
+    if (a.valueOf() !== b.valueOf()) return false;
+  }
+  return deepObjectEquals(a, b);
+}
+
+
+/**
+ * Throws an exception, and prints the values in case of error.
+ */
+function fail(expected, found) {
+  // TODO(cira): Replace String with PrettyPrint for objects and arrays.
+  var message = 'Failure: expected <' + String(expected) + '>, found <' +
+      String(found) + '>.';
+  throw new Error(message);
+}
+
+
+/**
+ * Throws if two variables have different types or values.
+ */
+function assertEquals(expected, found) {
+  if (!deepEquals(expected, found)) {
+    fail(expected, found);
+  }
+}
+
+
+/**
+ * Throws if value is false.
+ */
+function assertTrue(value) {
+  assertEquals(true, value)
+}
+
+
+/**
+ * Throws if value is true.
+ */
+function assertFalse(value) {
+  assertEquals(false, value);
+}
+
+
+/**
+ * Returns true if code throws specified exception.
+ */
+function assertThrows(code, type_opt, cause_opt) {
+  var threwException = true;
+  try {
+    if (typeof code == 'function') {
+      code();
+    } else {
+      eval(code);
+    }
+    threwException = false;
+  } catch (e) {
+    if (typeof type_opt == 'function') {
+      assertInstanceof(e, type_opt);
+    }
+    if (arguments.length >= 3) {
+      assertEquals(e.type, cause_opt);
+    }
+    // Success.
+    return;
+  }
+  throw new Error("Did not throw exception");
+}
+
+
+/**
+ * Throws an exception if code throws.
+ */
+function assertDoesNotThrow(code, name_opt) {
+  try {
+    if (typeof code == 'function') {
+      code();
+    } else {
+      eval(code);
+    }
+  } catch (e) {
+    fail("threw an exception: ", e.message || e, name_opt);
+  }
+}
+
+
+/**
+ * Throws if obj is not of given type.
+ */
+function assertInstanceof(obj, type) {
+  if (!(obj instanceof type)) {
+    var actualTypeName = null;
+    var actualConstructor = Object.prototypeOf(obj).constructor;
+    if (typeof actualConstructor == "function") {
+      actualTypeName = actualConstructor.name || String(actualConstructor);
+    }
+    throw new Error('Object <' + obj + '> is not an instance of <' +
+         (type.name || type) + '>' +
+         (actualTypeName ? ' but of < ' + actualTypeName + '>' : ''));
+  }
+}
diff --git a/test/intl/break-iterator/default-locale.js b/test/intl/break-iterator/default-locale.js
new file mode 100644
index 0000000..39a8857
--- /dev/null
+++ b/test/intl/break-iterator/default-locale.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Constructing BreakIterator with no locale arguments or with []
+// creates one with default locale.
+
+var iterator = new Intl.v8BreakIterator([]);
+
+var options = iterator.resolvedOptions();
+
+// Check it's none of these first.
+assertFalse(options.locale === 'und');
+assertFalse(options.locale === '');
+assertFalse(options.locale === undefined);
+
+// Then check for equality.
+assertEquals(options.locale, getDefaultLocale());
+
+var iteratorNone = new Intl.v8BreakIterator();
+assertEquals(options.locale, iteratorNone.resolvedOptions().locale);
+
+// TODO(cira): remove support for {} to mean empty list.
+var iteratorBraket = new Intl.v8BreakIterator({});
+assertEquals(options.locale, iteratorBraket.resolvedOptions().locale);
diff --git a/test/intl/break-iterator/en-break.js b/test/intl/break-iterator/en-break.js
new file mode 100644
index 0000000..7268a10
--- /dev/null
+++ b/test/intl/break-iterator/en-break.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Segment plain English sentence and check results.
+
+var iterator = new Intl.v8BreakIterator(['en']);
+
+var textToSegment = 'Jack and Jill, went over hill, and got lost. Alert!';
+iterator.adoptText(textToSegment);
+
+var slices = [];
+var types = [];
+var pos = iterator.first();
+while (pos !== -1) {
+  var nextPos = iterator.next();
+  if (nextPos === -1) break;
+
+  slices.push(textToSegment.slice(pos, nextPos));
+  types.push(iterator.breakType());
+
+  pos = nextPos;
+}
+
+assertEquals('Jack', slices[0]);
+assertEquals(' ', slices[1]);
+assertEquals('and', slices[2]);
+assertEquals(' ', slices[3]);
+assertEquals('Jill', slices[4]);
+assertEquals(',', slices[5]);
+assertEquals('!', slices[slices.length - 1]);
+
+assertEquals('letter', types[0]);
+assertEquals('none', types[1]);
+assertEquals('letter', types[2]);
+assertEquals('none', types[3]);
+assertEquals('letter', types[4]);
+assertEquals('none', types[types.length - 1]);
diff --git a/test/intl/break-iterator/property-override.js b/test/intl/break-iterator/property-override.js
new file mode 100644
index 0000000..49bd86f
--- /dev/null
+++ b/test/intl/break-iterator/property-override.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Checks for security holes introduced by Object.property overrides.
+// For example:
+// Object.defineProperty(Array.prototype, 'locale', {
+//   set: function(value) {
+//     throw new Error('blah');
+//   },
+//   configurable: true,
+//   enumerable: false
+// });
+//
+// would throw in case of (JS) x.locale = 'us' or (C++) x->Set('locale', 'us').
+//
+// Update both break-iterator.js and break-iterator.cc so they have the same
+// list of properties.
+
+// First get supported properties.
+var properties = [];
+var options = Intl.v8BreakIterator().resolvedOptions();
+for (var prop in options) {
+  if (options.hasOwnProperty(prop)) {
+    properties.push(prop);
+  }
+}
+
+var expectedProperties = [
+  'type', 'locale'
+];
+
+assertEquals(expectedProperties.length, properties.length);
+
+properties.forEach(function(prop) {
+  assertFalse(expectedProperties.indexOf(prop) === -1);
+});
+
+taintProperties(properties);
+
+var locale = Intl.v8BreakIterator().resolvedOptions().locale;
diff --git a/test/intl/break-iterator/protected-icu-internals.js b/test/intl/break-iterator/protected-icu-internals.js
new file mode 100644
index 0000000..ad1dc54
--- /dev/null
+++ b/test/intl/break-iterator/protected-icu-internals.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Internal object we got from native code should not be writable,
+// configurable or enumerable. One can still change its public properties, but
+// we don't use them to do actual work.
+
+var iterator = new Intl.v8BreakIterator([]);
+
+// Direct write should fail.
+iterator.iterator = {'zzz':'some random object'};
+
+assertFalse(iterator.iterator.hasOwnProperty('zzz'));
+
+// Try redefining the property.
+var didThrow = false;
+try {
+  Object.defineProperty(iterator, 'iterator', {value: undefined});
+} catch(e) {
+  didThrow = true;
+}
+assertTrue(didThrow);
+
+// Try deleting the property.
+assertFalse(delete iterator.iterator);
diff --git a/test/intl/break-iterator/resolved-options-is-method.js b/test/intl/break-iterator/resolved-options-is-method.js
new file mode 100644
index 0000000..0e9e06c
--- /dev/null
+++ b/test/intl/break-iterator/resolved-options-is-method.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that resolvedOptions is a method, not a property getter and that
+// the result is mutable.
+
+var iterator = new Intl.v8BreakIterator();
+
+var result = iterator.resolvedOptions();
+
+assertTrue(result instanceof Object);
+
+// Result should be mutable.
+result.locale = 'xx';
+
+assertEquals(result.locale, 'xx');
diff --git a/test/intl/break-iterator/wellformed-unsupported-locale.js b/test/intl/break-iterator/wellformed-unsupported-locale.js
new file mode 100644
index 0000000..56457b4
--- /dev/null
+++ b/test/intl/break-iterator/wellformed-unsupported-locale.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Passing a well formed but unsupported locale falls back to default.
+
+var iterator = Intl.v8BreakIterator(['xx']);
+
+assertEquals(iterator.resolvedOptions().locale, getDefaultLocale());
diff --git a/test/intl/break-iterator/zh-break.js b/test/intl/break-iterator/zh-break.js
new file mode 100644
index 0000000..c8434b1
--- /dev/null
+++ b/test/intl/break-iterator/zh-break.js
@@ -0,0 +1,63 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Segment plain Chinese sentence and check results.
+
+var iterator = new Intl.v8BreakIterator(['zh']);
+
+var textToSegment = '\u56FD\u52A1\u9662\u5173\u4E8E\u300A\u571F\u5730' +
+                    '\u623F\u5C4B\u7BA1\u7406\u6761\u4F8B\u300B';
+iterator.adoptText(textToSegment);
+
+var slices = [];
+var types = [];
+var pos = iterator.first();
+while (pos !== -1) {
+  var nextPos = iterator.next();
+  if (nextPos === -1) break;
+
+  slices.push(textToSegment.slice(pos, nextPos));
+  types.push(iterator.breakType());
+
+  pos = nextPos;
+}
+
+assertEquals('\u56FD\u52A1\u9662', slices[0]);
+assertEquals('\u5173\u4E8E', slices[1]);
+assertEquals('\u300A', slices[2]);
+assertEquals('\u571F\u5730', slices[3]);
+assertEquals('\u623F\u5C4B', slices[4]);
+assertEquals('\u7BA1\u7406', slices[5]);
+assertEquals('\u6761\u4F8B', slices[6]);
+assertEquals('\u300B', slices[7]);
+
+assertEquals('ideo', types[0]);
+assertEquals('ideo', types[1]);
+assertEquals('none', types[2]);
+assertEquals('ideo', types[3]);
+assertEquals('ideo', types[4]);
+assertEquals('none', types[types.length - 1]);
diff --git a/test/intl/collator/de-sort.js b/test/intl/collator/de-sort.js
new file mode 100644
index 0000000..278b949
--- /dev/null
+++ b/test/intl/collator/de-sort.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Sort plain German text using defaults.
+
+var strings = ['März', 'Fuße', 'FUSSE', 'Fluße', 'Flusse',
+               'flusse', 'fluße', 'flüße', 'flüsse'];
+
+var collator = Intl.Collator(['de']);
+var result = strings.sort(collator.compare);
+
+assertEquals('flusse', result[0]);
+assertEquals('Flusse', result[1]);
+assertEquals('fluße', result[2]);
+assertEquals('Fluße', result[3]);
+assertEquals('flüsse', result[4]);
+assertEquals('flüße', result[5]);
+assertEquals('FUSSE', result[6]);
+assertEquals('Fuße', result[7]);
+assertEquals('März', result[8]);
diff --git a/test/intl/collator/default-locale.js b/test/intl/collator/default-locale.js
new file mode 100644
index 0000000..f6ffba8
--- /dev/null
+++ b/test/intl/collator/default-locale.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Constructing Collator with no locale arguments or with []
+// creates one with default locale.
+
+var collator = new Intl.Collator([]);
+
+var options = collator.resolvedOptions();
+
+// Check it's none of these first.
+assertFalse(options.locale === 'und');
+assertFalse(options.locale === '');
+assertFalse(options.locale === undefined);
+
+// Then check for equality.
+assertEquals(options.locale, getDefaultLocale());
+
+var collatorNone = new Intl.Collator();
+assertEquals(options.locale, collatorNone.resolvedOptions().locale);
+
+// TODO(cira): remove support for {} to mean empty list.
+var collatorBraket = new Intl.Collator({});
+assertEquals(options.locale, collatorBraket.resolvedOptions().locale);
+
+var collatorWithOptions = new Intl.Collator(undefined, {usage: 'search'});
+assertEquals(getDefaultLocale() + '-u-co-search',
+             collatorWithOptions.resolvedOptions().locale);
diff --git a/test/intl/collator/en-sort.js b/test/intl/collator/en-sort.js
new file mode 100644
index 0000000..24adc77
--- /dev/null
+++ b/test/intl/collator/en-sort.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Sort plain English text using defaults.
+
+var strings = ['blood', 'bull', 'ascend', 'zed', 'down'];
+
+var collator = Intl.Collator(['en']);
+var result = strings.sort(collator.compare);
+
+assertEquals('ascend', result[0]);
+assertEquals('blood', result[1]);
+assertEquals('bull', result[2]);
+assertEquals('down', result[3]);
+assertEquals('zed', result[4]);
diff --git a/test/intl/collator/normalization.js b/test/intl/collator/normalization.js
new file mode 100644
index 0000000..8238f23
--- /dev/null
+++ b/test/intl/collator/normalization.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure normalization is always on, and normalization flag is ignored.
+
+// We need a character with two combining marks, from two different classes,
+// to make ICU fail comparison without normalization (upper, lower accent).
+// We will just switch order of combining characters to try to induce failure.
+
+// FYI, this one wouldn't work, since both accents are from the same class:
+// http://unicode.org/cldr/utility/character.jsp?a=01DF
+
+// See http://demo.icu-project.org/icu-bin/nbrowser?t=&s=1E09&uv=0 and
+// http://unicode.org/cldr/utility/character.jsp?a=1E09 for character details.
+var toCompare = ['\u0063\u0327\u0301', '\u0063\u0301\u0327'];
+
+// Try with normalization off (as an option).
+var collator = Intl.Collator([], {normalization: false});
+// If we accepted normalization parameter, this would have failed.
+assertEquals(0, collator.compare(toCompare[0], toCompare[1]));
+assertFalse(collator.resolvedOptions().hasOwnProperty('normalization'));
+
+// Try with normalization off (as Unicode extension).
+collator = Intl.Collator(['de-u-kk-false']);
+// If we accepted normalization parameter, this would have failed.
+assertEquals(0, collator.compare(toCompare[0], toCompare[1]));
+assertFalse(collator.resolvedOptions().hasOwnProperty('normalization'));
+
+// Normalization is on by default.
+collator = Intl.Collator();
+assertEquals(0, collator.compare(toCompare[0], toCompare[1]));
+assertFalse(collator.resolvedOptions().hasOwnProperty('normalization'));
diff --git a/test/intl/collator/property-override.js b/test/intl/collator/property-override.js
new file mode 100644
index 0000000..bed4d77
--- /dev/null
+++ b/test/intl/collator/property-override.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Checks for security holes introduced by Object.property overrides.
+// For example:
+// Object.defineProperty(Array.prototype, 'locale', {
+//   set: function(value) {
+//     throw new Error('blah');
+//   },
+//   configurable: true,
+//   enumerable: false
+// });
+//
+// would throw in case of (JS) x.locale = 'us' or (C++) x->Set('locale', 'us').
+//
+// Update both collator.js and collator.cc so they have the same list of
+// properties.
+
+// First get supported properties.
+var properties = [];
+var options = Intl.Collator().resolvedOptions();
+for (var prop in options) {
+  if (options.hasOwnProperty(prop)) {
+    properties.push(prop);
+  }
+}
+
+var expectedProperties = [
+  'caseFirst', 'sensitivity', 'ignorePunctuation',
+  'locale', 'numeric', 'usage', 'collation'
+];
+
+assertEquals(expectedProperties.length, properties.length);
+
+properties.forEach(function(prop) {
+  assertFalse(expectedProperties.indexOf(prop) === -1);
+});
+
+taintProperties(properties);
+
+var locale = Intl.Collator().resolvedOptions().locale;
diff --git a/test/intl/collator/protected-icu-internals.js b/test/intl/collator/protected-icu-internals.js
new file mode 100644
index 0000000..7acd35e
--- /dev/null
+++ b/test/intl/collator/protected-icu-internals.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Internal object we got from native code should not be writable,
+// configurable or enumerable. One can still change its public properties, but
+// we don't use them to do actual work.
+
+var collator = new Intl.Collator([]);
+
+// Direct write should fail.
+collator.collator = {'zzz':'some random object'};
+
+assertFalse(collator.collator.hasOwnProperty('zzz'));
+
+// Try redefining the property.
+var didThrow = false;
+try {
+  Object.defineProperty(collator, 'collator', {value: undefined});
+} catch(e) {
+  didThrow = true;
+}
+assertTrue(didThrow);
+
+// Try deleting the property.
+assertFalse(delete collator.collator);
diff --git a/test/intl/collator/resolved-options-is-method.js b/test/intl/collator/resolved-options-is-method.js
new file mode 100644
index 0000000..e7c874f
--- /dev/null
+++ b/test/intl/collator/resolved-options-is-method.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that resolvedOptions is a method, not a property getter and that
+// the result is mutable.
+
+var collator = new Intl.Collator();
+
+var result = collator.resolvedOptions();
+
+assertTrue(result instanceof Object);
+
+// Result should be mutable.
+result.locale = 'xx';
+
+assertEquals(result.locale, 'xx');
diff --git a/test/intl/collator/sr-sort.js b/test/intl/collator/sr-sort.js
new file mode 100644
index 0000000..53c784c
--- /dev/null
+++ b/test/intl/collator/sr-sort.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Sort plain Serbian text using defaults.
+
+var strings = ['новине', 'ограда', 'жирафа', 'Никола', 'Андрија',
+               'Стара Планина', 'џак', 'алав', 'ћук', 'чука'];
+
+var collator = Intl.Collator(['sr']);
+var result = strings.sort(collator.compare);
+
+assertEquals('алав', result[0]);
+assertEquals('Андрија', result[1]);
+assertEquals('жирафа', result[2]);
+assertEquals('Никола', result[3]);
+assertEquals('новине', result[4]);
+assertEquals('ограда', result[5]);
+assertEquals('Стара Планина', result[6]);
+assertEquals('ћук', result[7]);
+assertEquals('чука', result[8]);
+assertEquals('џак', result[9]);
+
diff --git a/test/intl/collator/wellformed-unsupported-locale.js b/test/intl/collator/wellformed-unsupported-locale.js
new file mode 100644
index 0000000..ea143fd
--- /dev/null
+++ b/test/intl/collator/wellformed-unsupported-locale.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Passing a well formed but unsupported locale falls back to default.
+
+var collator = Intl.Collator(['xx']);
+
+assertEquals(collator.resolvedOptions().locale, getDefaultLocale());
diff --git a/test/intl/date-format/default-locale.js b/test/intl/date-format/default-locale.js
new file mode 100644
index 0000000..2dcb0f8
--- /dev/null
+++ b/test/intl/date-format/default-locale.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Constructing DateTimeFormat with no locale arguments or with []
+// creates one with default locale.
+
+var dtf = new Intl.DateTimeFormat([]);
+
+var options = dtf.resolvedOptions();
+
+// Check it's none of these first.
+assertFalse(options.locale === 'und');
+assertFalse(options.locale === '');
+assertFalse(options.locale === undefined);
+
+// Then check for equality.
+assertEquals(options.locale, getDefaultLocale());
+
+var dtfNone = new Intl.DateTimeFormat();
+assertEquals(options.locale, dtfNone.resolvedOptions().locale);
diff --git a/test/intl/date-format/format-is-bound.js b/test/intl/date-format/format-is-bound.js
new file mode 100644
index 0000000..b744b65
--- /dev/null
+++ b/test/intl/date-format/format-is-bound.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create default DateTimeFormat.
+var dtf = new Intl.DateTimeFormat();
+
+// Array we want to iterate, actual dates are not important.
+var dateArray = [Date.now(), Date.now(), Date.now()];
+
+// It shouldn't throw.
+// The format() method should be properly bound to the dtf object.
+dateArray.forEach(dtf.format);
+
+// Formatting a date should work in a direct call.
+dtf.format();
diff --git a/test/intl/date-format/format-test.js b/test/intl/date-format/format-test.js
new file mode 100644
index 0000000..9817c97
--- /dev/null
+++ b/test/intl/date-format/format-test.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test formatting method with specified date, invalid input.
+
+var dtf = new Intl.DateTimeFormat('en-US', {timeZone: 'UTC'});
+
+var someDate = dtf.format(144313200000);
+assertEquals('7/29/1974', someDate);
+
+var invalidValues = [NaN, Infinity, -Infinity];
+invalidValues.forEach(function(value) {
+  var error;
+  try {
+    dtf.format(value);
+  } catch (e) {
+    error = e;
+  }
+
+  assertTrue(error !== undefined);
+  assertEquals('RangeError', error.name);
+});
diff --git a/test/intl/date-format/parse-MMMdy.js b/test/intl/date-format/parse-MMMdy.js
new file mode 100644
index 0000000..7136527
--- /dev/null
+++ b/test/intl/date-format/parse-MMMdy.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Testing v8Parse method for date and time pattern.
+// Month is represented as a short name.
+
+var dtf = new Intl.DateTimeFormat(['en'],
+                                  {year: 'numeric', month: 'short',
+                                   day: 'numeric'});
+
+// Make sure we have pattern we expect (may change in the future).
+assertEquals('MMM d, y', dtf.resolved.pattern);
+
+assertEquals('Sat May 04 1974 00:00:00 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('May 4, 1974'))));
+
+// Missing , in the pattern.
+assertEquals(undefined, dtf.v8Parse('May 4 1974'));
+
+// Extra "th" after 4 in the pattern.
+assertEquals(undefined, dtf.v8Parse('May 4th, 1974'));
+
+// Wrong pattern.
+assertEquals(undefined, dtf.v8Parse('5/4/1974'));
diff --git a/test/intl/date-format/parse-invalid-input.js b/test/intl/date-format/parse-invalid-input.js
new file mode 100644
index 0000000..ab0b889
--- /dev/null
+++ b/test/intl/date-format/parse-invalid-input.js
@@ -0,0 +1,35 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Invalid input is handled properly.
+
+var dtf = new Intl.DateTimeFormat(['en']);
+
+assertEquals(undefined, dtf.v8Parse(''));
+assertEquals(undefined, dtf.v8Parse('A'));
+assertEquals(undefined, dtf.v8Parse(5));
+assertEquals(undefined, dtf.v8Parse(new Date()));
diff --git a/test/intl/date-format/parse-mdy.js b/test/intl/date-format/parse-mdy.js
new file mode 100644
index 0000000..e767a0b
--- /dev/null
+++ b/test/intl/date-format/parse-mdy.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Testing v8Parse method for date only.
+
+var dtf = new Intl.DateTimeFormat(['en']);
+
+// Make sure we have pattern we expect (may change in the future).
+assertEquals('M/d/y', dtf.resolved.pattern);
+
+assertEquals('Sat May 04 1974 00:00:00 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('5/4/74'))));
+assertEquals('Sat May 04 1974 00:00:00 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('05/04/74'))));
+assertEquals('Sat May 04 1974 00:00:00 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('5/04/74'))));
+assertEquals('Sat May 04 1974 00:00:00 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('5/4/1974'))));
+
+// Month is numeric, so it fails on "May".
+assertEquals(undefined, dtf.v8Parse('May 4th 1974'));
+
+// Time is ignored from the input, since the pattern doesn't have it.
+assertEquals('Sat May 04 1974 00:00:00 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('5/4/74 12:30:12'))));
diff --git a/test/intl/date-format/parse-mdyhms.js b/test/intl/date-format/parse-mdyhms.js
new file mode 100644
index 0000000..74f7467
--- /dev/null
+++ b/test/intl/date-format/parse-mdyhms.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Testing v8Parse method for date and time pattern.
+
+var dtf = new Intl.DateTimeFormat(['en'],
+                                  {year: 'numeric', month: 'numeric',
+                                   day: 'numeric', hour: 'numeric',
+                                   minute: 'numeric', second: 'numeric'});
+
+// Make sure we have pattern we expect (may change in the future).
+assertEquals('M/d/y h:mm:ss a', dtf.resolved.pattern);
+
+assertEquals('Sat May 04 1974 12:30:12 GMT-0007 (PDT)',
+             usePDT(String(dtf.v8Parse('5/4/74 12:30:12 pm'))));
+
+// AM/PM were not specified.
+assertEquals(undefined, dtf.v8Parse('5/4/74 12:30:12'));
+
+// Time was not specified.
+assertEquals(undefined, dtf.v8Parse('5/4/74'));
+
+// Month is numeric, so it fails on "May".
+assertEquals(undefined, dtf.v8Parse('May 4th 1974'));
+
+// Wrong date delimiter.
+assertEquals(undefined, dtf.v8Parse('5-4-74 12:30:12 am'));
diff --git a/test/intl/date-format/property-override.js b/test/intl/date-format/property-override.js
new file mode 100644
index 0000000..a2bc2d9
--- /dev/null
+++ b/test/intl/date-format/property-override.js
@@ -0,0 +1,70 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Checks for security holes introduced by Object.property overrides.
+// For example:
+// Object.defineProperty(Array.prototype, 'locale', {
+//   set: function(value) {
+//     throw new Error('blah');
+//   },
+//   configurable: true,
+//   enumerable: false
+// });
+//
+// would throw in case of (JS) x.locale = 'us' or (C++) x->Set('locale', 'us').
+//
+// Update both date-format.js and date-format.cc so they have the same list of
+// properties.
+
+// First get supported properties.
+// Some of the properties are optional, so we request them.
+var properties = [];
+var options = Intl.DateTimeFormat(
+  'en-US', {weekday: 'short', era: 'short', year: 'numeric', month: 'short',
+            day: 'numeric', hour: 'numeric', minute: 'numeric',
+            second: 'numeric', timeZoneName: 'short'}).resolvedOptions();
+for (var prop in options) {
+  if (options.hasOwnProperty(prop)) {
+    properties.push(prop);
+  }
+}
+
+var expectedProperties = [
+  'calendar', 'day', 'era', 'hour12', 'hour', 'locale',
+  'minute', 'month', 'numberingSystem',
+  'second', 'timeZone', 'timeZoneName', 'weekday', 'year'
+];
+
+assertEquals(expectedProperties.length, properties.length);
+
+properties.forEach(function(prop) {
+  assertFalse(expectedProperties.indexOf(prop) === -1);
+});
+
+taintProperties(properties);
+
+var locale = Intl.DateTimeFormat().resolvedOptions().locale;
diff --git a/test/intl/date-format/protected-icu-internals.js b/test/intl/date-format/protected-icu-internals.js
new file mode 100644
index 0000000..140f4b5
--- /dev/null
+++ b/test/intl/date-format/protected-icu-internals.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Internal object we got from native code should not be writable,
+// configurable or enumerable. One can still change its public properties, but
+// we don't use them to do actual work.
+
+var format = new Intl.DateTimeFormat([]);
+
+// Direct write should fail.
+format.formatter = {'zzz':'some random object'};
+
+assertFalse(format.formatter.hasOwnProperty('zzz'));
+
+// Try redefining the property.
+var didThrow = false;
+try {
+  Object.defineProperty(format, 'formatter', {value: undefined});
+} catch(e) {
+  didThrow = true;
+}
+assertTrue(didThrow);
+
+// Try deleting the property.
+assertFalse(delete format.formatter);
diff --git a/test/intl/date-format/resolved-options-is-method.js b/test/intl/date-format/resolved-options-is-method.js
new file mode 100644
index 0000000..0c44778
--- /dev/null
+++ b/test/intl/date-format/resolved-options-is-method.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that resolvedOptions is a method, not a property getter and that
+// the result is mutable.
+
+var dtf = new Intl.DateTimeFormat();
+
+var result = dtf.resolvedOptions();
+
+assertTrue(result instanceof Object);
+
+// Result should be mutable.
+result.locale = 'xx';
+
+assertEquals(result.locale, 'xx');
diff --git a/test/intl/date-format/resolved-options.js b/test/intl/date-format/resolved-options.js
new file mode 100644
index 0000000..707eb07
--- /dev/null
+++ b/test/intl/date-format/resolved-options.js
@@ -0,0 +1,107 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test if resolvedOptions() returns expected fields/values.
+
+// Default (year, month, day) formatter.
+var dtfDefault = Intl.DateTimeFormat('en-US');
+var resolved = dtfDefault.resolvedOptions();
+
+assertTrue(resolved.hasOwnProperty('locale'));
+assertEquals('en-US', resolved.locale);
+assertTrue(resolved.hasOwnProperty('numberingSystem'));
+assertEquals('latn', resolved.numberingSystem);
+assertTrue(resolved.hasOwnProperty('calendar'));
+assertEquals('gregory', resolved.calendar);
+assertTrue(resolved.hasOwnProperty('timeZone'));
+assertEquals(getDefaultTimeZone(), resolved.timeZone);
+// These are in by default.
+assertTrue(resolved.hasOwnProperty('year'));
+assertEquals('numeric', resolved.year);
+assertTrue(resolved.hasOwnProperty('month'));
+assertEquals('numeric', resolved.month);
+assertTrue(resolved.hasOwnProperty('day'));
+assertEquals('numeric', resolved.day);
+// These shouldn't be in by default.
+assertFalse(resolved.hasOwnProperty('era'));
+assertFalse(resolved.hasOwnProperty('timeZoneName'));
+assertFalse(resolved.hasOwnProperty('weekday'));
+assertFalse(resolved.hasOwnProperty('hour12'));
+assertFalse(resolved.hasOwnProperty('hour'));
+assertFalse(resolved.hasOwnProperty('minute'));
+assertFalse(resolved.hasOwnProperty('second'));
+
+// Time formatter.
+var dtfTime = Intl.DateTimeFormat(
+  'sr-RS', {hour: 'numeric', minute: 'numeric', second: 'numeric'});
+resolved = dtfTime.resolvedOptions();
+
+assertTrue(resolved.hasOwnProperty('locale'));
+assertTrue(resolved.hasOwnProperty('numberingSystem'));
+assertTrue(resolved.hasOwnProperty('calendar'));
+assertTrue(resolved.hasOwnProperty('timeZone'));
+assertTrue(resolved.hasOwnProperty('hour12'));
+assertEquals(false, resolved.hour12);
+assertTrue(resolved.hasOwnProperty('hour'));
+assertEquals('2-digit', resolved.hour);
+assertTrue(resolved.hasOwnProperty('minute'));
+assertEquals('2-digit', resolved.minute);
+assertTrue(resolved.hasOwnProperty('second'));
+assertEquals('2-digit', resolved.second);
+// Didn't ask for them.
+assertFalse(resolved.hasOwnProperty('year'));
+assertFalse(resolved.hasOwnProperty('month'));
+assertFalse(resolved.hasOwnProperty('day'));
+assertFalse(resolved.hasOwnProperty('era'));
+assertFalse(resolved.hasOwnProperty('timeZoneName'));
+assertFalse(resolved.hasOwnProperty('weekday'));
+
+// Full formatter.
+var dtfFull = Intl.DateTimeFormat(
+  'en-US', {weekday: 'short', era: 'short', year: 'numeric', month: 'short',
+            day: 'numeric', hour: 'numeric', minute: 'numeric',
+            second: 'numeric', timeZoneName: 'short', timeZone: 'UTC'});
+resolved = dtfFull.resolvedOptions();
+
+assertTrue(resolved.hasOwnProperty('locale'));
+assertTrue(resolved.hasOwnProperty('numberingSystem'));
+assertTrue(resolved.hasOwnProperty('calendar'));
+assertTrue(resolved.hasOwnProperty('timeZone'));
+assertTrue(resolved.hasOwnProperty('hour12'));
+assertEquals(true, resolved.hour12);
+assertTrue(resolved.hasOwnProperty('hour'));
+assertTrue(resolved.hasOwnProperty('minute'));
+assertTrue(resolved.hasOwnProperty('second'));
+assertTrue(resolved.hasOwnProperty('year'));
+assertTrue(resolved.hasOwnProperty('month'));
+assertTrue(resolved.hasOwnProperty('day'));
+assertTrue(resolved.hasOwnProperty('era'));
+assertEquals('short', resolved.era);
+assertTrue(resolved.hasOwnProperty('timeZoneName'));
+assertEquals('short', resolved.timeZoneName);
+assertTrue(resolved.hasOwnProperty('weekday'));
+assertEquals('short', resolved.weekday);
diff --git a/test/intl/date-format/timezone.js b/test/intl/date-format/timezone.js
new file mode 100644
index 0000000..03e25f0
--- /dev/null
+++ b/test/intl/date-format/timezone.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests time zone support.
+
+var df = Intl.DateTimeFormat();
+assertEquals(getDefaultTimeZone(), df.resolvedOptions().timeZone);
+
+df = Intl.DateTimeFormat(undefined, {timeZone: 'UtC'});
+assertEquals('UTC', df.resolvedOptions().timeZone);
+
+df = Intl.DateTimeFormat(undefined, {timeZone: 'gmt'});
+assertEquals('UTC', df.resolvedOptions().timeZone);
+
+df = Intl.DateTimeFormat(undefined, {timeZone: 'America/Los_Angeles'});
+assertEquals('America/Los_Angeles', df.resolvedOptions().timeZone);
+
+df = Intl.DateTimeFormat(undefined, {timeZone: 'Europe/Belgrade'});
+assertEquals('Europe/Belgrade', df.resolvedOptions().timeZone);
+
+// Check Etc/XXX variants. They should work too.
+df = Intl.DateTimeFormat(undefined, {timeZone: 'Etc/UTC'});
+assertEquals('UTC', df.resolvedOptions().timeZone);
+
+df = Intl.DateTimeFormat(undefined, {timeZone: 'Etc/GMT'});
+assertEquals('UTC', df.resolvedOptions().timeZone);
+
+df = Intl.DateTimeFormat(undefined, {timeZone: 'euRope/beLGRade'});
+assertEquals('Europe/Belgrade', df.resolvedOptions().timeZone);
+
+// : + - are not allowed, only / _ are.
+assertThrows('Intl.DateTimeFormat(undefined, {timeZone: \'GMT+07:00\'})');
+assertThrows('Intl.DateTimeFormat(undefined, {timeZone: \'GMT+0700\'})');
+assertThrows('Intl.DateTimeFormat(undefined, {timeZone: \'GMT-05:00\'})');
+assertThrows('Intl.DateTimeFormat(undefined, {timeZone: \'GMT-0500\'})');
+assertThrows('Intl.DateTimeFormat(undefined, {timeZone: \'Etc/GMT+0\'})');
+assertThrows('Intl.DateTimeFormat(undefined, ' +
+    '{timeZone: \'America/Los-Angeles\'})');
+
+// Throws for unsupported time zones.
+assertThrows('Intl.DateTimeFormat(undefined, {timeZone: \'Aurope/Belgrade\'})');
diff --git a/test/intl/date-format/utils.js b/test/intl/date-format/utils.js
new file mode 100644
index 0000000..535de15
--- /dev/null
+++ b/test/intl/date-format/utils.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Utility methods for date testing.
+
+/**
+ * Returns date with timezone info forced into PDT.
+ */
+function usePDT(dateString) {
+  var removedTZ = dateString.replace(/(\+|-)\d{4}/, '-0007');
+  return removedTZ.replace(/\(.*?\)/, '(PDT)');
+}
diff --git a/test/intl/date-format/wellformed-unsupported-locale.js b/test/intl/date-format/wellformed-unsupported-locale.js
new file mode 100644
index 0000000..8867ec6
--- /dev/null
+++ b/test/intl/date-format/wellformed-unsupported-locale.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Passing a well formed but unsupported locale falls back to default.
+
+var dtf = Intl.DateTimeFormat(['xx']);
+
+assertEquals(dtf.resolvedOptions().locale, getDefaultLocale());
diff --git a/test/intl/general/empty-handle.js b/test/intl/general/empty-handle.js
new file mode 100644
index 0000000..d618963
--- /dev/null
+++ b/test/intl/general/empty-handle.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Minimal test case for b/161999.
+// We have to check if ObjectTemplate::NewInstance returned empty handle, which
+// can happen if there was a stack overflow.
+// This test can take some time to fail.
+
+var didThrowRangeError = false;
+try {
+  var X = '})()';
+  function C() { X[C("asd".localeCompare("asdf") < 0)] = C("a"); }
+  var b = C(C(new Date(Number.b, "").getTime()),
+            function() {
+              if (!X.C()) {
+              }
+            }[0].b++);
+} catch (e) {
+  if (e instanceof RangeError) {
+    didThrowRangeError = true;
+  }
+}
+
+assertTrue(didThrowRangeError);
diff --git a/test/intl/general/mapped-locale.js b/test/intl/general/mapped-locale.js
new file mode 100644
index 0000000..17151b5
--- /dev/null
+++ b/test/intl/general/mapped-locale.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that zh locales map properly, i.e. don't map zh-TW to zh.
+
+var nf = Intl.NumberFormat(['zh-TW'], {localeMatcher: 'lookup'});
+assertEquals('zh-TW', nf.resolvedOptions().locale);
+
+var nf = Intl.NumberFormat(['zh-Hant-TW'], {localeMatcher: 'lookup'});
+assertEquals('zh-Hant-TW', nf.resolvedOptions().locale);
+
+var nf = Intl.NumberFormat(['zh-Hant'], {localeMatcher: 'lookup'});
+assertEquals('zh-Hant', nf.resolvedOptions().locale);
+
+nf = Intl.NumberFormat(['zh'], {localeMatcher: 'lookup'});
+assertEquals('zh', nf.resolvedOptions().locale);
+
+nf = Intl.NumberFormat(['zh-CN'], {localeMatcher: 'lookup'});
+assertEquals('zh-CN', nf.resolvedOptions().locale);
+
+nf = Intl.NumberFormat(['zh-Hans-CN'], {localeMatcher: 'lookup'});
+assertEquals('zh-Hans-CN', nf.resolvedOptions().locale);
+
+nf = Intl.NumberFormat(['zh-Hans'], {localeMatcher: 'lookup'});
+assertEquals('zh-Hans', nf.resolvedOptions().locale);
+
+nf = Intl.NumberFormat(['en-US'], {localeMatcher: 'lookup'});
+assertEquals('en-US', nf.resolvedOptions().locale);
diff --git a/test/intl/general/supported-locales-of.js b/test/intl/general/supported-locales-of.js
new file mode 100644
index 0000000..016b4e9
--- /dev/null
+++ b/test/intl/general/supported-locales-of.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests supportedLocalesOf method.
+
+var undef = Intl.DateTimeFormat.supportedLocalesOf();
+assertEquals(undefined, undef[0]);
+
+var empty = Intl.DateTimeFormat.supportedLocalesOf([]);
+assertEquals(undefined, empty[0]);
+
+var strLocale = Intl.DateTimeFormat.supportedLocalesOf('sr');
+assertEquals('sr', strLocale[0]);
+
+var multiLocale =
+    Intl.DateTimeFormat.supportedLocalesOf(['sr-Thai-RS', 'de', 'zh-CN']);
+assertEquals('sr-Thai-RS', multiLocale[0]);
+assertEquals('de', multiLocale[1]);
+assertEquals('zh-CN', multiLocale[2]);
diff --git a/test/intl/general/v8Intl-exists.js b/test/intl/general/v8Intl-exists.js
new file mode 100644
index 0000000..610767e
--- /dev/null
+++ b/test/intl/general/v8Intl-exists.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure that v8Intl is mapped into Intl for backward compatibility.
+
+assertEquals(v8Intl, Intl);
+
+// Extra checks.
+assertTrue(v8Intl.hasOwnProperty('DateTimeFormat'));
+assertTrue(v8Intl.hasOwnProperty('NumberFormat'));
+assertTrue(v8Intl.hasOwnProperty('Collator'));
+assertTrue(v8Intl.hasOwnProperty('v8BreakIterator'));
diff --git a/test/intl/intl.status b/test/intl/intl.status
new file mode 100644
index 0000000..913626b
--- /dev/null
+++ b/test/intl/intl.status
@@ -0,0 +1,41 @@
+# Copyright 2013 the V8 project authors. All rights reserved.
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of Google Inc. nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+prefix intl
+
+# The following tests use getDefaultLocale() or getDefaultTimezone().
+break-iterator/default-locale: FAIL
+break-iterator/wellformed-unsupported-locale: FAIL
+collator/default-locale: FAIL
+collator/wellformed-unsupported-locale: FAIL
+date-format/default-locale: FAIL
+date-format/resolved-options: FAIL
+date-format/timezone: FAIL
+date-format/wellformed-unsupported-locale: FAIL
+general/v8Intl-exists: FAIL
+number-format/default-locale: FAIL
+number-format/wellformed-unsupported-locale: FAIL
diff --git a/test/intl/number-format/check-digit-ranges.js b/test/intl/number-format/check-digit-ranges.js
new file mode 100644
index 0000000..322785c
--- /dev/null
+++ b/test/intl/number-format/check-digit-ranges.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Digit ranges are obeyed.
+
+// Invalid ranges
+assertThrows('Intl.NumberFormat(undefined, {minimumIntegerDigits: 0})');
+assertThrows('Intl.NumberFormat(undefined, {minimumIntegerDigits: 22})');
+assertThrows('Intl.NumberFormat(undefined, {minimumIntegerDigits: null})');
+assertThrows('Intl.NumberFormat(undefined, {minimumIntegerDigits: Infinity})');
+assertThrows('Intl.NumberFormat(undefined, {minimumIntegerDigits: -Infinity})');
+assertThrows('Intl.NumberFormat(undefined, {minimumIntegerDigits: x})');
+
+assertThrows('Intl.NumberFormat(undefined, {minimumFractionDigits: -1})');
+assertThrows('Intl.NumberFormat(undefined, {maximumFractionDigits: 21})');
+
+assertThrows('Intl.NumberFormat(undefined, {minimumSignificantDigits: 0})');
+assertThrows('Intl.NumberFormat(undefined, {maximumSignificantDigits: 22})');
+assertThrows('Intl.NumberFormat(undefined, ' +
+    '{minimumSignificantDigits: 5, maximumSignificantDigits: 2})');
+
+// Valid ranges
+assertDoesNotThrow('Intl.NumberFormat(undefined, {minimumIntegerDigits: 1})');
+assertDoesNotThrow('Intl.NumberFormat(undefined, {minimumIntegerDigits: 21})');
+
+assertDoesNotThrow('Intl.NumberFormat(undefined, {minimumFractionDigits: 0})');
+assertDoesNotThrow('Intl.NumberFormat(undefined, {minimumFractionDigits: 20})');
+
+assertDoesNotThrow('Intl.NumberFormat(undefined, ' +
+    '{minimumSignificantDigits: 1})');
+assertDoesNotThrow('Intl.NumberFormat(undefined, ' +
+    '{maximumSignificantDigits: 21})');
diff --git a/test/intl/number-format/default-locale.js b/test/intl/number-format/default-locale.js
new file mode 100644
index 0000000..0d5e24d
--- /dev/null
+++ b/test/intl/number-format/default-locale.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Constructing NumberFormat with no locale arguments or with []
+// creates one with default locale.
+
+var nf = new Intl.NumberFormat([]);
+
+var options = nf.resolvedOptions();
+
+// Check it's none of these first.
+assertFalse(options.locale === 'und');
+assertFalse(options.locale === '');
+assertFalse(options.locale === undefined);
+
+// Then check for equality.
+assertEquals(options.locale, getDefaultLocale());
+
+var nfNone = new Intl.NumberFormat();
+assertEquals(options.locale, nfNone.resolvedOptions().locale);
diff --git a/test/intl/number-format/format-is-bound.js b/test/intl/number-format/format-is-bound.js
new file mode 100644
index 0000000..b24c2ed
--- /dev/null
+++ b/test/intl/number-format/format-is-bound.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create default NumberFormat.
+var nf = new Intl.NumberFormat();
+
+// Array we want to iterate, actual numbers are not important.
+var numberArray = [1, 2, 3];
+
+// It shouldn't throw.
+// The format() method should be properly bound to the nf object.
+numberArray.forEach(nf.format);
+
+// Formatting a number should work in a direct call.
+nf.format(12345);
diff --git a/test/intl/number-format/parse-currency.js b/test/intl/number-format/parse-currency.js
new file mode 100644
index 0000000..c87ffea
--- /dev/null
+++ b/test/intl/number-format/parse-currency.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Currency parsing is not yet supported. We need ICU49 or higher to get
+// it working.
+
+var nf = new Intl.NumberFormat(['en'], {style: 'currency', currency: 'USD'});
+
+assertEquals(undefined, nf.v8Parse('USD 123.43'));
diff --git a/test/intl/number-format/parse-decimal.js b/test/intl/number-format/parse-decimal.js
new file mode 100644
index 0000000..ea3f8dd
--- /dev/null
+++ b/test/intl/number-format/parse-decimal.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var nf = new Intl.NumberFormat(['en'], {style: 'decimal'});
+
+assertEquals(123.43, nf.v8Parse('123.43'));
+assertEquals(123, nf.v8Parse('123'));
+assertEquals(NaN, nf.v8Parse(NaN));
+assertEquals(12323, nf.v8Parse('123,23'));
+assertEquals(12323.456, nf.v8Parse('123,23.456'));
+assertEquals(12323.456, nf.v8Parse('0000000123,23.456'));
+assertEquals(-12323.456, nf.v8Parse('-123,23.456'));
+
+// Scientific notation gets ignored.
+assertEquals(123.456, nf.v8Parse('123.456e-3'));
diff --git a/test/intl/number-format/parse-invalid-input.js b/test/intl/number-format/parse-invalid-input.js
new file mode 100644
index 0000000..8c84d0b
--- /dev/null
+++ b/test/intl/number-format/parse-invalid-input.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Invalid input is handled properly.
+
+var nf = new Intl.NumberFormat(['en']);
+
+assertEquals(undefined, nf.v8Parse(''));
+assertEquals(undefined, nf.v8Parse('A'));
+assertEquals(undefined, nf.v8Parse(new Date()));
+assertEquals(undefined, nf.v8Parse(undefined));
+assertEquals(undefined, nf.v8Parse(null));
+assertEquals(undefined, nf.v8Parse());
+assertEquals(undefined, nf.v8Parse('Text before 12345'));
diff --git a/test/intl/number-format/parse-percent.js b/test/intl/number-format/parse-percent.js
new file mode 100644
index 0000000..4964da4
--- /dev/null
+++ b/test/intl/number-format/parse-percent.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var nf = new Intl.NumberFormat(['en'], {style: 'percent'});
+
+assertEquals(1.2343, nf.v8Parse('123.43%'));
+assertEquals(1.23, nf.v8Parse('123%'));
+assertEquals(NaN, nf.v8Parse(NaN));
+assertEquals(123.23, nf.v8Parse('123,23%'));
+assertEquals(123.23456, nf.v8Parse('123,23.456%'));
+assertEquals(123.23456, nf.v8Parse('0000000123,23.456%'));
+assertEquals(-123.23456, nf.v8Parse('-123,23.456%'));
diff --git a/test/intl/number-format/property-override.js b/test/intl/number-format/property-override.js
new file mode 100644
index 0000000..1fbe78e
--- /dev/null
+++ b/test/intl/number-format/property-override.js
@@ -0,0 +1,78 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Checks for security holes introduced by Object.property overrides.
+// For example:
+// Object.defineProperty(Array.prototype, 'locale', {
+//   set: function(value) {
+//     throw new Error('blah');
+//   },
+//   configurable: true,
+//   enumerable: false
+// });
+//
+// would throw in case of (JS) x.locale = 'us' or (C++) x->Set('locale', 'us').
+//
+// Update both number-format.js and number-format.cc so they have the same
+// list of properties.
+
+// First get supported properties.
+var properties = [];
+// Some properties are optional and won't show up in resolvedOptions if
+// they were not requested - currency, currencyDisplay,
+// minimumSignificantDigits and maximumSignificantDigits - so we request them.
+var options = Intl.NumberFormat(
+  undefined, {style: 'currency', currency: 'USD', currencyDisplay: 'name',
+              minimumSignificantDigits: 1, maximumSignificantDigits: 5}).
+    resolvedOptions();
+for (var prop in options) {
+  if (options.hasOwnProperty(prop)) {
+    properties.push(prop);
+  }
+}
+
+var expectedProperties = [
+  'style', 'locale', 'numberingSystem',
+  'currency', 'currencyDisplay', 'useGrouping',
+  'minimumIntegerDigits', 'minimumFractionDigits',
+  'maximumFractionDigits', 'minimumSignificantDigits',
+  'maximumSignificantDigits'
+];
+
+assertEquals(expectedProperties.length, properties.length);
+
+properties.forEach(function(prop) {
+  assertFalse(expectedProperties.indexOf(prop) === -1);
+});
+
+taintProperties(properties);
+
+var locale = Intl.NumberFormat(undefined,
+                               {currency: 'USD', currencyDisplay: 'name',
+                                minimumIntegerDigits: 2,
+                                numberingSystem: 'latn'}).
+    resolvedOptions().locale;
diff --git a/test/intl/number-format/protected-icu-internals.js b/test/intl/number-format/protected-icu-internals.js
new file mode 100644
index 0000000..fc9b709
--- /dev/null
+++ b/test/intl/number-format/protected-icu-internals.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Internal object we got from native code should not be writable,
+// configurable or enumerable. One can still change its public properties, but
+// we don't use them to do actual work.
+
+var format = new Intl.NumberFormat([]);
+
+// Direct write should fail.
+format.formatter = {'zzz':'some random object'};
+
+assertFalse(format.formatter.hasOwnProperty('zzz'));
+
+// Try redefining the property.
+var didThrow = false;
+try {
+  Object.defineProperty(format, 'formatter', {value: undefined});
+} catch(e) {
+  didThrow = true;
+}
+assertTrue(didThrow);
+
+// Try deleting the property.
+assertFalse(delete format.formatter);
diff --git a/test/intl/number-format/resolved-options-is-method.js b/test/intl/number-format/resolved-options-is-method.js
new file mode 100644
index 0000000..1b56716
--- /dev/null
+++ b/test/intl/number-format/resolved-options-is-method.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that resolvedOptions is a method, not a property getter and that
+// the result is mutable.
+
+var nf = new Intl.NumberFormat();
+
+var result = nf.resolvedOptions();
+
+assertTrue(result instanceof Object);
+
+// Result should be mutable.
+result.locale = 'xx';
+
+assertEquals(result.locale, 'xx');
diff --git a/test/intl/number-format/wellformed-unsupported-locale.js b/test/intl/number-format/wellformed-unsupported-locale.js
new file mode 100644
index 0000000..e3fe9cc
--- /dev/null
+++ b/test/intl/number-format/wellformed-unsupported-locale.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Passing a well formed but unsupported locale falls back to default.
+
+var nf = Intl.NumberFormat(['xx']);
+
+assertEquals(nf.resolvedOptions().locale, getDefaultLocale());
diff --git a/test/intl/overrides/caching.js b/test/intl/overrides/caching.js
new file mode 100644
index 0000000..5ff3c39
--- /dev/null
+++ b/test/intl/overrides/caching.js
@@ -0,0 +1,60 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Performance test for overriden methods. Makes sure that default case
+// is faster (cached) than the general case.
+
+// Default, cached.
+var startTime = new Date();
+for (var i = 0; i < 1000; i++) {
+  'a'.localeCompare('c');
+}
+var endTime = new Date();
+var cachedTime = endTime.getTime() - startTime.getTime();
+
+// Not cached.
+startTime = new Date();
+for (var i = 0; i < 1000; i++) {
+  'a'.localeCompare('c', 'sr');
+}
+endTime = new Date();
+var nonCachedTime = endTime.getTime() - startTime.getTime();
+
+// Using collator. Faster than default, but not by much.
+var collator = Intl.Collator();
+startTime = new Date();
+for (var i = 0; i < 1000; i++) {
+  collator.compare('a', 'c');
+}
+endTime = new Date();
+collatorTime = endTime.getTime() - startTime.getTime();
+
+// Difference is within 20%.
+assertTrue(collatorTime < cachedTime);
+// Non-cached time is much slower, measured to 12.5 times.
+assertTrue(cachedTime < nonCachedTime);
+
diff --git a/test/intl/overrides/date.js b/test/intl/overrides/date.js
new file mode 100644
index 0000000..a35d63d
--- /dev/null
+++ b/test/intl/overrides/date.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests Date.prototype.toLocaleXXXString method overrides.
+
+var date = new Date();
+
+
+// Defaults for toLocaleXXXString
+var dtfDate = new Intl.DateTimeFormat();
+var dtfTime = new Intl.DateTimeFormat(
+  [], {hour: 'numeric', minute: 'numeric', second: 'numeric'});
+var dtfAll = new Intl.DateTimeFormat(
+  [], {year: 'numeric', month: 'numeric', day: 'numeric',
+       hour: 'numeric', minute: 'numeric', second: 'numeric'});
+assertEquals(dtfAll.format(date), date.toLocaleString());
+assertEquals(dtfDate.format(date), date.toLocaleDateString());
+assertEquals(dtfTime.format(date), date.toLocaleTimeString());
+
+
+// Specify locale, default options for toLocaleXXXString
+var locale = ['sr'];
+dtfDate = new Intl.DateTimeFormat(locale);
+dtfTime = new Intl.DateTimeFormat(
+  locale, {hour: 'numeric', minute: 'numeric', second: 'numeric'});
+dtfAll = new Intl.DateTimeFormat(
+  locale, {year: 'numeric', month: 'numeric', day: 'numeric',
+           hour: 'numeric', minute: 'numeric', second: 'numeric'});
+assertEquals(dtfAll.format(date), date.toLocaleString(locale));
+assertEquals(dtfDate.format(date), date.toLocaleDateString(locale));
+assertEquals(dtfTime.format(date), date.toLocaleTimeString(locale));
+
+
+// Specify locale and options for toLocaleXXXString
+locale = ['ko'];
+var options = {year: 'numeric', month: 'long', day: 'numeric',
+               hour: 'numeric', minute: '2-digit', second: 'numeric'};
+var dtf = new Intl.DateTimeFormat(locale, options);
+assertEquals(dtf.format(date), date.toLocaleString(locale, options));
+assertEquals(dtf.format(date), date.toLocaleDateString(locale, options));
+assertEquals(dtf.format(date), date.toLocaleTimeString(locale, options));
diff --git a/test/intl/overrides/number.js b/test/intl/overrides/number.js
new file mode 100644
index 0000000..11f41fd
--- /dev/null
+++ b/test/intl/overrides/number.js
@@ -0,0 +1,53 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests Number.prototype.toLocaleString method override.
+
+var integer = 123456790;
+var float = 1234567890.123434;
+
+
+// Defaults
+var nf = new Intl.NumberFormat();
+assertEquals(nf.format(integer), integer.toLocaleString());
+assertEquals(nf.format(float), float.toLocaleString());
+
+
+// Specify locale, default options for toLocaleString method.
+var locale = ['sr'];
+nf = new Intl.NumberFormat(locale);
+assertEquals(nf.format(integer), integer.toLocaleString(locale));
+assertEquals(nf.format(float), float.toLocaleString(locale));
+
+
+// Specify locale and options for toLocaleString method.
+locale = ['ko'];
+var options = {minimumIntegerDigits: 8, useGroupingSeparator: true,
+               minimumFractionalDigits: 1, maximumFractionalDigits: 2};
+nf = new Intl.NumberFormat(locale, options);
+assertEquals(nf.format(integer), integer.toLocaleString(locale, options));
+assertEquals(nf.format(float), float.toLocaleString(locale, options));
diff --git a/test/intl/overrides/security.js b/test/intl/overrides/security.js
new file mode 100644
index 0000000..e012753
--- /dev/null
+++ b/test/intl/overrides/security.js
@@ -0,0 +1,50 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we always use original Intl.Constructors for toLocaleString calls.
+
+function throwError() {
+  throw new Error('Malicious method invoked.');
+}
+
+Intl.Collator = Intl.NumberFormat = Intl.DateTimeFormat = throwError;
+
+Intl.Collator.prototype.compare = throwError;
+Intl.NumberFormat.prototype.format = throwError;
+Intl.DateTimeFormat.prototype.format = throwError;
+
+// Make sure constructors actually throw now.
+assertThrows('new Intl.Collator()');
+assertThrows('new Intl.NumberFormat()');
+assertThrows('new Intl.DateTimeFormat()');
+
+// None of these should throw.
+assertDoesNotThrow('new Date().toLocaleString()');
+assertDoesNotThrow('new Date().toLocaleDateString()');
+assertDoesNotThrow('new Date().toLocaleTimeString()');
+assertDoesNotThrow('new Number(12345.412).toLocaleString()');
+assertDoesNotThrow('new String(\'abc\').localeCompare(\'bcd\')');
diff --git a/test/intl/overrides/string.js b/test/intl/overrides/string.js
new file mode 100644
index 0000000..9e9da4d
--- /dev/null
+++ b/test/intl/overrides/string.js
@@ -0,0 +1,69 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests String.prototype.localeCompare method override.
+
+var testData = {
+  'en': ['blood', 'bull', 'ascend', 'zed', 'down'],
+  'sr': ['новине', 'ограда', 'жирафа', 'Никола', 'Андрија', 'Стара Планина',
+         'џак', 'алав', 'ћук', 'чука'],
+  'de': ['März', 'Fuße', 'FUSSE', 'Fluße', 'Flusse', 'flusse', 'fluße',
+         'flüße', 'flüsse']
+};
+
+
+function testArrays(locale) {
+  var data;
+  if (locale === undefined) {
+    data = testData['en'];
+    locale = [];
+  } else {
+    data = testData[locale];
+  }
+
+  var collator = new Intl.Collator(locale, options);
+  var collatorResult = data.sort(collator.compare);
+  var localeCompareResult = data.sort(function(a, b) {
+    return a.localeCompare(b, locale, options)
+  });
+  assertEquals(collatorResult, localeCompareResult);
+}
+
+
+// Defaults
+var options = undefined;
+testArrays();
+
+
+// Specify locale, keep default options.
+options = undefined;
+Object.keys(testData).forEach(testArrays);
+
+
+// Specify locale and options.
+options = {caseFirst: 'upper'};
+Object.keys(testData).forEach(testArrays);
diff --git a/test/intl/overrides/webkit-tests.js b/test/intl/overrides/webkit-tests.js
new file mode 100644
index 0000000..1429de6
--- /dev/null
+++ b/test/intl/overrides/webkit-tests.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Makes sure we don't break affected WebKit tests.
+
+// Handles fast/js/string-prototype-properties.html
+assertThrows('String.prototype.localeCompare.call(undefined, \'1224\')');
+assertEquals(0, String.prototype.localeCompare.call(1224, '1224'));
diff --git a/test/intl/testcfg.py b/test/intl/testcfg.py
new file mode 100644
index 0000000..d25683b
--- /dev/null
+++ b/test/intl/testcfg.py
@@ -0,0 +1,72 @@
+# Copyright 2013 the V8 project authors. All rights reserved.
+# Redistribution and use in source and binary forms, with or without
+# modification, are permitted provided that the following conditions are
+# met:
+#
+#     * Redistributions of source code must retain the above copyright
+#       notice, this list of conditions and the following disclaimer.
+#     * Redistributions in binary form must reproduce the above
+#       copyright notice, this list of conditions and the following
+#       disclaimer in the documentation and/or other materials provided
+#       with the distribution.
+#     * Neither the name of Google Inc. nor the names of its
+#       contributors may be used to endorse or promote products derived
+#       from this software without specific prior written permission.
+#
+# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+# "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+# LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+# A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+# OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+# SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+# LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+# DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+# THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+# (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+# OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+import os
+
+from testrunner.local import testsuite
+from testrunner.objects import testcase
+
+
+class IntlTestSuite(testsuite.TestSuite):
+
+  def __init__(self, name, root):
+    super(IntlTestSuite, self).__init__(name, root)
+
+  def ListTests(self, context):
+    tests = []
+    for dirname, dirs, files in os.walk(self.root):
+      for dotted in [x for x in dirs if x.startswith('.')]:
+        dirs.remove(dotted)
+      dirs.sort()
+      files.sort()
+      for filename in files:
+        if (filename.endswith(".js") and filename != "assert.js" and
+            filename != "utils.js"):
+          testname = os.path.join(dirname[len(self.root) + 1:], filename[:-3])
+          test = testcase.TestCase(self, testname)
+          tests.append(test)
+    return tests
+
+  def GetFlagsForTestCase(self, testcase, context):
+    flags = [] + context.mode_flags
+
+    files = []
+    files.append(os.path.join(self.root, "assert.js"))
+    files.append(os.path.join(self.root, "utils.js"))
+    files.append(os.path.join(self.root, "date-format", "utils.js"))
+    files.append(os.path.join(self.root, testcase.path + self.suffix()))
+
+    flags += files
+    if context.isolates:
+      flags.append("--isolate")
+      flags += files
+
+    return testcase.flags + flags
+
+
+def GetSuite(name, root):
+  return IntlTestSuite(name, root)
diff --git a/test/intl/utils.js b/test/intl/utils.js
new file mode 100644
index 0000000..9173590
--- /dev/null
+++ b/test/intl/utils.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+/**
+ * Taints properties on Object.prototype so we can find security issues.
+ */
+function taintProperties(properties) {
+  properties.forEach(function(property) {
+    Object.defineProperty(Object.prototype, property, {
+      set: function(value) {
+        throw new Error('Property ' + property + ' is compromised. ' +
+                        'Setting value: ' + value);
+      }
+    });
+  });
+}
diff --git a/test/mjsunit/allocation-site-info.js b/test/mjsunit/allocation-site-info.js
index 86c28aa..72df772 100644
--- a/test/mjsunit/allocation-site-info.js
+++ b/test/mjsunit/allocation-site-info.js
@@ -133,9 +133,7 @@
   obj = fastliteralcase(get_standard_literal(), 1.5);
   assertKind(elements_kind.fast_double, obj);
   obj = fastliteralcase(get_standard_literal(), 2);
-  // TODO(hpayer): bring the following assert back as soon as allocation
-  // sites work again for fast literals
-  //assertKind(elements_kind.fast_double, obj);
+  assertKind(elements_kind.fast_double, obj);
 
   // The test below is in a loop because arrays that live
   // at global scope without the chance of being recreated
@@ -175,9 +173,7 @@
   obj = fastliteralcase_smifast("carter");
   assertKind(elements_kind.fast, obj);
   obj = fastliteralcase_smifast(2);
-  // TODO(hpayer): bring the following assert back as soon as allocation
-  // sites work again for fast literals
-  //assertKind(elements_kind.fast, obj);
+  assertKind(elements_kind.fast, obj);
 
   function newarraycase_smidouble(value) {
     var a = new Array();
@@ -301,9 +297,26 @@
     assertTrue(new type(1,2,3) instanceof type);
   }
 
+  function instanceof_check2(type) {
+    assertTrue(new type() instanceof type);
+    assertTrue(new type(5) instanceof type);
+    assertTrue(new type(1,2,3) instanceof type);
+  }
+
   var realmBArray = Realm.eval(realmB, "Array");
   instanceof_check(Array);
   instanceof_check(realmBArray);
+
+  // instanceof_check2 is here because the call site goes through a state.
+  // Since instanceof_check(Array) was first called with the current context
+  // Array function, it went from (uninit->Array) then (Array->megamorphic).
+  // We'll get a different state traversal if we start with realmBArray.
+  // It'll go (uninit->realmBArray) then (realmBArray->megamorphic). Recognize
+  // that state "Array" implies an AllocationSite is present, and code is
+  // configured to use it.
+  instanceof_check2(realmBArray);
+  instanceof_check2(Array);
+
   %OptimizeFunctionOnNextCall(instanceof_check);
 
   // No de-opt will occur because HCallNewArray wasn't selected, on account of
diff --git a/test/mjsunit/compiler/minus-zero.js b/test/mjsunit/compiler/minus-zero.js
new file mode 100644
index 0000000..6efceb5
--- /dev/null
+++ b/test/mjsunit/compiler/minus-zero.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function add(x, y) {
+  return x + y;
+}
+
+assertEquals(0, add(0, 0));
+assertEquals(0, add(0, 0));
+%OptimizeFunctionOnNextCall(add);
+assertEquals(-0, add(-0, -0));
diff --git a/test/mjsunit/compiler/phi-representations.js b/test/mjsunit/compiler/phi-representations.js
new file mode 100644
index 0000000..6d11bb0
--- /dev/null
+++ b/test/mjsunit/compiler/phi-representations.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function ar() {
+  var r = undefined;
+  var f = 1;
+  while (f--) {
+    r = (typeof r === 'undefined') ? 0.1 : r;
+  };
+  return (r - r);
+}
+
+assertEquals(0, ar());
+assertEquals(0, ar());
+%OptimizeFunctionOnNextCall(ar);
+assertEquals(0, ar());
+
+function ar2() {
+  var r = undefined;
+  var f = 1;
+  while (f--) {
+    r = r === undefined ? 0.1 : r;
+  };
+  return (r - r);
+}
+
+assertEquals(0, ar2());
+assertEquals(0, ar2());
+%OptimizeFunctionOnNextCall(ar2);
+assertEquals(0, ar2());
diff --git a/test/mjsunit/harmony/object-observe.js b/test/mjsunit/harmony/object-observe.js
index 0434ccd..103dda6 100644
--- a/test/mjsunit/harmony/object-observe.js
+++ b/test/mjsunit/harmony/object-observe.js
@@ -637,7 +637,8 @@
 Object.observe(obj2, recursiveObserver2);
 ++obj1.a;
 Object.deliverChangeRecords(recursiveObserver2);
-assertEquals(199, recordCount);
+// TODO(verwaest): Disabled because of bug 2774.
+// assertEquals(199, recordCount);
 
 
 // Observing named properties.
diff --git a/test/mjsunit/harmony/typedarrays.js b/test/mjsunit/harmony/typedarrays.js
index e1b0e65..99364c8 100644
--- a/test/mjsunit/harmony/typedarrays.js
+++ b/test/mjsunit/harmony/typedarrays.js
@@ -219,7 +219,6 @@
     assertThrows(function() { new proto(unalignedArrayBuffer)}, RangeError);
     assertThrows(function() { new proto(unalignedArrayBuffer, 5*elementSize)},
                  RangeError);
-    assertThrows(function() { new proto() }, TypeError);
   }
 
   var aFromString = new proto("30");
@@ -250,6 +249,12 @@
   assertSame(0, aOverAbLen0.length);
   assertSame(0, aOverAbLen0.byteLength);
   assertSame(0, aOverAbLen0.byteOffset);
+
+  var aNoParam = new proto();
+  assertSame(elementSize, aNoParam.BYTES_PER_ELEMENT);
+  assertSame(0, aNoParam.length);
+  assertSame(0, aNoParam.byteLength);
+  assertSame(0, aNoParam.byteOffset);
 }
 
 TestTypedArray(Uint8Array, 1, 0xFF);
diff --git a/test/mjsunit/regress/regress-frame-details-null-receiver.js b/test/mjsunit/regress/regress-frame-details-null-receiver.js
new file mode 100644
index 0000000..d15ed4d
--- /dev/null
+++ b/test/mjsunit/regress/regress-frame-details-null-receiver.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+
+Debug = debug.Debug;
+var listened = false;
+
+function listener(event, exec_state, event_data, data) {
+  if (event == Debug.DebugEvent.Exception) {
+    for (var i = 0; i < exec_state.frameCount(); i++) {
+      print(exec_state.frame(i).receiver());
+      print(exec_state.frame(i).func().name());
+    }
+  }
+  listened = true;
+}
+
+Debug.setListener(listener);
+Debug.setBreakOnException();
+
+assertThrows(function() { delete null['foo']; });
+
+Debug.clearBreakOnException();
+Debug.setListener(null);
+
+assertTrue(listened);
+
diff --git a/test/mjsunit/tools/profviz-test.default b/test/mjsunit/tools/profviz-test.default
new file mode 100644
index 0000000..04185a2
--- /dev/null
+++ b/test/mjsunit/tools/profviz-test.default
@@ -0,0 +1,1566 @@
+[
+  "set yrange [0:24.5]",
+  "set xlabel \"execution time in ms\"",
+  "set xrange [2.4204999999999997:141.1669999999999]",
+  "set style fill pattern 2 bo 1",
+  "set style rect fs solid 1 noborder",
+  "set style line 1 lt 1 lw 1 lc rgb \"#000000\"",
+  "set border 15 lw 0.2",
+  "set style line 2 lt 1 lw 1 lc rgb \"#9944CC\"",
+  "set xtics out nomirror",
+  "unset key",
+  "set object 1 rect from 87.51699999999991, 7 to 87.60371656249991, 3 fc rgb \"#9944CC\"",
+  "set object 2 rect from 110.7114999999999, 7 to 110.7982165624999, 3 fc rgb \"#9944CC\"",
+  "set object 3 rect from 133.5129999999999, 7 to 133.59971656249988, 3 fc rgb \"#9944CC\"",
+  "set object 4 rect from 61.49249999999995, 7 to 61.57921656249995, 5.020618556701031 fc rgb \"#9944CC\"",
+  "set object 5 rect from 101.40849999999992, 7 to 101.49521656249992, 5.103092783505154 fc rgb \"#9944CC\"",
+  "set object 6 rect from 57.242999999999974, 7 to 57.329716562499975, 6.766323024054983 fc rgb \"#9944CC\"",
+  "set object 7 rect from 58.751499999999965, 7 to 58.838216562499966, 6.766323024054983 fc rgb \"#9944CC\"",
+  "set object 8 rect from 60.72499999999996, 7 to 60.81171656249996, 6.766323024054983 fc rgb \"#9944CC\"",
+  "set ytics out nomirror (\"execution (59.6%%)\" 12.5, \"external (0.2%%)\" 13.5, \"compile unopt (3.1%%)\" 14.5, \"recompile sync (6.7%%)\" 15.5, \"recompile async (11.6%%)\" 16.5, \"compile eval (0.0%%)\" 17.5, \"parse (10.0%%)\" 18.5, \"preparse (0.8%%)\" 19.5, \"lazy parse (2.9%%)\" 20.5, \"gc scavenge (1.7%%)\" 21.5, \"gc compaction (3.3%%)\" 22.5, \"gc context (0.0%%)\" 23.5, \"code kind color coding\" 11, \"code kind in execution\" 10, \"top 8 js stack frames\" 9, \"pause times\" 0, \"max deopt size: 9.1 kB\" 7)",
+  "set object 9 rect from 42.11000000000001, 12.83 to 42.28050000000001, 12.17 fc rgb \"#000000\"",
+  "set object 10 rect from 42.298000000000016, 12.83 to 42.30000000000002, 12.17 fc rgb \"#000000\"",
+  "set object 11 rect from 42.31450000000002, 12.83 to 42.62700000000002, 12.17 fc rgb \"#000000\"",
+  "set object 12 rect from 42.656500000000015, 12.83 to 42.66150000000002, 12.17 fc rgb \"#000000\"",
+  "set object 13 rect from 42.70600000000002, 12.83 to 42.747000000000014, 12.17 fc rgb \"#000000\"",
+  "set object 14 rect from 42.763500000000015, 12.83 to 42.76550000000001, 12.17 fc rgb \"#000000\"",
+  "set object 15 rect from 42.795000000000016, 12.83 to 42.812500000000014, 12.17 fc rgb \"#000000\"",
+  "set object 16 rect from 42.83300000000001, 12.83 to 42.844000000000015, 12.17 fc rgb \"#000000\"",
+  "set object 17 rect from 42.858500000000014, 12.83 to 42.85950000000001, 12.17 fc rgb \"#000000\"",
+  "set object 18 rect from 42.88200000000001, 12.83 to 43.60550000000001, 12.17 fc rgb \"#000000\"",
+  "set object 19 rect from 43.62000000000002, 12.83 to 43.622000000000014, 12.17 fc rgb \"#000000\"",
+  "set object 20 rect from 43.632500000000014, 12.83 to 44.796000000000014, 12.17 fc rgb \"#000000\"",
+  "set object 21 rect from 44.81150000000002, 12.83 to 44.812500000000014, 12.17 fc rgb \"#000000\"",
+  "set object 22 rect from 44.82200000000002, 12.83 to 44.84500000000001, 12.17 fc rgb \"#000000\"",
+  "set object 23 rect from 44.87150000000002, 12.83 to 44.87550000000002, 12.17 fc rgb \"#000000\"",
+  "set object 24 rect from 44.917000000000016, 12.83 to 44.996000000000016, 12.17 fc rgb \"#000000\"",
+  "set object 25 rect from 45.00850000000001, 12.83 to 45.01150000000001, 12.17 fc rgb \"#000000\"",
+  "set object 26 rect from 45.02900000000001, 12.83 to 45.04700000000001, 12.17 fc rgb \"#000000\"",
+  "set object 27 rect from 45.06450000000002, 12.83 to 45.068500000000014, 12.17 fc rgb \"#000000\"",
+  "set object 28 rect from 45.08700000000001, 12.83 to 45.09600000000001, 12.17 fc rgb \"#000000\"",
+  "set object 29 rect from 45.107500000000016, 12.83 to 45.110500000000016, 12.17 fc rgb \"#000000\"",
+  "set object 30 rect from 45.13500000000002, 12.83 to 45.14400000000002, 12.17 fc rgb \"#000000\"",
+  "set object 31 rect from 45.16150000000002, 12.83 to 45.32050000000002, 12.17 fc rgb \"#000000\"",
+  "set object 32 rect from 45.33700000000002, 12.83 to 45.34000000000002, 12.17 fc rgb \"#000000\"",
+  "set object 33 rect from 45.361500000000014, 12.83 to 45.38750000000002, 12.17 fc rgb \"#000000\"",
+  "set object 34 rect from 45.402000000000015, 12.83 to 45.405000000000015, 12.17 fc rgb \"#000000\"",
+  "set object 35 rect from 45.41750000000002, 12.83 to 45.43250000000002, 12.17 fc rgb \"#000000\"",
+  "set object 36 rect from 45.442000000000014, 12.83 to 45.49750000000001, 12.17 fc rgb \"#000000\"",
+  "set object 37 rect from 45.55900000000001, 12.83 to 45.56900000000001, 12.17 fc rgb \"#000000\"",
+  "set object 38 rect from 45.626500000000014, 12.83 to 45.66050000000001, 12.17 fc rgb \"#000000\"",
+  "set object 39 rect from 45.70300000000001, 12.83 to 45.71200000000001, 12.17 fc rgb \"#000000\"",
+  "set object 40 rect from 45.76150000000001, 12.83 to 45.79350000000001, 12.17 fc rgb \"#000000\"",
+  "set object 41 rect from 45.81700000000001, 12.83 to 45.82000000000001, 12.17 fc rgb \"#000000\"",
+  "set object 42 rect from 45.84850000000001, 12.83 to 45.86950000000001, 12.17 fc rgb \"#000000\"",
+  "set object 43 rect from 45.92300000000001, 12.83 to 45.93000000000001, 12.17 fc rgb \"#000000\"",
+  "set object 44 rect from 45.97850000000001, 12.83 to 45.99450000000001, 12.17 fc rgb \"#000000\"",
+  "set object 45 rect from 46.060500000000005, 12.83 to 46.08650000000001, 12.17 fc rgb \"#000000\"",
+  "set object 46 rect from 46.13100000000001, 12.83 to 46.18500000000001, 12.17 fc rgb \"#000000\"",
+  "set object 47 rect from 46.28150000000001, 12.83 to 46.291500000000006, 12.17 fc rgb \"#000000\"",
+  "set object 48 rect from 46.37200000000001, 12.83 to 46.550000000000004, 12.17 fc rgb \"#000000\"",
+  "set object 49 rect from 46.5915, 12.83 to 46.59550000000001, 12.17 fc rgb \"#000000\"",
+  "set object 50 rect from 46.621, 12.83 to 46.65500000000001, 12.17 fc rgb \"#000000\"",
+  "set object 51 rect from 46.691500000000005, 12.83 to 46.694500000000005, 12.17 fc rgb \"#000000\"",
+  "set object 52 rect from 46.74, 12.83 to 46.861000000000004, 12.17 fc rgb \"#000000\"",
+  "set object 53 rect from 46.8935, 12.83 to 46.8975, 12.17 fc rgb \"#000000\"",
+  "set object 54 rect from 46.9925, 12.83 to 47.039500000000004, 12.17 fc rgb \"#000000\"",
+  "set object 55 rect from 47.049, 12.83 to 47.0765, 12.17 fc rgb \"#000000\"",
+  "set object 56 rect from 47.135000000000005, 12.83 to 47.141, 12.17 fc rgb \"#000000\"",
+  "set object 57 rect from 47.3935, 12.83 to 47.4125, 12.17 fc rgb \"#000000\"",
+  "set object 58 rect from 47.465, 12.83 to 47.472, 12.17 fc rgb \"#000000\"",
+  "set object 59 rect from 47.5235, 12.83 to 49.454499999999996, 12.17 fc rgb \"#000000\"",
+  "set object 60 rect from 49.467, 12.83 to 49.469, 12.17 fc rgb \"#000000\"",
+  "set object 61 rect from 49.4955, 12.83 to 49.6855, 12.17 fc rgb \"#000000\"",
+  "set object 62 rect from 49.726, 12.83 to 49.732, 12.17 fc rgb \"#000000\"",
+  "set object 63 rect from 49.780499999999996, 12.83 to 49.799499999999995, 12.17 fc rgb \"#000000\"",
+  "set object 64 rect from 49.812999999999995, 12.83 to 49.814, 12.17 fc rgb \"#000000\"",
+  "set object 65 rect from 49.82449999999999, 12.83 to 49.851, 12.17 fc rgb \"#000000\"",
+  "set object 66 rect from 49.8685, 12.83 to 49.894499999999994, 12.17 fc rgb \"#000000\"",
+  "set object 67 rect from 49.9695, 12.83 to 50.083999999999996, 12.17 fc rgb \"#000000\"",
+  "set object 68 rect from 50.14149999999999, 12.83 to 50.147499999999994, 12.17 fc rgb \"#000000\"",
+  "set object 69 rect from 50.20799999999999, 12.83 to 50.29299999999999, 12.17 fc rgb \"#000000\"",
+  "set object 70 rect from 50.31249999999999, 12.83 to 50.314499999999995, 12.17 fc rgb \"#000000\"",
+  "set object 71 rect from 50.32899999999999, 12.83 to 50.36699999999999, 12.17 fc rgb \"#000000\"",
+  "set object 72 rect from 50.39849999999999, 12.83 to 50.40249999999999, 12.17 fc rgb \"#000000\"",
+  "set object 73 rect from 50.43099999999999, 12.83 to 50.54899999999999, 12.17 fc rgb \"#000000\"",
+  "set object 74 rect from 50.62049999999999, 12.83 to 50.62949999999999, 12.17 fc rgb \"#000000\"",
+  "set object 75 rect from 51.02349999999999, 12.83 to 51.27549999999999, 12.17 fc rgb \"#000000\"",
+  "set object 76 rect from 51.29099999999999, 12.83 to 51.292999999999985, 12.17 fc rgb \"#000000\"",
+  "set object 77 rect from 51.30249999999999, 12.83 to 51.52249999999999, 12.17 fc rgb \"#000000\"",
+  "set object 78 rect from 51.56899999999999, 12.83 to 51.57499999999999, 12.17 fc rgb \"#000000\"",
+  "set object 79 rect from 51.78349999999999, 12.83 to 51.87299999999998, 12.17 fc rgb \"#000000\"",
+  "set object 80 rect from 51.89049999999999, 12.83 to 51.89349999999999, 12.17 fc rgb \"#000000\"",
+  "set object 81 rect from 51.91599999999998, 12.83 to 52.115999999999985, 12.17 fc rgb \"#000000\"",
+  "set object 82 rect from 52.13449999999999, 12.83 to 52.13749999999999, 12.17 fc rgb \"#000000\"",
+  "set object 83 rect from 52.15399999999998, 12.83 to 52.286999999999985, 12.17 fc rgb \"#000000\"",
+  "set object 84 rect from 52.300499999999985, 12.83 to 52.30249999999998, 12.17 fc rgb \"#000000\"",
+  "set object 85 rect from 52.31499999999998, 12.83 to 52.362999999999985, 12.17 fc rgb \"#000000\"",
+  "set object 86 rect from 52.404499999999985, 12.83 to 52.40949999999998, 12.17 fc rgb \"#000000\"",
+  "set object 87 rect from 52.448999999999984, 12.83 to 54.55999999999998, 12.17 fc rgb \"#000000\"",
+  "set object 88 rect from 54.951999999999984, 12.83 to 55.48599999999998, 12.17 fc rgb \"#000000\"",
+  "set object 89 rect from 55.66249999999998, 12.83 to 55.79999999999998, 12.17 fc rgb \"#000000\"",
+  "set object 90 rect from 56.198999999999984, 12.83 to 56.25149999999998, 12.17 fc rgb \"#000000\"",
+  "set object 91 rect from 56.52499999999998, 12.83 to 56.55699999999998, 12.17 fc rgb \"#000000\"",
+  "set object 92 rect from 56.634499999999974, 12.83 to 56.63999999999998, 12.17 fc rgb \"#000000\"",
+  "set object 93 rect from 56.69449999999998, 12.83 to 56.746499999999976, 12.17 fc rgb \"#000000\"",
+  "set object 94 rect from 56.845999999999975, 12.83 to 56.85849999999998, 12.17 fc rgb \"#000000\"",
+  "set object 95 rect from 56.97649999999997, 12.83 to 57.03599999999997, 12.17 fc rgb \"#000000\"",
+  "set object 96 rect from 57.205999999999975, 12.83 to 57.27249999999997, 12.17 fc rgb \"#000000\"",
+  "set object 97 rect from 57.33299999999997, 12.83 to 57.565999999999974, 12.17 fc rgb \"#000000\"",
+  "set object 98 rect from 57.64849999999997, 12.83 to 57.878499999999974, 12.17 fc rgb \"#000000\"",
+  "set object 99 rect from 57.934999999999974, 12.83 to 57.97299999999997, 12.17 fc rgb \"#000000\"",
+  "set object 100 rect from 58.07699999999997, 12.83 to 58.09149999999997, 12.17 fc rgb \"#000000\"",
+  "set object 101 rect from 58.12149999999997, 12.83 to 58.14299999999997, 12.17 fc rgb \"#000000\"",
+  "set object 102 rect from 58.17349999999997, 12.83 to 58.17499999999997, 12.17 fc rgb \"#000000\"",
+  "set object 103 rect from 58.21549999999997, 12.83 to 58.23599999999997, 12.17 fc rgb \"#000000\"",
+  "set object 104 rect from 58.275499999999965, 12.83 to 58.27599999999997, 12.17 fc rgb \"#000000\"",
+  "set object 105 rect from 58.300499999999964, 12.83 to 58.30299999999997, 12.17 fc rgb \"#000000\"",
+  "set object 106 rect from 58.316999999999965, 12.83 to 58.409499999999966, 12.17 fc rgb \"#000000\"",
+  "set object 107 rect from 58.58699999999997, 12.83 to 58.589499999999965, 12.17 fc rgb \"#000000\"",
+  "set object 108 rect from 58.65749999999996, 12.83 to 58.92499999999996, 12.17 fc rgb \"#000000\"",
+  "set object 109 rect from 59.02199999999996, 12.83 to 59.02349999999996, 12.17 fc rgb \"#000000\"",
+  "set object 110 rect from 59.042999999999964, 12.83 to 59.641499999999965, 12.17 fc rgb \"#000000\"",
+  "set object 111 rect from 59.69699999999996, 12.83 to 59.89099999999996, 12.17 fc rgb \"#000000\"",
+  "set object 112 rect from 59.93649999999996, 12.83 to 60.04699999999996, 12.17 fc rgb \"#000000\"",
+  "set object 113 rect from 60.08349999999996, 12.83 to 60.17149999999996, 12.17 fc rgb \"#000000\"",
+  "set object 114 rect from 60.54849999999996, 12.83 to 60.55099999999995, 12.17 fc rgb \"#000000\"",
+  "set object 115 rect from 60.65699999999996, 12.83 to 60.91649999999996, 12.17 fc rgb \"#000000\"",
+  "set object 116 rect from 61.253999999999955, 12.83 to 61.31249999999996, 12.17 fc rgb \"#000000\"",
+  "set object 117 rect from 61.464999999999954, 12.83 to 62.16149999999996, 12.17 fc rgb \"#000000\"",
+  "set object 118 rect from 62.548999999999964, 12.83 to 62.62699999999996, 12.17 fc rgb \"#000000\"",
+  "set object 119 rect from 63.024999999999956, 12.83 to 63.14749999999995, 12.17 fc rgb \"#000000\"",
+  "set object 120 rect from 63.41299999999995, 12.83 to 64.40899999999996, 12.17 fc rgb \"#000000\"",
+  "set object 121 rect from 64.61749999999995, 12.83 to 65.56449999999995, 12.17 fc rgb \"#000000\"",
+  "set object 122 rect from 65.61699999999995, 12.83 to 67.34249999999994, 12.17 fc rgb \"#000000\"",
+  "set object 123 rect from 67.45099999999994, 12.83 to 67.45549999999994, 12.17 fc rgb \"#000000\"",
+  "set object 124 rect from 67.48749999999995, 12.83 to 67.53599999999994, 12.17 fc rgb \"#000000\"",
+  "set object 125 rect from 67.57649999999995, 12.83 to 67.57799999999995, 12.17 fc rgb \"#000000\"",
+  "set object 126 rect from 67.59199999999996, 12.83 to 68.70599999999996, 12.17 fc rgb \"#000000\"",
+  "set object 127 rect from 68.76649999999995, 12.83 to 69.10849999999995, 12.17 fc rgb \"#000000\"",
+  "set object 128 rect from 69.49599999999995, 12.83 to 70.31749999999994, 12.17 fc rgb \"#000000\"",
+  "set object 129 rect from 70.33949999999994, 12.83 to 70.34449999999994, 12.17 fc rgb \"#000000\"",
+  "set object 130 rect from 70.35799999999995, 12.83 to 70.40899999999993, 12.17 fc rgb \"#000000\"",
+  "set object 131 rect from 70.58649999999994, 12.83 to 72.22199999999995, 12.17 fc rgb \"#000000\"",
+  "set object 132 rect from 72.28049999999995, 12.83 to 74.40699999999995, 12.17 fc rgb \"#000000\"",
+  "set object 133 rect from 74.63849999999994, 12.83 to 75.04799999999994, 12.17 fc rgb \"#000000\"",
+  "set object 134 rect from 75.20099999999994, 12.83 to 75.41849999999994, 12.17 fc rgb \"#000000\"",
+  "set object 135 rect from 75.46799999999995, 12.83 to 78.16449999999993, 12.17 fc rgb \"#000000\"",
+  "set object 136 rect from 78.23649999999994, 12.83 to 80.90399999999994, 12.17 fc rgb \"#000000\"",
+  "set object 137 rect from 80.95049999999993, 12.83 to 83.58349999999993, 12.17 fc rgb \"#000000\"",
+  "set object 138 rect from 83.63999999999993, 12.83 to 84.09549999999993, 12.17 fc rgb \"#000000\"",
+  "set object 139 rect from 84.84549999999993, 12.83 to 84.91749999999993, 12.17 fc rgb \"#000000\"",
+  "set object 140 rect from 85.13799999999992, 12.83 to 85.37849999999993, 12.17 fc rgb \"#000000\"",
+  "set object 141 rect from 86.05649999999993, 12.83 to 86.75549999999993, 12.17 fc rgb \"#000000\"",
+  "set object 142 rect from 87.27399999999992, 12.83 to 87.27549999999992, 12.17 fc rgb \"#000000\"",
+  "set object 143 rect from 87.36899999999991, 12.83 to 88.75199999999992, 12.17 fc rgb \"#000000\"",
+  "set object 144 rect from 88.82299999999992, 12.83 to 88.83949999999992, 12.17 fc rgb \"#000000\"",
+  "set object 145 rect from 89.21399999999991, 12.83 to 91.90999999999991, 12.17 fc rgb \"#000000\"",
+  "set object 146 rect from 91.96649999999993, 12.83 to 94.55599999999993, 12.17 fc rgb \"#000000\"",
+  "set object 147 rect from 94.6054999999999, 12.83 to 97.20749999999991, 12.17 fc rgb \"#000000\"",
+  "set object 148 rect from 97.26099999999992, 12.83 to 99.86649999999992, 12.17 fc rgb \"#000000\"",
+  "set object 149 rect from 99.92199999999991, 12.83 to 102.56049999999992, 12.17 fc rgb \"#000000\"",
+  "set object 150 rect from 102.61199999999991, 12.83 to 102.74149999999992, 12.17 fc rgb \"#000000\"",
+  "set object 151 rect from 102.99499999999992, 12.83 to 104.13299999999992, 12.17 fc rgb \"#000000\"",
+  "set object 152 rect from 104.4429999999999, 12.83 to 105.88099999999991, 12.17 fc rgb \"#000000\"",
+  "set object 153 rect from 105.93349999999991, 12.83 to 107.51699999999991, 12.17 fc rgb \"#000000\"",
+  "set object 154 rect from 108.09449999999991, 12.83 to 109.2659999999999, 12.17 fc rgb \"#000000\"",
+  "set object 155 rect from 109.41799999999989, 12.83 to 110.0909999999999, 12.17 fc rgb \"#000000\"",
+  "set object 156 rect from 110.4839999999999, 12.83 to 112.6029999999999, 12.17 fc rgb \"#000000\"",
+  "set object 157 rect from 112.6564999999999, 12.83 to 115.36399999999989, 12.17 fc rgb \"#000000\"",
+  "set object 158 rect from 115.4124999999999, 12.83 to 118.1434999999999, 12.17 fc rgb \"#000000\"",
+  "set object 159 rect from 118.19199999999991, 12.83 to 120.9194999999999, 12.17 fc rgb \"#000000\"",
+  "set object 160 rect from 121.0314999999999, 12.83 to 123.77499999999989, 12.17 fc rgb \"#000000\"",
+  "set object 161 rect from 123.8254999999999, 12.83 to 126.55149999999989, 12.17 fc rgb \"#000000\"",
+  "set object 162 rect from 126.59899999999989, 12.83 to 129.3344999999999, 12.17 fc rgb \"#000000\"",
+  "set object 163 rect from 129.48849999999987, 12.83 to 130.5424999999999, 12.17 fc rgb \"#000000\"",
+  "set object 164 rect from 131.1209999999999, 12.83 to 132.8659999999999, 12.17 fc rgb \"#000000\"",
+  "set object 165 rect from 132.92249999999987, 12.83 to 133.04349999999988, 12.17 fc rgb \"#000000\"",
+  "set object 166 rect from 133.4079999999999, 12.83 to 136.14449999999988, 12.17 fc rgb \"#000000\"",
+  "set object 167 rect from 136.19799999999987, 12.83 to 138.9289999999999, 12.17 fc rgb \"#000000\"",
+  "set object 168 rect from 138.98049999999986, 12.83 to 140.86699999999988, 12.17 fc rgb \"#000000\"",
+  "set object 169 rect from 140.8814999999999, 12.83 to 140.88349999999988, 12.17 fc rgb \"#000000\"",
+  "set object 170 rect from 140.89599999999987, 12.83 to 140.9319999999999, 12.17 fc rgb \"#000000\"",
+  "set object 171 rect from 140.9574999999999, 12.83 to 140.96249999999986, 12.17 fc rgb \"#000000\"",
+  "set object 172 rect from 140.9779999999999, 12.83 to 141.0599999999999, 12.17 fc rgb \"#000000\"",
+  "set object 173 rect from 141.0984999999999, 12.83 to 141.09999999999988, 12.17 fc rgb \"#000000\"",
+  "set object 174 rect from 2.4490000000000003, 13.83 to 2.4545, 13.17 fc rgb \"#3399FF\"",
+  "set object 175 rect from 3.7920000000000003, 13.83 to 3.8075, 13.17 fc rgb \"#3399FF\"",
+  "set object 176 rect from 6.276000000000001, 13.83 to 6.2805, 13.17 fc rgb \"#3399FF\"",
+  "set object 177 rect from 7.373, 13.83 to 7.3865, 13.17 fc rgb \"#3399FF\"",
+  "set object 178 rect from 9.299, 13.83 to 9.302499999999998, 13.17 fc rgb \"#3399FF\"",
+  "set object 179 rect from 10.405000000000001, 13.83 to 10.4235, 13.17 fc rgb \"#3399FF\"",
+  "set object 180 rect from 12.882, 13.83 to 12.8865, 13.17 fc rgb \"#3399FF\"",
+  "set object 181 rect from 13.897, 13.83 to 13.910499999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 182 rect from 55.80349999999998, 13.83 to 55.80399999999998, 13.17 fc rgb \"#3399FF\"",
+  "set object 183 rect from 56.19399999999998, 13.83 to 56.19849999999998, 13.17 fc rgb \"#3399FF\"",
+  "set object 184 rect from 62.16599999999996, 13.83 to 62.166499999999964, 13.17 fc rgb \"#3399FF\"",
+  "set object 185 rect from 62.54499999999995, 13.83 to 62.54849999999996, 13.17 fc rgb \"#3399FF\"",
+  "set object 186 rect from 65.56999999999996, 13.83 to 65.57049999999997, 13.17 fc rgb \"#3399FF\"",
+  "set object 187 rect from 65.61499999999995, 13.83 to 65.61649999999995, 13.17 fc rgb \"#3399FF\"",
+  "set object 188 rect from 68.71249999999995, 13.83 to 68.71399999999994, 13.17 fc rgb \"#3399FF\"",
+  "set object 189 rect from 68.76249999999995, 13.83 to 68.76599999999993, 13.17 fc rgb \"#3399FF\"",
+  "set object 190 rect from 72.22849999999994, 13.83 to 72.22899999999994, 13.17 fc rgb \"#3399FF\"",
+  "set object 191 rect from 72.27749999999995, 13.83 to 72.27999999999994, 13.17 fc rgb \"#3399FF\"",
+  "set object 192 rect from 75.42299999999994, 13.83 to 75.42349999999995, 13.17 fc rgb \"#3399FF\"",
+  "set object 193 rect from 75.46599999999995, 13.83 to 75.46749999999994, 13.17 fc rgb \"#3399FF\"",
+  "set object 194 rect from 78.17099999999994, 13.83 to 78.17149999999994, 13.17 fc rgb \"#3399FF\"",
+  "set object 195 rect from 78.23049999999994, 13.83 to 78.23599999999993, 13.17 fc rgb \"#3399FF\"",
+  "set object 196 rect from 80.91049999999994, 13.83 to 80.91099999999994, 13.17 fc rgb \"#3399FF\"",
+  "set object 197 rect from 80.94849999999994, 13.83 to 80.94999999999993, 13.17 fc rgb \"#3399FF\"",
+  "set object 198 rect from 83.58999999999995, 13.83 to 83.59049999999995, 13.17 fc rgb \"#3399FF\"",
+  "set object 199 rect from 83.63699999999994, 13.83 to 83.63949999999993, 13.17 fc rgb \"#3399FF\"",
+  "set object 200 rect from 88.75849999999993, 13.83 to 88.75899999999993, 13.17 fc rgb \"#3399FF\"",
+  "set object 201 rect from 88.81899999999993, 13.83 to 88.82249999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 202 rect from 91.91649999999991, 13.83 to 91.91699999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 203 rect from 91.96349999999993, 13.83 to 91.96599999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 204 rect from 94.56249999999991, 13.83 to 94.56299999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 205 rect from 94.60349999999991, 13.83 to 94.6049999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 206 rect from 97.21399999999991, 13.83 to 97.21449999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 207 rect from 97.25899999999993, 13.83 to 97.26049999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 208 rect from 99.87599999999992, 13.83 to 99.87649999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 209 rect from 99.91899999999993, 13.83 to 99.92149999999991, 13.17 fc rgb \"#3399FF\"",
+  "set object 210 rect from 102.56599999999992, 13.83 to 102.56649999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 211 rect from 102.6099999999999, 13.83 to 102.61149999999991, 13.17 fc rgb \"#3399FF\"",
+  "set object 212 rect from 105.88749999999992, 13.83 to 105.88799999999992, 13.17 fc rgb \"#3399FF\"",
+  "set object 213 rect from 105.93149999999991, 13.83 to 105.93299999999991, 13.17 fc rgb \"#3399FF\"",
+  "set object 214 rect from 109.27249999999991, 13.83 to 109.27299999999991, 13.17 fc rgb \"#3399FF\"",
+  "set object 215 rect from 109.38599999999991, 13.83 to 109.4024999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 216 rect from 112.6104999999999, 13.83 to 112.6109999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 217 rect from 112.6544999999999, 13.83 to 112.65599999999989, 13.17 fc rgb \"#3399FF\"",
+  "set object 218 rect from 115.37049999999991, 13.83 to 115.37099999999991, 13.17 fc rgb \"#3399FF\"",
+  "set object 219 rect from 115.4104999999999, 13.83 to 115.41199999999989, 13.17 fc rgb \"#3399FF\"",
+  "set object 220 rect from 118.14999999999989, 13.83 to 118.1504999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 221 rect from 118.18999999999991, 13.83 to 118.1914999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 222 rect from 120.9319999999999, 13.83 to 120.9324999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 223 rect from 121.0104999999999, 13.83 to 121.0259999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 224 rect from 123.78149999999991, 13.83 to 123.78199999999991, 13.17 fc rgb \"#3399FF\"",
+  "set object 225 rect from 123.8234999999999, 13.83 to 123.8249999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 226 rect from 126.5569999999999, 13.83 to 126.5574999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 227 rect from 126.5969999999999, 13.83 to 126.59849999999989, 13.17 fc rgb \"#3399FF\"",
+  "set object 228 rect from 129.4124999999999, 13.83 to 129.4249999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 229 rect from 129.4864999999999, 13.83 to 129.4879999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 230 rect from 132.87149999999988, 13.83 to 132.87199999999987, 13.17 fc rgb \"#3399FF\"",
+  "set object 231 rect from 132.9204999999999, 13.83 to 132.92199999999988, 13.17 fc rgb \"#3399FF\"",
+  "set object 232 rect from 136.15099999999987, 13.83 to 136.15149999999986, 13.17 fc rgb \"#3399FF\"",
+  "set object 233 rect from 136.19599999999988, 13.83 to 136.19749999999988, 13.17 fc rgb \"#3399FF\"",
+  "set object 234 rect from 138.93549999999988, 13.83 to 138.93599999999986, 13.17 fc rgb \"#3399FF\"",
+  "set object 235 rect from 138.97849999999988, 13.83 to 138.97999999999988, 13.17 fc rgb \"#3399FF\"",
+  "set object 236 rect from 141.0599999999999, 13.83 to 141.0984999999999, 13.17 fc rgb \"#3399FF\"",
+  "set object 237 rect from 16.9945, 14.83 to 17.7705, 14.17 fc rgb \"#CC0000\"",
+  "set object 238 rect from 18.046, 14.83 to 18.1735, 14.17 fc rgb \"#CC0000\"",
+  "set object 239 rect from 19.0915, 14.83 to 19.152, 14.17 fc rgb \"#CC0000\"",
+  "set object 240 rect from 20.624499999999998, 14.83 to 21.063999999999997, 14.17 fc rgb \"#CC0000\"",
+  "set object 241 rect from 21.148500000000002, 14.83 to 21.175, 14.17 fc rgb \"#CC0000\"",
+  "set object 242 rect from 21.2875, 14.83 to 21.363, 14.17 fc rgb \"#CC0000\"",
+  "set object 243 rect from 21.505, 14.83 to 21.525499999999997, 14.17 fc rgb \"#CC0000\"",
+  "set object 244 rect from 21.604000000000003, 14.83 to 21.619500000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 245 rect from 21.747, 14.83 to 21.8475, 14.17 fc rgb \"#CC0000\"",
+  "set object 246 rect from 22.400499999999997, 14.83 to 22.416999999999998, 14.17 fc rgb \"#CC0000\"",
+  "set object 247 rect from 22.4715, 14.83 to 22.486, 14.17 fc rgb \"#CC0000\"",
+  "set object 248 rect from 22.517500000000002, 14.83 to 22.528, 14.17 fc rgb \"#CC0000\"",
+  "set object 249 rect from 22.5655, 14.83 to 22.570999999999998, 14.17 fc rgb \"#CC0000\"",
+  "set object 250 rect from 23.1575, 14.83 to 23.189, 14.17 fc rgb \"#CC0000\"",
+  "set object 251 rect from 23.376, 14.83 to 23.3945, 14.17 fc rgb \"#CC0000\"",
+  "set object 252 rect from 23.518, 14.83 to 23.5775, 14.17 fc rgb \"#CC0000\"",
+  "set object 253 rect from 23.617, 14.83 to 23.8365, 14.17 fc rgb \"#CC0000\"",
+  "set object 254 rect from 23.912000000000003, 14.83 to 23.9205, 14.17 fc rgb \"#CC0000\"",
+  "set object 255 rect from 24.4405, 14.83 to 24.458, 14.17 fc rgb \"#CC0000\"",
+  "set object 256 rect from 24.5085, 14.83 to 24.544000000000004, 14.17 fc rgb \"#CC0000\"",
+  "set object 257 rect from 41.91250000000001, 14.83 to 42.05100000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 258 rect from 42.30000000000002, 14.83 to 42.31450000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 259 rect from 42.66150000000002, 14.83 to 42.70600000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 260 rect from 42.76550000000001, 14.83 to 42.795000000000016, 14.17 fc rgb \"#CC0000\"",
+  "set object 261 rect from 42.812500000000014, 14.83 to 42.83300000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 262 rect from 42.85950000000001, 14.83 to 42.88200000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 263 rect from 43.622000000000014, 14.83 to 43.632500000000014, 14.17 fc rgb \"#CC0000\"",
+  "set object 264 rect from 44.812500000000014, 14.83 to 44.82200000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 265 rect from 44.87550000000002, 14.83 to 44.917000000000016, 14.17 fc rgb \"#CC0000\"",
+  "set object 266 rect from 45.01150000000001, 14.83 to 45.02900000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 267 rect from 45.068500000000014, 14.83 to 45.08700000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 268 rect from 45.110500000000016, 14.83 to 45.13500000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 269 rect from 45.16350000000002, 14.83 to 45.17200000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 270 rect from 45.34000000000002, 14.83 to 45.361500000000014, 14.17 fc rgb \"#CC0000\"",
+  "set object 271 rect from 45.405000000000015, 14.83 to 45.41750000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 272 rect from 45.44250000000002, 14.83 to 45.44850000000002, 14.17 fc rgb \"#CC0000\"",
+  "set object 273 rect from 45.466000000000015, 14.83 to 45.470500000000015, 14.17 fc rgb \"#CC0000\"",
+  "set object 274 rect from 45.484000000000016, 14.83 to 45.489500000000014, 14.17 fc rgb \"#CC0000\"",
+  "set object 275 rect from 45.56900000000001, 14.83 to 45.626500000000014, 14.17 fc rgb \"#CC0000\"",
+  "set object 276 rect from 45.71200000000001, 14.83 to 45.76150000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 277 rect from 45.82000000000001, 14.83 to 45.84850000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 278 rect from 45.93000000000001, 14.83 to 45.97850000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 279 rect from 46.08650000000001, 14.83 to 46.13100000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 280 rect from 46.291500000000006, 14.83 to 46.37200000000001, 14.17 fc rgb \"#CC0000\"",
+  "set object 281 rect from 46.59550000000001, 14.83 to 46.621, 14.17 fc rgb \"#CC0000\"",
+  "set object 282 rect from 46.694500000000005, 14.83 to 46.74, 14.17 fc rgb \"#CC0000\"",
+  "set object 283 rect from 46.8975, 14.83 to 46.9925, 14.17 fc rgb \"#CC0000\"",
+  "set object 284 rect from 47.050000000000004, 14.83 to 47.057500000000005, 14.17 fc rgb \"#CC0000\"",
+  "set object 285 rect from 47.141, 14.83 to 47.3935, 14.17 fc rgb \"#CC0000\"",
+  "set object 286 rect from 47.472, 14.83 to 47.5235, 14.17 fc rgb \"#CC0000\"",
+  "set object 287 rect from 49.469, 14.83 to 49.4955, 14.17 fc rgb \"#CC0000\"",
+  "set object 288 rect from 49.732, 14.83 to 49.780499999999996, 14.17 fc rgb \"#CC0000\"",
+  "set object 289 rect from 49.814, 14.83 to 49.82449999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 290 rect from 49.851, 14.83 to 49.8685, 14.17 fc rgb \"#CC0000\"",
+  "set object 291 rect from 49.99849999999999, 14.83 to 50.007, 14.17 fc rgb \"#CC0000\"",
+  "set object 292 rect from 50.147499999999994, 14.83 to 50.20799999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 293 rect from 50.314499999999995, 14.83 to 50.32899999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 294 rect from 50.40249999999999, 14.83 to 50.43099999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 295 rect from 50.52949999999999, 14.83 to 50.53499999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 296 rect from 50.62949999999999, 14.83 to 51.02349999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 297 rect from 51.292999999999985, 14.83 to 51.30249999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 298 rect from 51.57499999999999, 14.83 to 51.78349999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 299 rect from 51.89349999999999, 14.83 to 51.91599999999998, 14.17 fc rgb \"#CC0000\"",
+  "set object 300 rect from 52.13749999999999, 14.83 to 52.15399999999998, 14.17 fc rgb \"#CC0000\"",
+  "set object 301 rect from 52.30249999999998, 14.83 to 52.31499999999998, 14.17 fc rgb \"#CC0000\"",
+  "set object 302 rect from 52.331499999999984, 14.83 to 52.338999999999984, 14.17 fc rgb \"#CC0000\"",
+  "set object 303 rect from 52.40949999999998, 14.83 to 52.448999999999984, 14.17 fc rgb \"#CC0000\"",
+  "set object 304 rect from 70.34449999999994, 14.83 to 70.35799999999995, 14.17 fc rgb \"#CC0000\"",
+  "set object 305 rect from 140.88349999999988, 14.83 to 140.89599999999987, 14.17 fc rgb \"#CC0000\"",
+  "set object 306 rect from 140.96249999999986, 14.83 to 140.9779999999999, 14.17 fc rgb \"#CC0000\"",
+  "set object 307 rect from 141.0404999999999, 14.83 to 141.04699999999988, 14.17 fc rgb \"#CC0000\"",
+  "set object 308 rect from 25.285, 15.83 to 25.4055, 15.17 fc rgb \"#CC0044\"",
+  "set object 309 rect from 25.428000000000004, 15.83 to 25.507500000000004, 15.17 fc rgb \"#CC0044\"",
+  "set object 310 rect from 25.526500000000002, 15.83 to 25.591500000000003, 15.17 fc rgb \"#CC0044\"",
+  "set object 311 rect from 54.55999999999998, 15.83 to 54.566499999999984, 15.17 fc rgb \"#CC0044\"",
+  "set object 312 rect from 54.64299999999998, 15.83 to 54.951999999999984, 15.17 fc rgb \"#CC0044\"",
+  "set object 313 rect from 55.48599999999998, 15.83 to 55.49149999999998, 15.17 fc rgb \"#CC0044\"",
+  "set object 314 rect from 55.53099999999998, 15.83 to 55.66249999999998, 15.17 fc rgb \"#CC0044\"",
+  "set object 315 rect from 56.25149999999998, 15.83 to 56.52499999999998, 15.17 fc rgb \"#CC0044\"",
+  "set object 316 rect from 56.55699999999998, 15.83 to 56.64049999999998, 15.17 fc rgb \"#CC0044\"",
+  "set object 317 rect from 56.64999999999998, 15.83 to 56.69449999999998, 15.17 fc rgb \"#CC0044\"",
+  "set object 318 rect from 56.746499999999976, 15.83 to 56.750999999999976, 15.17 fc rgb \"#CC0044\"",
+  "set object 319 rect from 56.76449999999998, 15.83 to 56.845999999999975, 15.17 fc rgb \"#CC0044\"",
+  "set object 320 rect from 56.85849999999998, 15.83 to 56.97649999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 321 rect from 57.03599999999997, 15.83 to 57.039499999999975, 15.17 fc rgb \"#CC0044\"",
+  "set object 322 rect from 57.076499999999974, 15.83 to 57.205999999999975, 15.17 fc rgb \"#CC0044\"",
+  "set object 323 rect from 57.27249999999997, 15.83 to 57.33299999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 324 rect from 57.565999999999974, 15.83 to 57.64849999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 325 rect from 57.878499999999974, 15.83 to 57.934999999999974, 15.17 fc rgb \"#CC0044\"",
+  "set object 326 rect from 57.97299999999997, 15.83 to 57.97749999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 327 rect from 57.99099999999997, 15.83 to 58.04499999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 328 rect from 58.055499999999974, 15.83 to 58.07699999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 329 rect from 58.09149999999997, 15.83 to 58.12149999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 330 rect from 58.14299999999997, 15.83 to 58.21549999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 331 rect from 58.23599999999997, 15.83 to 58.316999999999965, 15.17 fc rgb \"#CC0044\"",
+  "set object 332 rect from 58.409499999999966, 15.83 to 58.40999999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 333 rect from 58.431499999999964, 15.83 to 58.51699999999997, 15.17 fc rgb \"#CC0044\"",
+  "set object 334 rect from 58.53049999999997, 15.83 to 58.590999999999966, 15.17 fc rgb \"#CC0044\"",
+  "set object 335 rect from 58.60049999999997, 15.83 to 58.65749999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 336 rect from 58.92499999999996, 15.83 to 59.042999999999964, 15.17 fc rgb \"#CC0044\"",
+  "set object 337 rect from 59.641499999999965, 15.83 to 59.65599999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 338 rect from 59.669499999999964, 15.83 to 59.69699999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 339 rect from 59.89099999999996, 15.83 to 59.93649999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 340 rect from 60.04699999999996, 15.83 to 60.05149999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 341 rect from 60.060999999999964, 15.83 to 60.08349999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 342 rect from 60.17149999999996, 15.83 to 60.176999999999964, 15.17 fc rgb \"#CC0044\"",
+  "set object 343 rect from 60.19499999999996, 15.83 to 60.26949999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 344 rect from 60.27999999999996, 15.83 to 60.31149999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 345 rect from 60.34699999999996, 15.83 to 60.471499999999956, 15.17 fc rgb \"#CC0044\"",
+  "set object 346 rect from 60.48399999999996, 15.83 to 60.508499999999955, 15.17 fc rgb \"#CC0044\"",
+  "set object 347 rect from 60.51999999999996, 15.83 to 60.65699999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 348 rect from 60.91649999999996, 15.83 to 60.92099999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 349 rect from 60.98249999999996, 15.83 to 61.253999999999955, 15.17 fc rgb \"#CC0044\"",
+  "set object 350 rect from 61.31249999999996, 15.83 to 61.464999999999954, 15.17 fc rgb \"#CC0044\"",
+  "set object 351 rect from 62.62699999999996, 15.83 to 63.024999999999956, 15.17 fc rgb \"#CC0044\"",
+  "set object 352 rect from 63.14749999999995, 15.83 to 63.15199999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 353 rect from 63.228499999999954, 15.83 to 63.41299999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 354 rect from 64.40899999999996, 15.83 to 64.61749999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 355 rect from 67.34249999999994, 15.83 to 67.34999999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 356 rect from 67.36349999999995, 15.83 to 67.45699999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 357 rect from 67.46599999999995, 15.83 to 67.48749999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 358 rect from 67.53599999999994, 15.83 to 67.59199999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 359 rect from 69.10849999999995, 15.83 to 69.11299999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 360 rect from 69.12949999999995, 15.83 to 69.19199999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 361 rect from 69.22649999999994, 15.83 to 69.30799999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 362 rect from 69.31949999999995, 15.83 to 69.34699999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 363 rect from 69.35749999999994, 15.83 to 69.38399999999996, 15.17 fc rgb \"#CC0044\"",
+  "set object 364 rect from 69.40549999999995, 15.83 to 69.45099999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 365 rect from 69.46349999999994, 15.83 to 69.49599999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 366 rect from 70.40899999999993, 15.83 to 70.58649999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 367 rect from 74.40699999999995, 15.83 to 74.41449999999995, 15.17 fc rgb \"#CC0044\"",
+  "set object 368 rect from 74.43899999999994, 15.83 to 74.52049999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 369 rect from 74.54499999999993, 15.83 to 74.59549999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 370 rect from 74.60899999999995, 15.83 to 74.63849999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 371 rect from 75.04799999999994, 15.83 to 75.20099999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 372 rect from 84.09549999999993, 15.83 to 84.09999999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 373 rect from 84.15349999999994, 15.83 to 84.26099999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 374 rect from 84.27549999999994, 15.83 to 84.34199999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 375 rect from 84.35349999999993, 15.83 to 84.37299999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 376 rect from 84.40149999999993, 15.83 to 84.43999999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 377 rect from 84.46149999999993, 15.83 to 84.53049999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 378 rect from 84.60099999999994, 15.83 to 84.68049999999992, 15.17 fc rgb \"#CC0044\"",
+  "set object 379 rect from 84.69199999999992, 15.83 to 84.71649999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 380 rect from 84.72799999999992, 15.83 to 84.84549999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 381 rect from 84.91749999999993, 15.83 to 84.92199999999994, 15.17 fc rgb \"#CC0044\"",
+  "set object 382 rect from 84.93849999999993, 15.83 to 84.99799999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 383 rect from 85.01049999999992, 15.83 to 85.06199999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 384 rect from 85.07249999999993, 15.83 to 85.13799999999992, 15.17 fc rgb \"#CC0044\"",
+  "set object 385 rect from 85.37849999999993, 15.83 to 85.38399999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 386 rect from 85.43999999999994, 15.83 to 85.59949999999992, 15.17 fc rgb \"#CC0044\"",
+  "set object 387 rect from 85.61599999999993, 15.83 to 85.63749999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 388 rect from 85.65899999999993, 15.83 to 85.69649999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 389 rect from 85.70599999999993, 15.83 to 85.73249999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 390 rect from 85.76899999999992, 15.83 to 85.86549999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 391 rect from 85.87599999999992, 15.83 to 85.91149999999992, 15.17 fc rgb \"#CC0044\"",
+  "set object 392 rect from 85.92499999999993, 15.83 to 86.05649999999993, 15.17 fc rgb \"#CC0044\"",
+  "set object 393 rect from 86.75549999999993, 15.83 to 87.36899999999991, 15.17 fc rgb \"#CC0044\"",
+  "set object 394 rect from 88.83949999999992, 15.83 to 89.21399999999991, 15.17 fc rgb \"#CC0044\"",
+  "set object 395 rect from 102.74149999999992, 15.83 to 102.74599999999992, 15.17 fc rgb \"#CC0044\"",
+  "set object 396 rect from 102.80749999999992, 15.83 to 102.99499999999992, 15.17 fc rgb \"#CC0044\"",
+  "set object 397 rect from 104.13299999999992, 15.83 to 104.4429999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 398 rect from 107.51699999999991, 15.83 to 107.5244999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 399 rect from 107.57199999999992, 15.83 to 107.62449999999991, 15.17 fc rgb \"#CC0044\"",
+  "set object 400 rect from 107.6389999999999, 15.83 to 107.69849999999991, 15.17 fc rgb \"#CC0044\"",
+  "set object 401 rect from 107.70999999999992, 15.83 to 107.7294999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 402 rect from 107.7469999999999, 15.83 to 107.7834999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 403 rect from 107.79299999999992, 15.83 to 107.82049999999991, 15.17 fc rgb \"#CC0044\"",
+  "set object 404 rect from 107.8529999999999, 15.83 to 107.9294999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 405 rect from 107.94099999999992, 15.83 to 107.9654999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 406 rect from 107.97599999999991, 15.83 to 108.09449999999991, 15.17 fc rgb \"#CC0044\"",
+  "set object 407 rect from 110.0909999999999, 15.83 to 110.4839999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 408 rect from 130.5424999999999, 15.83 to 130.5489999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 409 rect from 130.5954999999999, 15.83 to 130.6469999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 410 rect from 130.6614999999999, 15.83 to 130.68999999999988, 15.17 fc rgb \"#CC0044\"",
+  "set object 411 rect from 130.6994999999999, 15.83 to 130.7219999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 412 rect from 130.7324999999999, 15.83 to 130.7519999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 413 rect from 130.76949999999988, 15.83 to 130.8059999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 414 rect from 130.8154999999999, 15.83 to 130.84299999999988, 15.17 fc rgb \"#CC0044\"",
+  "set object 415 rect from 130.87549999999987, 15.83 to 130.95199999999988, 15.17 fc rgb \"#CC0044\"",
+  "set object 416 rect from 130.9644999999999, 15.83 to 130.99099999999987, 15.17 fc rgb \"#CC0044\"",
+  "set object 417 rect from 131.00249999999988, 15.83 to 131.1209999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 418 rect from 133.04349999999988, 15.83 to 133.4079999999999, 15.17 fc rgb \"#CC0044\"",
+  "set object 419 rect from 54.97249999999998, 16.83 to 56.20849999999998, 16.17 fc rgb \"#CC4499\"",
+  "set object 420 rect from 56.238999999999976, 16.83 to 56.53849999999998, 16.17 fc rgb \"#CC4499\"",
+  "set object 421 rect from 56.71599999999998, 16.83 to 56.830999999999975, 16.17 fc rgb \"#CC4499\"",
+  "set object 422 rect from 56.84349999999998, 16.83 to 57.062999999999974, 16.17 fc rgb \"#CC4499\"",
+  "set object 423 rect from 57.228499999999976, 16.83 to 57.545499999999976, 16.17 fc rgb \"#CC4499\"",
+  "set object 424 rect from 57.957499999999975, 16.83 to 58.00149999999997, 16.17 fc rgb \"#CC4499\"",
+  "set object 425 rect from 58.09499999999997, 16.83 to 58.30249999999997, 16.17 fc rgb \"#CC4499\"",
+  "set object 426 rect from 58.603999999999964, 16.83 to 58.964499999999965, 16.17 fc rgb \"#CC4499\"",
+  "set object 427 rect from 59.773999999999965, 16.83 to 59.88149999999996, 16.17 fc rgb \"#CC4499\"",
+  "set object 428 rect from 60.106999999999964, 16.83 to 60.18549999999996, 16.17 fc rgb \"#CC4499\"",
+  "set object 429 rect from 60.56649999999996, 16.83 to 62.55849999999995, 16.17 fc rgb \"#CC4499\"",
+  "set object 430 rect from 63.43549999999995, 16.83 to 64.39649999999995, 16.17 fc rgb \"#CC4499\"",
+  "set object 431 rect from 67.45849999999994, 16.83 to 67.57949999999995, 16.17 fc rgb \"#CC4499\"",
+  "set object 432 rect from 69.52049999999994, 16.83 to 70.32799999999995, 16.17 fc rgb \"#CC4499\"",
+  "set object 433 rect from 74.66299999999993, 16.83 to 75.03649999999993, 16.17 fc rgb \"#CC4499\"",
+  "set object 434 rect from 84.86699999999993, 16.83 to 88.80849999999992, 16.17 fc rgb \"#CC4499\"",
+  "set object 435 rect from 103.02549999999991, 16.83 to 104.04749999999991, 16.17 fc rgb \"#CC4499\"",
+  "set object 436 rect from 108.1159999999999, 16.83 to 110.07649999999991, 16.17 fc rgb \"#CC4499\"",
+  "set object 437 rect from 131.1424999999999, 16.83 to 133.02899999999988, 16.17 fc rgb \"#CC4499\"",
+  "set object 438 rect from 141.13349999999986, 16.83 to 141.1669999999999, 16.17 fc rgb \"#CC4499\"",
+  "set object 439 rect from 22.2675, 18.83 to 22.3815, 18.17 fc rgb \"#00CC00\"",
+  "set object 440 rect from 22.665, 18.83 to 23.1135, 18.17 fc rgb \"#00CC00\"",
+  "set object 441 rect from 27.951000000000004, 18.83 to 27.972500000000004, 18.17 fc rgb \"#00CC00\"",
+  "set object 442 rect from 27.993000000000002, 18.83 to 28.013500000000004, 18.17 fc rgb \"#00CC00\"",
+  "set object 443 rect from 28.043000000000003, 18.83 to 28.063500000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 444 rect from 28.085000000000004, 18.83 to 28.087500000000002, 18.17 fc rgb \"#00CC00\"",
+  "set object 445 rect from 28.115000000000002, 18.83 to 28.139500000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 446 rect from 28.154000000000007, 18.83 to 28.260000000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 447 rect from 28.309500000000003, 18.83 to 28.374000000000006, 18.17 fc rgb \"#00CC00\"",
+  "set object 448 rect from 28.383500000000005, 18.83 to 28.385000000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 449 rect from 28.396500000000003, 18.83 to 28.445000000000007, 18.17 fc rgb \"#00CC00\"",
+  "set object 450 rect from 28.459500000000006, 18.83 to 28.463000000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 451 rect from 28.489500000000007, 18.83 to 28.499000000000006, 18.17 fc rgb \"#00CC00\"",
+  "set object 452 rect from 28.512500000000006, 18.83 to 28.516000000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 453 rect from 28.529500000000006, 18.83 to 28.533000000000005, 18.17 fc rgb \"#00CC00\"",
+  "set object 454 rect from 28.554500000000004, 18.83 to 28.557000000000006, 18.17 fc rgb \"#00CC00\"",
+  "set object 455 rect from 28.573500000000006, 18.83 to 28.579000000000008, 18.17 fc rgb \"#00CC00\"",
+  "set object 456 rect from 28.59950000000001, 18.83 to 28.602000000000007, 18.17 fc rgb \"#00CC00\"",
+  "set object 457 rect from 28.623500000000007, 18.83 to 28.625000000000007, 18.17 fc rgb \"#00CC00\"",
+  "set object 458 rect from 28.637500000000006, 18.83 to 28.647000000000006, 18.17 fc rgb \"#00CC00\"",
+  "set object 459 rect from 28.657500000000006, 18.83 to 28.669000000000008, 18.17 fc rgb \"#00CC00\"",
+  "set object 460 rect from 28.682500000000005, 18.83 to 28.686000000000007, 18.17 fc rgb \"#00CC00\"",
+  "set object 461 rect from 28.695500000000006, 18.83 to 28.701000000000008, 18.17 fc rgb \"#00CC00\"",
+  "set object 462 rect from 28.72450000000001, 18.83 to 28.811000000000007, 18.17 fc rgb \"#00CC00\"",
+  "set object 463 rect from 28.83250000000001, 18.83 to 28.907500000000006, 18.17 fc rgb \"#00CC00\"",
+  "set object 464 rect from 28.97100000000001, 18.83 to 28.97450000000001, 18.17 fc rgb \"#00CC00\"",
+  "set object 465 rect from 28.99600000000001, 18.83 to 28.99850000000001, 18.17 fc rgb \"#00CC00\"",
+  "set object 466 rect from 29.01200000000001, 18.83 to 29.01350000000001, 18.17 fc rgb \"#00CC00\"",
+  "set object 467 rect from 29.02600000000001, 18.83 to 29.056500000000007, 18.17 fc rgb \"#00CC00\"",
+  "set object 468 rect from 29.06900000000001, 18.83 to 29.159500000000012, 18.17 fc rgb \"#00CC00\"",
+  "set object 469 rect from 29.17100000000001, 18.83 to 29.18450000000001, 18.17 fc rgb \"#00CC00\"",
+  "set object 470 rect from 29.19400000000001, 18.83 to 41.84850000000001, 18.17 fc rgb \"#00CC00\"",
+  "set object 471 rect from 41.87900000000001, 18.83 to 41.88650000000001, 18.17 fc rgb \"#00CC00\"",
+  "set object 472 rect from 27.972500000000004, 19.83 to 28.053000000000004, 19.17 fc rgb \"#44CC00\"",
+  "set object 473 rect from 28.063500000000005, 19.83 to 28.169000000000004, 19.17 fc rgb \"#44CC00\"",
+  "set object 474 rect from 28.260000000000005, 19.83 to 28.489500000000007, 19.17 fc rgb \"#44CC00\"",
+  "set object 475 rect from 28.499000000000006, 19.83 to 28.761500000000005, 19.17 fc rgb \"#44CC00\"",
+  "set object 476 rect from 28.78900000000001, 19.83 to 28.847500000000007, 19.17 fc rgb \"#44CC00\"",
+  "set object 477 rect from 28.907500000000006, 19.83 to 29.047000000000008, 19.17 fc rgb \"#44CC00\"",
+  "set object 478 rect from 29.056500000000007, 19.83 to 29.111000000000008, 19.17 fc rgb \"#44CC00\"",
+  "set object 479 rect from 29.12350000000001, 19.83 to 29.21900000000001, 19.17 fc rgb \"#44CC00\"",
+  "set object 480 rect from 41.82650000000001, 19.83 to 41.83500000000001, 19.17 fc rgb \"#44CC00\"",
+  "set object 481 rect from 41.84850000000001, 19.83 to 41.87900000000001, 19.17 fc rgb \"#44CC00\"",
+  "set object 482 rect from 16.737, 20.83 to 16.9595, 20.17 fc rgb \"#00CC44\"",
+  "set object 483 rect from 17.8715, 20.83 to 18.017000000000003, 20.17 fc rgb \"#00CC44\"",
+  "set object 484 rect from 18.992, 20.83 to 19.0685, 20.17 fc rgb \"#00CC44\"",
+  "set object 485 rect from 20.52, 20.83 to 20.5975, 20.17 fc rgb \"#00CC44\"",
+  "set object 486 rect from 21.109, 20.83 to 21.1335, 20.17 fc rgb \"#00CC44\"",
+  "set object 487 rect from 21.212, 20.83 to 21.2695, 20.17 fc rgb \"#00CC44\"",
+  "set object 488 rect from 21.4595, 20.83 to 21.49, 20.17 fc rgb \"#00CC44\"",
+  "set object 489 rect from 21.566499999999998, 20.83 to 21.588, 20.17 fc rgb \"#00CC44\"",
+  "set object 490 rect from 21.6535, 20.83 to 21.727, 20.17 fc rgb \"#00CC44\"",
+  "set object 491 rect from 22.445, 20.83 to 22.4625, 20.17 fc rgb \"#00CC44\"",
+  "set object 492 rect from 22.502000000000002, 20.83 to 22.5165, 20.17 fc rgb \"#00CC44\"",
+  "set object 493 rect from 22.553, 20.83 to 22.5645, 20.17 fc rgb \"#00CC44\"",
+  "set object 494 rect from 23.233, 20.83 to 23.336000000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 495 rect from 23.4255, 20.83 to 23.506, 20.17 fc rgb \"#00CC44\"",
+  "set object 496 rect from 23.5895, 20.83 to 23.613, 20.17 fc rgb \"#00CC44\"",
+  "set object 497 rect from 23.870500000000003, 20.83 to 23.907, 20.17 fc rgb \"#00CC44\"",
+  "set object 498 rect from 24.393, 20.83 to 24.430500000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 499 rect from 24.470000000000002, 20.83 to 24.504500000000004, 20.17 fc rgb \"#00CC44\"",
+  "set object 500 rect from 25.267500000000002, 20.83 to 25.283, 20.17 fc rgb \"#00CC44\"",
+  "set object 501 rect from 25.4195, 20.83 to 25.427, 20.17 fc rgb \"#00CC44\"",
+  "set object 502 rect from 25.519500000000004, 20.83 to 25.526000000000003, 20.17 fc rgb \"#00CC44\"",
+  "set object 503 rect from 42.28050000000001, 20.83 to 42.298000000000016, 20.17 fc rgb \"#00CC44\"",
+  "set object 504 rect from 42.62700000000002, 20.83 to 42.656500000000015, 20.17 fc rgb \"#00CC44\"",
+  "set object 505 rect from 42.747000000000014, 20.83 to 42.763500000000015, 20.17 fc rgb \"#00CC44\"",
+  "set object 506 rect from 42.80300000000001, 20.83 to 42.81050000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 507 rect from 42.844000000000015, 20.83 to 42.858500000000014, 20.17 fc rgb \"#00CC44\"",
+  "set object 508 rect from 43.60550000000001, 20.83 to 43.62000000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 509 rect from 44.796000000000014, 20.83 to 44.81150000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 510 rect from 44.84500000000001, 20.83 to 44.87150000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 511 rect from 44.996000000000016, 20.83 to 45.00850000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 512 rect from 45.04700000000001, 20.83 to 45.06450000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 513 rect from 45.09600000000001, 20.83 to 45.107500000000016, 20.17 fc rgb \"#00CC44\"",
+  "set object 514 rect from 45.14400000000002, 20.83 to 45.16150000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 515 rect from 45.32050000000002, 20.83 to 45.33700000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 516 rect from 45.38750000000002, 20.83 to 45.402000000000015, 20.17 fc rgb \"#00CC44\"",
+  "set object 517 rect from 45.43250000000002, 20.83 to 45.442000000000014, 20.17 fc rgb \"#00CC44\"",
+  "set object 518 rect from 45.46050000000002, 20.83 to 45.46500000000002, 20.17 fc rgb \"#00CC44\"",
+  "set object 519 rect from 45.47750000000001, 20.83 to 45.48300000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 520 rect from 45.49750000000001, 20.83 to 45.55900000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 521 rect from 45.66050000000001, 20.83 to 45.70300000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 522 rect from 45.79350000000001, 20.83 to 45.81700000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 523 rect from 45.86950000000001, 20.83 to 45.92300000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 524 rect from 45.99450000000001, 20.83 to 46.060500000000005, 20.17 fc rgb \"#00CC44\"",
+  "set object 525 rect from 46.18500000000001, 20.83 to 46.28150000000001, 20.17 fc rgb \"#00CC44\"",
+  "set object 526 rect from 46.550000000000004, 20.83 to 46.5915, 20.17 fc rgb \"#00CC44\"",
+  "set object 527 rect from 46.65500000000001, 20.83 to 46.691500000000005, 20.17 fc rgb \"#00CC44\"",
+  "set object 528 rect from 46.861000000000004, 20.83 to 46.8935, 20.17 fc rgb \"#00CC44\"",
+  "set object 529 rect from 47.039500000000004, 20.83 to 47.049, 20.17 fc rgb \"#00CC44\"",
+  "set object 530 rect from 47.0765, 20.83 to 47.135000000000005, 20.17 fc rgb \"#00CC44\"",
+  "set object 531 rect from 47.4125, 20.83 to 47.465, 20.17 fc rgb \"#00CC44\"",
+  "set object 532 rect from 49.454499999999996, 20.83 to 49.467, 20.17 fc rgb \"#00CC44\"",
+  "set object 533 rect from 49.6855, 20.83 to 49.726, 20.17 fc rgb \"#00CC44\"",
+  "set object 534 rect from 49.799499999999995, 20.83 to 49.812999999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 535 rect from 49.841499999999996, 20.83 to 49.849999999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 536 rect from 49.894499999999994, 20.83 to 49.9695, 20.17 fc rgb \"#00CC44\"",
+  "set object 537 rect from 50.083999999999996, 20.83 to 50.14149999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 538 rect from 50.29299999999999, 20.83 to 50.31249999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 539 rect from 50.36699999999999, 20.83 to 50.39849999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 540 rect from 50.520999999999994, 20.83 to 50.528499999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 541 rect from 50.54899999999999, 20.83 to 50.62049999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 542 rect from 51.27549999999999, 20.83 to 51.29099999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 543 rect from 51.52249999999999, 20.83 to 51.56899999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 544 rect from 51.87299999999998, 20.83 to 51.89049999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 545 rect from 52.115999999999985, 20.83 to 52.13449999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 546 rect from 52.286999999999985, 20.83 to 52.300499999999985, 20.17 fc rgb \"#00CC44\"",
+  "set object 547 rect from 52.326999999999984, 20.83 to 52.33049999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 548 rect from 52.362999999999985, 20.83 to 52.404499999999985, 20.17 fc rgb \"#00CC44\"",
+  "set object 549 rect from 54.566499999999984, 20.83 to 54.64299999999998, 20.17 fc rgb \"#00CC44\"",
+  "set object 550 rect from 55.49149999999998, 20.83 to 55.53099999999998, 20.17 fc rgb \"#00CC44\"",
+  "set object 551 rect from 56.64049999999998, 20.83 to 56.64999999999998, 20.17 fc rgb \"#00CC44\"",
+  "set object 552 rect from 56.750999999999976, 20.83 to 56.76449999999998, 20.17 fc rgb \"#00CC44\"",
+  "set object 553 rect from 57.039499999999975, 20.83 to 57.076499999999974, 20.17 fc rgb \"#00CC44\"",
+  "set object 554 rect from 57.885999999999974, 20.83 to 57.893499999999975, 20.17 fc rgb \"#00CC44\"",
+  "set object 555 rect from 57.97749999999997, 20.83 to 57.99099999999997, 20.17 fc rgb \"#00CC44\"",
+  "set object 556 rect from 58.04499999999997, 20.83 to 58.055499999999974, 20.17 fc rgb \"#00CC44\"",
+  "set object 557 rect from 58.14549999999997, 20.83 to 58.15399999999997, 20.17 fc rgb \"#00CC44\"",
+  "set object 558 rect from 58.17549999999997, 20.83 to 58.18399999999997, 20.17 fc rgb \"#00CC44\"",
+  "set object 559 rect from 58.40999999999997, 20.83 to 58.431499999999964, 20.17 fc rgb \"#00CC44\"",
+  "set object 560 rect from 58.51699999999997, 20.83 to 58.53049999999997, 20.17 fc rgb \"#00CC44\"",
+  "set object 561 rect from 58.590999999999966, 20.83 to 58.60049999999997, 20.17 fc rgb \"#00CC44\"",
+  "set object 562 rect from 59.65599999999996, 20.83 to 59.669499999999964, 20.17 fc rgb \"#00CC44\"",
+  "set object 563 rect from 60.05149999999996, 20.83 to 60.060999999999964, 20.17 fc rgb \"#00CC44\"",
+  "set object 564 rect from 60.176999999999964, 20.83 to 60.19499999999996, 20.17 fc rgb \"#00CC44\"",
+  "set object 565 rect from 60.26949999999996, 20.83 to 60.27999999999996, 20.17 fc rgb \"#00CC44\"",
+  "set object 566 rect from 60.31149999999996, 20.83 to 60.34699999999996, 20.17 fc rgb \"#00CC44\"",
+  "set object 567 rect from 60.471499999999956, 20.83 to 60.48399999999996, 20.17 fc rgb \"#00CC44\"",
+  "set object 568 rect from 60.508499999999955, 20.83 to 60.51999999999996, 20.17 fc rgb \"#00CC44\"",
+  "set object 569 rect from 60.92099999999996, 20.83 to 60.98249999999996, 20.17 fc rgb \"#00CC44\"",
+  "set object 570 rect from 63.15199999999995, 20.83 to 63.228499999999954, 20.17 fc rgb \"#00CC44\"",
+  "set object 571 rect from 67.34999999999994, 20.83 to 67.36349999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 572 rect from 67.40699999999995, 20.83 to 67.41249999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 573 rect from 67.45699999999994, 20.83 to 67.46599999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 574 rect from 69.11299999999994, 20.83 to 69.12949999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 575 rect from 69.19199999999995, 20.83 to 69.22649999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 576 rect from 69.30799999999994, 20.83 to 69.31949999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 577 rect from 69.34699999999995, 20.83 to 69.35749999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 578 rect from 69.38399999999996, 20.83 to 69.40549999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 579 rect from 69.45099999999994, 20.83 to 69.46349999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 580 rect from 70.31749999999994, 20.83 to 70.33949999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 581 rect from 74.41449999999995, 20.83 to 74.43899999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 582 rect from 74.52049999999994, 20.83 to 74.54499999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 583 rect from 74.59549999999994, 20.83 to 74.60899999999995, 20.17 fc rgb \"#00CC44\"",
+  "set object 584 rect from 84.09999999999994, 20.83 to 84.15349999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 585 rect from 84.26099999999994, 20.83 to 84.27549999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 586 rect from 84.31099999999992, 20.83 to 84.31949999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 587 rect from 84.34199999999993, 20.83 to 84.35349999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 588 rect from 84.37299999999993, 20.83 to 84.40149999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 589 rect from 84.43999999999994, 20.83 to 84.46149999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 590 rect from 84.53049999999993, 20.83 to 84.60099999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 591 rect from 84.68049999999992, 20.83 to 84.69199999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 592 rect from 84.71649999999993, 20.83 to 84.72799999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 593 rect from 84.92199999999994, 20.83 to 84.93849999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 594 rect from 84.99799999999993, 20.83 to 85.01049999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 595 rect from 85.03599999999992, 20.83 to 85.04449999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 596 rect from 85.06199999999993, 20.83 to 85.07249999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 597 rect from 85.09499999999994, 20.83 to 85.10249999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 598 rect from 85.38399999999993, 20.83 to 85.43999999999994, 20.17 fc rgb \"#00CC44\"",
+  "set object 599 rect from 85.59949999999992, 20.83 to 85.61599999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 600 rect from 85.63749999999993, 20.83 to 85.65899999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 601 rect from 85.69649999999993, 20.83 to 85.70599999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 602 rect from 85.73249999999993, 20.83 to 85.76899999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 603 rect from 85.86549999999993, 20.83 to 85.87599999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 604 rect from 85.91149999999992, 20.83 to 85.92499999999993, 20.17 fc rgb \"#00CC44\"",
+  "set object 605 rect from 102.74599999999992, 20.83 to 102.80749999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 606 rect from 107.5244999999999, 20.83 to 107.57199999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 607 rect from 107.62449999999991, 20.83 to 107.6389999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 608 rect from 107.6674999999999, 20.83 to 107.6759999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 609 rect from 107.69849999999991, 20.83 to 107.70999999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 610 rect from 107.7294999999999, 20.83 to 107.7469999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 611 rect from 107.7834999999999, 20.83 to 107.79299999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 612 rect from 107.82049999999991, 20.83 to 107.8529999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 613 rect from 107.9294999999999, 20.83 to 107.94099999999992, 20.17 fc rgb \"#00CC44\"",
+  "set object 614 rect from 107.9654999999999, 20.83 to 107.97599999999991, 20.17 fc rgb \"#00CC44\"",
+  "set object 615 rect from 130.5489999999999, 20.83 to 130.5954999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 616 rect from 130.6469999999999, 20.83 to 130.6614999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 617 rect from 130.68999999999988, 20.83 to 130.6994999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 618 rect from 130.7219999999999, 20.83 to 130.7324999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 619 rect from 130.7519999999999, 20.83 to 130.76949999999988, 20.17 fc rgb \"#00CC44\"",
+  "set object 620 rect from 130.8059999999999, 20.83 to 130.8154999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 621 rect from 130.84299999999988, 20.83 to 130.87549999999987, 20.17 fc rgb \"#00CC44\"",
+  "set object 622 rect from 130.95199999999988, 20.83 to 130.9644999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 623 rect from 130.99099999999987, 20.83 to 131.00249999999988, 20.17 fc rgb \"#00CC44\"",
+  "set object 624 rect from 140.86699999999988, 20.83 to 140.8814999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 625 rect from 140.9319999999999, 20.83 to 140.9574999999999, 20.17 fc rgb \"#00CC44\"",
+  "set object 626 rect from 141.0299999999999, 20.83 to 141.03849999999989, 20.17 fc rgb \"#00CC44\"",
+  "set object 627 rect from 55.79999999999998, 21.83 to 56.198999999999984, 21.17 fc rgb \"#0044CC\"",
+  "set object 628 rect from 62.16149999999996, 21.83 to 62.548999999999964, 21.17 fc rgb \"#0044CC\"",
+  "set object 629 rect from 65.56449999999995, 21.83 to 65.61699999999995, 21.17 fc rgb \"#0044CC\"",
+  "set object 630 rect from 68.70599999999996, 21.83 to 68.76649999999995, 21.17 fc rgb \"#0044CC\"",
+  "set object 631 rect from 72.22199999999995, 21.83 to 72.28049999999995, 21.17 fc rgb \"#0044CC\"",
+  "set object 632 rect from 75.41849999999994, 21.83 to 75.46799999999995, 21.17 fc rgb \"#0044CC\"",
+  "set object 633 rect from 78.16449999999993, 21.83 to 78.23649999999994, 21.17 fc rgb \"#0044CC\"",
+  "set object 634 rect from 80.90399999999994, 21.83 to 80.95049999999993, 21.17 fc rgb \"#0044CC\"",
+  "set object 635 rect from 83.58349999999993, 21.83 to 83.63999999999993, 21.17 fc rgb \"#0044CC\"",
+  "set object 636 rect from 88.75199999999992, 21.83 to 88.82299999999992, 21.17 fc rgb \"#0044CC\"",
+  "set object 637 rect from 91.90999999999991, 21.83 to 91.96649999999993, 21.17 fc rgb \"#0044CC\"",
+  "set object 638 rect from 94.55599999999993, 21.83 to 94.6054999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 639 rect from 97.20749999999991, 21.83 to 97.26099999999992, 21.17 fc rgb \"#0044CC\"",
+  "set object 640 rect from 99.86649999999992, 21.83 to 99.92199999999991, 21.17 fc rgb \"#0044CC\"",
+  "set object 641 rect from 102.56049999999992, 21.83 to 102.61199999999991, 21.17 fc rgb \"#0044CC\"",
+  "set object 642 rect from 105.88099999999991, 21.83 to 105.93349999999991, 21.17 fc rgb \"#0044CC\"",
+  "set object 643 rect from 109.2659999999999, 21.83 to 109.38599999999991, 21.17 fc rgb \"#0044CC\"",
+  "set object 644 rect from 109.4024999999999, 21.83 to 109.41799999999989, 21.17 fc rgb \"#0044CC\"",
+  "set object 645 rect from 112.6029999999999, 21.83 to 112.6564999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 646 rect from 115.36399999999989, 21.83 to 115.4124999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 647 rect from 118.1434999999999, 21.83 to 118.19199999999991, 21.17 fc rgb \"#0044CC\"",
+  "set object 648 rect from 120.9194999999999, 21.83 to 121.0104999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 649 rect from 121.0259999999999, 21.83 to 121.0314999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 650 rect from 123.77499999999989, 21.83 to 123.8254999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 651 rect from 126.55149999999989, 21.83 to 126.59899999999989, 21.17 fc rgb \"#0044CC\"",
+  "set object 652 rect from 129.3344999999999, 21.83 to 129.4124999999999, 21.17 fc rgb \"#0044CC\"",
+  "set object 653 rect from 129.4249999999999, 21.83 to 129.48849999999987, 21.17 fc rgb \"#0044CC\"",
+  "set object 654 rect from 132.8659999999999, 21.83 to 132.92249999999987, 21.17 fc rgb \"#0044CC\"",
+  "set object 655 rect from 136.14449999999988, 21.83 to 136.19799999999987, 21.17 fc rgb \"#0044CC\"",
+  "set object 656 rect from 138.9289999999999, 21.83 to 138.98049999999986, 21.17 fc rgb \"#0044CC\"",
+  "set object 657 rect from 2.4204999999999997, 22.83 to 3.7920000000000003, 22.17 fc rgb \"#4444CC\"",
+  "set object 658 rect from 3.8075, 22.83 to 3.8129999999999997, 22.17 fc rgb \"#4444CC\"",
+  "set object 659 rect from 6.2695, 22.83 to 7.373, 22.17 fc rgb \"#4444CC\"",
+  "set object 660 rect from 7.3865, 22.83 to 7.3919999999999995, 22.17 fc rgb \"#4444CC\"",
+  "set object 661 rect from 9.2915, 22.83 to 10.405000000000001, 22.17 fc rgb \"#4444CC\"",
+  "set object 662 rect from 10.4235, 22.83 to 10.43, 22.17 fc rgb \"#4444CC\"",
+  "set object 663 rect from 12.8765, 22.83 to 13.897, 22.17 fc rgb \"#4444CC\"",
+  "set object 664 rect from 13.910499999999999, 22.83 to 13.915999999999999, 22.17 fc rgb \"#4444CC\"",
+  "set object 665 rect from 18.803, 10.2 to 19.803, 9.8 fc rgb \"#000000\"",
+  "set object 666 rect from 19.8815, 10.2 to 20.8815, 9.8 fc rgb \"#000000\"",
+  "set object 667 rect from 20.910999999999998, 10.2 to 21.910999999999998, 9.8 fc rgb \"#000000\"",
+  "set object 668 rect from 28.357000000000006, 10.2 to 30.17350000000001, 9.8 fc rgb \"#000000\"",
+  "set object 669 rect from 30.235000000000014, 10.2 to 31.235000000000014, 9.8 fc rgb \"#000000\"",
+  "set object 670 rect from 31.28350000000001, 10.2 to 32.28350000000001, 9.8 fc rgb \"#000000\"",
+  "set object 671 rect from 32.353000000000016, 10.2 to 33.353000000000016, 9.8 fc rgb \"#000000\"",
+  "set object 672 rect from 33.42150000000001, 10.2 to 34.42150000000001, 9.8 fc rgb \"#000000\"",
+  "set object 673 rect from 34.47700000000001, 10.2 to 35.47700000000001, 9.8 fc rgb \"#000000\"",
+  "set object 674 rect from 35.531500000000015, 10.2 to 36.531500000000015, 9.8 fc rgb \"#000000\"",
+  "set object 675 rect from 36.59600000000001, 10.2 to 37.59600000000001, 9.8 fc rgb \"#000000\"",
+  "set object 676 rect from 37.65150000000001, 10.2 to 38.65150000000001, 9.8 fc rgb \"#000000\"",
+  "set object 677 rect from 38.70800000000001, 10.2 to 39.70800000000001, 9.8 fc rgb \"#000000\"",
+  "set object 678 rect from 39.76650000000001, 10.2 to 40.76650000000001, 9.8 fc rgb \"#000000\"",
+  "set object 679 rect from 40.82900000000001, 10.2 to 42.82200000000002, 9.8 fc rgb \"#000000\"",
+  "set object 680 rect from 43.79150000000001, 10.2 to 44.79150000000001, 9.8 fc rgb \"#000000\"",
+  "set object 681 rect from 45.50300000000001, 10.2 to 48.4035, 9.8 fc rgb \"#000000\"",
+  "set object 682 rect from 48.49, 10.2 to 53.228999999999985, 9.8 fc rgb \"#000000\"",
+  "set object 683 rect from 54.33049999999998, 10.2 to 55.33049999999998, 9.8 fc rgb \"#000000\"",
+  "set object 684 rect from 55.37549999999998, 10.2 to 56.37549999999998, 9.8 fc rgb \"#000000\"",
+  "set object 685 rect from 58.19399999999997, 10.2 to 59.19399999999997, 9.8 fc rgb \"#000000\"",
+  "set object 686 rect from 62.20049999999995, 10.2 to 63.20049999999995, 9.8 fc rgb \"#000000\"",
+  "set object 687 rect from 65.31249999999996, 10.2 to 66.31249999999996, 9.8 fc rgb \"#000000\"",
+  "set object 688 rect from 66.37099999999995, 10.2 to 67.37099999999995, 9.8 fc rgb \"#000000\"",
+  "set object 689 rect from 68.37699999999995, 10.2 to 70.37999999999994, 9.8 fc rgb \"#000000\"",
+  "set object 690 rect from 72.48699999999994, 10.2 to 73.48699999999994, 9.8 fc rgb \"#000000\"",
+  "set object 691 rect from 73.55549999999994, 10.2 to 74.55549999999994, 9.8 fc rgb \"#000000\"",
+  "set object 692 rect from 76.64899999999994, 10.2 to 77.64899999999994, 9.8 fc rgb \"#000000\"",
+  "set object 693 rect from 79.81349999999993, 10.2 to 80.81349999999993, 9.8 fc rgb \"#000000\"",
+  "set object 694 rect from 81.90449999999993, 10.2 to 82.90449999999993, 9.8 fc rgb \"#000000\"",
+  "set object 695 rect from 83.96999999999994, 10.2 to 85.90049999999992, 9.8 fc rgb \"#000000\"",
+  "set object 696 rect from 90.04699999999991, 10.2 to 91.04699999999991, 9.8 fc rgb \"#000000\"",
+  "set object 697 rect from 91.11749999999992, 10.2 to 92.11749999999992, 9.8 fc rgb \"#000000\"",
+  "set object 698 rect from 94.24599999999992, 10.2 to 95.24599999999992, 9.8 fc rgb \"#000000\"",
+  "set object 699 rect from 96.36399999999992, 10.2 to 97.36399999999992, 9.8 fc rgb \"#000000\"",
+  "set object 700 rect from 108.83549999999991, 10.2 to 109.83549999999991, 9.8 fc rgb \"#000000\"",
+  "set object 701 rect from 109.87949999999991, 10.2 to 110.87949999999991, 9.8 fc rgb \"#000000\"",
+  "set object 702 rect from 112.9859999999999, 10.2 to 113.9859999999999, 9.8 fc rgb \"#000000\"",
+  "set object 703 rect from 114.0484999999999, 10.2 to 115.0484999999999, 9.8 fc rgb \"#000000\"",
+  "set object 704 rect from 119.3669999999999, 10.2 to 120.3669999999999, 9.8 fc rgb \"#000000\"",
+  "set object 705 rect from 120.4439999999999, 10.2 to 121.4439999999999, 9.8 fc rgb \"#000000\"",
+  "set object 706 rect from 121.46899999999991, 10.2 to 122.46899999999991, 9.8 fc rgb \"#000000\"",
+  "set object 707 rect from 126.7234999999999, 10.2 to 127.7234999999999, 9.8 fc rgb \"#000000\"",
+  "set object 708 rect from 127.77299999999991, 10.2 to 128.7729999999999, 9.8 fc rgb \"#000000\"",
+  "set object 709 rect from 132.9344999999999, 10.2 to 133.9344999999999, 9.8 fc rgb \"#000000\"",
+  "set object 710 rect from 135.0459999999999, 10.2 to 136.0459999999999, 9.8 fc rgb \"#000000\"",
+  "set object 711 rect from 137.1609999999999, 10.2 to 138.1609999999999, 9.8 fc rgb \"#000000\"",
+  "set object 712 rect from 139.24899999999988, 10.2 to 140.24899999999988, 9.8 fc rgb \"#000000\"",
+  "set object 713 rect from 61.17299999999995, 10.2 to 62.17299999999995, 9.8 fc rgb \"#DD0000\"",
+  "set object 714 rect from 63.23999999999996, 10.2 to 64.23999999999995, 9.8 fc rgb \"#DD0000\"",
+  "set object 715 rect from 88.98349999999992, 10.2 to 89.98349999999992, 9.8 fc rgb \"#DD0000\"",
+  "set object 716 rect from 106.85949999999991, 10.2 to 107.85949999999991, 9.8 fc rgb \"#DD0000\"",
+  "set object 717 rect from 18.803, 9.399999999999999 to 19.803, 9.2 fc rgb \"#DD0000\"",
+  "set object 718 rect from 19.8815, 9.399999999999999 to 20.8815, 9.2 fc rgb \"#DD0000\"",
+  "set object 719 rect from 20.910999999999998, 9.399999999999999 to 21.910999999999998, 9.2 fc rgb \"#DD0000\"",
+  "set object 720 rect from 41.82200000000002, 9.399999999999999 to 42.82200000000002, 9.2 fc rgb \"#DD0000\"",
+  "set object 721 rect from 43.79150000000001, 9.399999999999999 to 44.79150000000001, 9.2 fc rgb \"#DD0000\"",
+  "set object 722 rect from 45.50300000000001, 9.399999999999999 to 48.4035, 9.2 fc rgb \"#DD0000\"",
+  "set object 723 rect from 48.49, 9.399999999999999 to 53.228999999999985, 9.2 fc rgb \"#DD0000\"",
+  "set object 724 rect from 54.33049999999998, 9.399999999999999 to 55.33049999999998, 9.2 fc rgb \"#DD0000\"",
+  "set object 725 rect from 57.33799999999997, 9.399999999999999 to 59.19399999999997, 9.2 fc rgb \"#DD0000\"",
+  "set object 726 rect from 62.20049999999995, 9.399999999999999 to 63.20049999999995, 9.2 fc rgb \"#DD0000\"",
+  "set object 727 rect from 64.28099999999995, 9.399999999999999 to 65.28099999999995, 9.2 fc rgb \"#DD0000\"",
+  "set object 728 rect from 67.35049999999995, 9.399999999999999 to 68.35049999999995, 9.2 fc rgb \"#DD0000\"",
+  "set object 729 rect from 71.44949999999994, 9.399999999999999 to 72.44949999999994, 9.2 fc rgb \"#DD0000\"",
+  "set object 730 rect from 75.59449999999994, 9.399999999999999 to 76.59449999999994, 9.2 fc rgb \"#DD0000\"",
+  "set object 731 rect from 77.68599999999995, 9.399999999999999 to 78.68599999999995, 9.2 fc rgb \"#DD0000\"",
+  "set object 732 rect from 78.74099999999993, 9.399999999999999 to 79.74099999999993, 9.2 fc rgb \"#DD0000\"",
+  "set object 733 rect from 82.96499999999995, 9.399999999999999 to 84.96999999999994, 9.2 fc rgb \"#DD0000\"",
+  "set object 734 rect from 88.98349999999992, 9.399999999999999 to 89.98349999999992, 9.2 fc rgb \"#DD0000\"",
+  "set object 735 rect from 90.04699999999991, 9.399999999999999 to 91.04699999999991, 9.2 fc rgb \"#DD0000\"",
+  "set object 736 rect from 91.11749999999992, 9.399999999999999 to 92.11749999999992, 9.2 fc rgb \"#DD0000\"",
+  "set object 737 rect from 94.24599999999992, 9.399999999999999 to 95.24599999999992, 9.2 fc rgb \"#DD0000\"",
+  "set object 738 rect from 98.46299999999991, 9.399999999999999 to 99.46299999999991, 9.2 fc rgb \"#DD0000\"",
+  "set object 739 rect from 106.85949999999991, 9.399999999999999 to 108.7474999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 740 rect from 109.87949999999991, 9.399999999999999 to 110.87949999999991, 9.2 fc rgb \"#DD0000\"",
+  "set object 741 rect from 115.0789999999999, 9.399999999999999 to 116.0789999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 742 rect from 119.3669999999999, 9.399999999999999 to 120.3669999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 743 rect from 123.56399999999988, 9.399999999999999 to 124.56399999999988, 9.2 fc rgb \"#DD0000\"",
+  "set object 744 rect from 127.77299999999991, 9.399999999999999 to 128.7729999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 745 rect from 128.8479999999999, 9.399999999999999 to 129.8479999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 746 rect from 131.90949999999987, 9.399999999999999 to 132.90949999999987, 9.2 fc rgb \"#DD0000\"",
+  "set object 747 rect from 132.9344999999999, 9.399999999999999 to 133.9344999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 748 rect from 138.2054999999999, 9.399999999999999 to 139.2054999999999, 9.2 fc rgb \"#DD0000\"",
+  "set object 749 rect from 18.803, 9.149999999999999 to 19.803, 8.95 fc rgb \"#DD0000\"",
+  "set object 750 rect from 19.8815, 9.149999999999999 to 20.8815, 8.95 fc rgb \"#DD0000\"",
+  "set object 751 rect from 20.910999999999998, 9.149999999999999 to 21.910999999999998, 8.95 fc rgb \"#DD0000\"",
+  "set object 752 rect from 45.50300000000001, 9.149999999999999 to 48.4035, 8.95 fc rgb \"#DD0000\"",
+  "set object 753 rect from 48.49, 9.149999999999999 to 53.228999999999985, 8.95 fc rgb \"#DD0000\"",
+  "set object 754 rect from 54.33049999999998, 9.149999999999999 to 55.33049999999998, 8.95 fc rgb \"#DD0000\"",
+  "set object 755 rect from 57.33799999999997, 9.149999999999999 to 59.19399999999997, 8.95 fc rgb \"#DD0000\"",
+  "set object 756 rect from 61.17299999999995, 9.149999999999999 to 62.17299999999995, 8.95 fc rgb \"#DD0000\"",
+  "set object 757 rect from 62.20049999999995, 9.149999999999999 to 63.20049999999995, 8.95 fc rgb \"#DD0000\"",
+  "set object 758 rect from 63.23999999999996, 9.149999999999999 to 64.23999999999995, 8.95 fc rgb \"#DD0000\"",
+  "set object 759 rect from 64.28099999999995, 9.149999999999999 to 65.28099999999995, 8.95 fc rgb \"#DD0000\"",
+  "set object 760 rect from 65.31249999999996, 9.149999999999999 to 66.31249999999996, 8.95 fc rgb \"#DD0000\"",
+  "set object 761 rect from 66.37099999999995, 9.149999999999999 to 68.35049999999995, 8.95 fc rgb \"#DD0000\"",
+  "set object 762 rect from 68.37699999999995, 9.149999999999999 to 70.37999999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 763 rect from 70.39199999999994, 9.149999999999999 to 71.39199999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 764 rect from 71.44949999999994, 9.149999999999999 to 72.44949999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 765 rect from 72.48699999999994, 9.149999999999999 to 73.48699999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 766 rect from 73.55549999999994, 9.149999999999999 to 75.56249999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 767 rect from 75.59449999999994, 9.149999999999999 to 76.59449999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 768 rect from 76.64899999999994, 9.149999999999999 to 77.64899999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 769 rect from 77.68599999999995, 9.149999999999999 to 78.68599999999995, 8.95 fc rgb \"#DD0000\"",
+  "set object 770 rect from 78.74099999999993, 9.149999999999999 to 79.74099999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 771 rect from 79.81349999999993, 9.149999999999999 to 80.81349999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 772 rect from 80.83699999999993, 9.149999999999999 to 81.83699999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 773 rect from 81.90449999999993, 9.149999999999999 to 82.90449999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 774 rect from 82.96499999999995, 9.149999999999999 to 84.96999999999994, 8.95 fc rgb \"#DD0000\"",
+  "set object 775 rect from 85.90099999999993, 9.149999999999999 to 86.90099999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 776 rect from 87.97249999999993, 9.149999999999999 to 88.97249999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 777 rect from 88.98349999999992, 9.149999999999999 to 89.98349999999992, 8.95 fc rgb \"#DD0000\"",
+  "set object 778 rect from 90.04699999999991, 9.149999999999999 to 91.04699999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 779 rect from 91.11749999999992, 9.149999999999999 to 92.11749999999992, 8.95 fc rgb \"#DD0000\"",
+  "set object 780 rect from 92.14499999999992, 9.149999999999999 to 93.14499999999992, 8.95 fc rgb \"#DD0000\"",
+  "set object 781 rect from 93.21149999999992, 9.149999999999999 to 94.21149999999992, 8.95 fc rgb \"#DD0000\"",
+  "set object 782 rect from 96.36399999999992, 9.149999999999999 to 97.36399999999992, 8.95 fc rgb \"#DD0000\"",
+  "set object 783 rect from 98.46299999999991, 9.149999999999999 to 99.46299999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 784 rect from 101.62199999999993, 9.149999999999999 to 102.62199999999993, 8.95 fc rgb \"#DD0000\"",
+  "set object 785 rect from 102.63099999999991, 9.149999999999999 to 103.63099999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 786 rect from 104.73949999999991, 9.149999999999999 to 105.73949999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 787 rect from 106.85949999999991, 9.149999999999999 to 108.7474999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 788 rect from 109.87949999999991, 9.149999999999999 to 110.87949999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 789 rect from 110.93299999999991, 9.149999999999999 to 111.93299999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 790 rect from 112.00149999999991, 9.149999999999999 to 113.9859999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 791 rect from 115.0789999999999, 9.149999999999999 to 116.0789999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 792 rect from 117.26799999999992, 9.149999999999999 to 118.26799999999992, 8.95 fc rgb \"#DD0000\"",
+  "set object 793 rect from 120.4439999999999, 9.149999999999999 to 121.4439999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 794 rect from 121.46899999999991, 9.149999999999999 to 122.46899999999991, 8.95 fc rgb \"#DD0000\"",
+  "set object 795 rect from 122.52449999999989, 9.149999999999999 to 123.52449999999989, 8.95 fc rgb \"#DD0000\"",
+  "set object 796 rect from 123.56399999999988, 9.149999999999999 to 124.56399999999988, 8.95 fc rgb \"#DD0000\"",
+  "set object 797 rect from 126.7234999999999, 9.149999999999999 to 127.7234999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 798 rect from 127.77299999999991, 9.149999999999999 to 128.7729999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 799 rect from 128.8479999999999, 9.149999999999999 to 129.8479999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 800 rect from 131.90949999999987, 9.149999999999999 to 132.90949999999987, 8.95 fc rgb \"#DD0000\"",
+  "set object 801 rect from 132.9344999999999, 9.149999999999999 to 133.9344999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 802 rect from 133.9804999999999, 9.149999999999999 to 134.9804999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 803 rect from 137.1609999999999, 9.149999999999999 to 138.1609999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 804 rect from 138.2054999999999, 9.149999999999999 to 139.2054999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 805 rect from 140.3004999999999, 9.149999999999999 to 141.3004999999999, 8.95 fc rgb \"#DD0000\"",
+  "set object 806 rect from 18.803, 8.899999999999999 to 19.803, 8.7 fc rgb \"#DD0000\"",
+  "set object 807 rect from 19.8815, 8.899999999999999 to 20.8815, 8.7 fc rgb \"#DD0000\"",
+  "set object 808 rect from 20.910999999999998, 8.899999999999999 to 21.910999999999998, 8.7 fc rgb \"#DD0000\"",
+  "set object 809 rect from 45.50300000000001, 8.899999999999999 to 48.4035, 8.7 fc rgb \"#DD0000\"",
+  "set object 810 rect from 48.49, 8.899999999999999 to 53.228999999999985, 8.7 fc rgb \"#DD0000\"",
+  "set object 811 rect from 54.33049999999998, 8.899999999999999 to 55.33049999999998, 8.7 fc rgb \"#DD0000\"",
+  "set object 812 rect from 57.33799999999997, 8.899999999999999 to 59.19399999999997, 8.7 fc rgb \"#DD0000\"",
+  "set object 813 rect from 61.17299999999995, 8.899999999999999 to 62.17299999999995, 8.7 fc rgb \"#DD0000\"",
+  "set object 814 rect from 62.20049999999995, 8.899999999999999 to 63.20049999999995, 8.7 fc rgb \"#DD0000\"",
+  "set object 815 rect from 63.23999999999996, 8.899999999999999 to 64.23999999999995, 8.7 fc rgb \"#DD0000\"",
+  "set object 816 rect from 64.28099999999995, 8.899999999999999 to 65.28099999999995, 8.7 fc rgb \"#DD0000\"",
+  "set object 817 rect from 65.31249999999996, 8.899999999999999 to 66.31249999999996, 8.7 fc rgb \"#DD0000\"",
+  "set object 818 rect from 66.37099999999995, 8.899999999999999 to 68.35049999999995, 8.7 fc rgb \"#DD0000\"",
+  "set object 819 rect from 68.37699999999995, 8.899999999999999 to 70.37999999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 820 rect from 70.39199999999994, 8.899999999999999 to 71.39199999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 821 rect from 71.44949999999994, 8.899999999999999 to 72.44949999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 822 rect from 72.48699999999994, 8.899999999999999 to 73.48699999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 823 rect from 73.55549999999994, 8.899999999999999 to 75.56249999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 824 rect from 75.59449999999994, 8.899999999999999 to 76.59449999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 825 rect from 76.64899999999994, 8.899999999999999 to 77.64899999999994, 8.7 fc rgb \"#DD0000\"",
+  "set object 826 rect from 77.68599999999995, 8.899999999999999 to 78.68599999999995, 8.7 fc rgb \"#DD0000\"",
+  "set object 827 rect from 78.74099999999993, 8.899999999999999 to 79.74099999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 828 rect from 79.81349999999993, 8.899999999999999 to 80.81349999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 829 rect from 80.83699999999993, 8.899999999999999 to 81.83699999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 830 rect from 81.90449999999993, 8.899999999999999 to 82.90449999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 831 rect from 82.96499999999995, 8.899999999999999 to 86.90099999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 832 rect from 87.97249999999993, 8.899999999999999 to 88.97249999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 833 rect from 88.98349999999992, 8.899999999999999 to 89.98349999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 834 rect from 90.04699999999991, 8.899999999999999 to 91.04699999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 835 rect from 91.11749999999992, 8.899999999999999 to 92.11749999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 836 rect from 92.14499999999992, 8.899999999999999 to 93.14499999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 837 rect from 93.21149999999992, 8.899999999999999 to 94.21149999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 838 rect from 94.24599999999992, 8.899999999999999 to 95.24599999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 839 rect from 95.31249999999991, 8.899999999999999 to 96.31249999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 840 rect from 96.36399999999992, 8.899999999999999 to 97.36399999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 841 rect from 97.39349999999992, 8.899999999999999 to 98.39349999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 842 rect from 98.46299999999991, 8.899999999999999 to 99.46299999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 843 rect from 99.48249999999992, 8.899999999999999 to 100.48249999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 844 rect from 100.56199999999993, 8.899999999999999 to 101.56199999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 845 rect from 101.62199999999993, 8.899999999999999 to 102.62199999999993, 8.7 fc rgb \"#DD0000\"",
+  "set object 846 rect from 102.63099999999991, 8.899999999999999 to 103.63099999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 847 rect from 103.67849999999991, 8.899999999999999 to 104.67849999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 848 rect from 104.73949999999991, 8.899999999999999 to 105.73949999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 849 rect from 105.77499999999992, 8.899999999999999 to 106.77499999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 850 rect from 106.85949999999991, 8.899999999999999 to 108.7474999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 851 rect from 109.87949999999991, 8.899999999999999 to 110.87949999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 852 rect from 110.93299999999991, 8.899999999999999 to 111.93299999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 853 rect from 112.00149999999991, 8.899999999999999 to 113.9859999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 854 rect from 114.0484999999999, 8.899999999999999 to 115.0484999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 855 rect from 115.0789999999999, 8.899999999999999 to 116.0789999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 856 rect from 116.14449999999991, 8.899999999999999 to 117.14449999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 857 rect from 117.26799999999992, 8.899999999999999 to 118.26799999999992, 8.7 fc rgb \"#DD0000\"",
+  "set object 858 rect from 118.3064999999999, 8.899999999999999 to 119.3064999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 859 rect from 119.3669999999999, 8.899999999999999 to 120.3669999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 860 rect from 120.4439999999999, 8.899999999999999 to 121.4439999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 861 rect from 121.46899999999991, 8.899999999999999 to 122.46899999999991, 8.7 fc rgb \"#DD0000\"",
+  "set object 862 rect from 122.52449999999989, 8.899999999999999 to 123.52449999999989, 8.7 fc rgb \"#DD0000\"",
+  "set object 863 rect from 123.56399999999988, 8.899999999999999 to 124.56399999999988, 8.7 fc rgb \"#DD0000\"",
+  "set object 864 rect from 124.6324999999999, 8.899999999999999 to 125.6324999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 865 rect from 125.6929999999999, 8.899999999999999 to 126.6929999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 866 rect from 126.7234999999999, 8.899999999999999 to 127.7234999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 867 rect from 127.77299999999991, 8.899999999999999 to 128.7729999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 868 rect from 128.8479999999999, 8.899999999999999 to 129.8479999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 869 rect from 129.8879999999999, 8.899999999999999 to 131.8519999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 870 rect from 131.90949999999987, 8.899999999999999 to 132.90949999999987, 8.7 fc rgb \"#DD0000\"",
+  "set object 871 rect from 132.9344999999999, 8.899999999999999 to 133.9344999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 872 rect from 133.9804999999999, 8.899999999999999 to 134.9804999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 873 rect from 135.0459999999999, 8.899999999999999 to 136.0459999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 874 rect from 136.08249999999987, 8.899999999999999 to 137.08249999999987, 8.7 fc rgb \"#DD0000\"",
+  "set object 875 rect from 137.1609999999999, 8.899999999999999 to 138.1609999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 876 rect from 138.2054999999999, 8.899999999999999 to 139.2054999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 877 rect from 139.24899999999988, 8.899999999999999 to 140.24899999999988, 8.7 fc rgb \"#DD0000\"",
+  "set object 878 rect from 140.3004999999999, 8.899999999999999 to 141.3004999999999, 8.7 fc rgb \"#DD0000\"",
+  "set object 879 rect from 18.803, 8.649999999999999 to 19.803, 8.45 fc rgb \"#DD0000\"",
+  "set object 880 rect from 19.8815, 8.649999999999999 to 20.8815, 8.45 fc rgb \"#DD0000\"",
+  "set object 881 rect from 20.910999999999998, 8.649999999999999 to 21.910999999999998, 8.45 fc rgb \"#DD0000\"",
+  "set object 882 rect from 45.50300000000001, 8.649999999999999 to 48.4035, 8.45 fc rgb \"#DD0000\"",
+  "set object 883 rect from 48.49, 8.649999999999999 to 53.228999999999985, 8.45 fc rgb \"#DD0000\"",
+  "set object 884 rect from 54.33049999999998, 8.649999999999999 to 55.33049999999998, 8.45 fc rgb \"#DD0000\"",
+  "set object 885 rect from 57.33799999999997, 8.649999999999999 to 59.19399999999997, 8.45 fc rgb \"#DD0000\"",
+  "set object 886 rect from 61.17299999999995, 8.649999999999999 to 62.17299999999995, 8.45 fc rgb \"#DD0000\"",
+  "set object 887 rect from 62.20049999999995, 8.649999999999999 to 63.20049999999995, 8.45 fc rgb \"#DD0000\"",
+  "set object 888 rect from 63.23999999999996, 8.649999999999999 to 64.23999999999995, 8.45 fc rgb \"#DD0000\"",
+  "set object 889 rect from 64.28099999999995, 8.649999999999999 to 65.28099999999995, 8.45 fc rgb \"#DD0000\"",
+  "set object 890 rect from 65.31249999999996, 8.649999999999999 to 66.31249999999996, 8.45 fc rgb \"#DD0000\"",
+  "set object 891 rect from 66.37099999999995, 8.649999999999999 to 68.35049999999995, 8.45 fc rgb \"#DD0000\"",
+  "set object 892 rect from 68.37699999999995, 8.649999999999999 to 70.37999999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 893 rect from 70.39199999999994, 8.649999999999999 to 71.39199999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 894 rect from 71.44949999999994, 8.649999999999999 to 72.44949999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 895 rect from 72.48699999999994, 8.649999999999999 to 73.48699999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 896 rect from 73.55549999999994, 8.649999999999999 to 75.56249999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 897 rect from 75.59449999999994, 8.649999999999999 to 76.59449999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 898 rect from 76.64899999999994, 8.649999999999999 to 77.64899999999994, 8.45 fc rgb \"#DD0000\"",
+  "set object 899 rect from 77.68599999999995, 8.649999999999999 to 78.68599999999995, 8.45 fc rgb \"#DD0000\"",
+  "set object 900 rect from 78.74099999999993, 8.649999999999999 to 79.74099999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 901 rect from 79.81349999999993, 8.649999999999999 to 80.81349999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 902 rect from 80.83699999999993, 8.649999999999999 to 81.83699999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 903 rect from 81.90449999999993, 8.649999999999999 to 82.90449999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 904 rect from 82.96499999999995, 8.649999999999999 to 86.90099999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 905 rect from 87.97249999999993, 8.649999999999999 to 88.97249999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 906 rect from 88.98349999999992, 8.649999999999999 to 89.98349999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 907 rect from 90.04699999999991, 8.649999999999999 to 91.04699999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 908 rect from 91.11749999999992, 8.649999999999999 to 92.11749999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 909 rect from 92.14499999999992, 8.649999999999999 to 93.14499999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 910 rect from 93.21149999999992, 8.649999999999999 to 94.21149999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 911 rect from 94.24599999999992, 8.649999999999999 to 95.24599999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 912 rect from 95.31249999999991, 8.649999999999999 to 96.31249999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 913 rect from 96.36399999999992, 8.649999999999999 to 97.36399999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 914 rect from 97.39349999999992, 8.649999999999999 to 98.39349999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 915 rect from 98.46299999999991, 8.649999999999999 to 99.46299999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 916 rect from 99.48249999999992, 8.649999999999999 to 100.48249999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 917 rect from 100.56199999999993, 8.649999999999999 to 101.56199999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 918 rect from 101.62199999999993, 8.649999999999999 to 102.62199999999993, 8.45 fc rgb \"#DD0000\"",
+  "set object 919 rect from 102.63099999999991, 8.649999999999999 to 103.63099999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 920 rect from 103.67849999999991, 8.649999999999999 to 104.67849999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 921 rect from 104.73949999999991, 8.649999999999999 to 105.73949999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 922 rect from 105.77499999999992, 8.649999999999999 to 106.77499999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 923 rect from 106.85949999999991, 8.649999999999999 to 108.7474999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 924 rect from 109.87949999999991, 8.649999999999999 to 110.87949999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 925 rect from 110.93299999999991, 8.649999999999999 to 111.93299999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 926 rect from 112.00149999999991, 8.649999999999999 to 113.9859999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 927 rect from 114.0484999999999, 8.649999999999999 to 115.0484999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 928 rect from 115.0789999999999, 8.649999999999999 to 116.0789999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 929 rect from 116.14449999999991, 8.649999999999999 to 117.14449999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 930 rect from 117.26799999999992, 8.649999999999999 to 118.26799999999992, 8.45 fc rgb \"#DD0000\"",
+  "set object 931 rect from 118.3064999999999, 8.649999999999999 to 119.3064999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 932 rect from 119.3669999999999, 8.649999999999999 to 120.3669999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 933 rect from 120.4439999999999, 8.649999999999999 to 121.4439999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 934 rect from 121.46899999999991, 8.649999999999999 to 122.46899999999991, 8.45 fc rgb \"#DD0000\"",
+  "set object 935 rect from 122.52449999999989, 8.649999999999999 to 123.52449999999989, 8.45 fc rgb \"#DD0000\"",
+  "set object 936 rect from 123.56399999999988, 8.649999999999999 to 124.56399999999988, 8.45 fc rgb \"#DD0000\"",
+  "set object 937 rect from 124.6324999999999, 8.649999999999999 to 125.6324999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 938 rect from 125.6929999999999, 8.649999999999999 to 126.6929999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 939 rect from 126.7234999999999, 8.649999999999999 to 127.7234999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 940 rect from 127.77299999999991, 8.649999999999999 to 128.7729999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 941 rect from 128.8479999999999, 8.649999999999999 to 129.8479999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 942 rect from 129.8879999999999, 8.649999999999999 to 131.8519999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 943 rect from 131.90949999999987, 8.649999999999999 to 132.90949999999987, 8.45 fc rgb \"#DD0000\"",
+  "set object 944 rect from 132.9344999999999, 8.649999999999999 to 133.9344999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 945 rect from 133.9804999999999, 8.649999999999999 to 134.9804999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 946 rect from 135.0459999999999, 8.649999999999999 to 136.0459999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 947 rect from 136.08249999999987, 8.649999999999999 to 137.08249999999987, 8.45 fc rgb \"#DD0000\"",
+  "set object 948 rect from 137.1609999999999, 8.649999999999999 to 138.1609999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 949 rect from 138.2054999999999, 8.649999999999999 to 139.2054999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 950 rect from 139.24899999999988, 8.649999999999999 to 140.24899999999988, 8.45 fc rgb \"#DD0000\"",
+  "set object 951 rect from 140.3004999999999, 8.649999999999999 to 141.3004999999999, 8.45 fc rgb \"#DD0000\"",
+  "set object 952 rect from 18.803, 8.399999999999999 to 19.803, 8.2 fc rgb \"#DD0000\"",
+  "set object 953 rect from 19.8815, 8.399999999999999 to 20.8815, 8.2 fc rgb \"#DD0000\"",
+  "set object 954 rect from 20.910999999999998, 8.399999999999999 to 21.910999999999998, 8.2 fc rgb \"#DD0000\"",
+  "set object 955 rect from 45.50300000000001, 8.399999999999999 to 48.4035, 8.2 fc rgb \"#DD0000\"",
+  "set object 956 rect from 48.49, 8.399999999999999 to 53.228999999999985, 8.2 fc rgb \"#DD0000\"",
+  "set object 957 rect from 54.33049999999998, 8.399999999999999 to 55.33049999999998, 8.2 fc rgb \"#DD0000\"",
+  "set object 958 rect from 57.33799999999997, 8.399999999999999 to 59.19399999999997, 8.2 fc rgb \"#DD0000\"",
+  "set object 959 rect from 61.17299999999995, 8.399999999999999 to 62.17299999999995, 8.2 fc rgb \"#DD0000\"",
+  "set object 960 rect from 62.20049999999995, 8.399999999999999 to 63.20049999999995, 8.2 fc rgb \"#DD0000\"",
+  "set object 961 rect from 63.23999999999996, 8.399999999999999 to 64.23999999999995, 8.2 fc rgb \"#DD0000\"",
+  "set object 962 rect from 64.28099999999995, 8.399999999999999 to 65.28099999999995, 8.2 fc rgb \"#DD0000\"",
+  "set object 963 rect from 65.31249999999996, 8.399999999999999 to 66.31249999999996, 8.2 fc rgb \"#DD0000\"",
+  "set object 964 rect from 66.37099999999995, 8.399999999999999 to 68.35049999999995, 8.2 fc rgb \"#DD0000\"",
+  "set object 965 rect from 68.37699999999995, 8.399999999999999 to 70.37999999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 966 rect from 70.39199999999994, 8.399999999999999 to 71.39199999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 967 rect from 71.44949999999994, 8.399999999999999 to 72.44949999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 968 rect from 72.48699999999994, 8.399999999999999 to 73.48699999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 969 rect from 73.55549999999994, 8.399999999999999 to 75.56249999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 970 rect from 75.59449999999994, 8.399999999999999 to 76.59449999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 971 rect from 76.64899999999994, 8.399999999999999 to 77.64899999999994, 8.2 fc rgb \"#DD0000\"",
+  "set object 972 rect from 77.68599999999995, 8.399999999999999 to 78.68599999999995, 8.2 fc rgb \"#DD0000\"",
+  "set object 973 rect from 78.74099999999993, 8.399999999999999 to 79.74099999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 974 rect from 79.81349999999993, 8.399999999999999 to 80.81349999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 975 rect from 80.83699999999993, 8.399999999999999 to 81.83699999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 976 rect from 81.90449999999993, 8.399999999999999 to 82.90449999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 977 rect from 82.96499999999995, 8.399999999999999 to 86.90099999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 978 rect from 87.97249999999993, 8.399999999999999 to 88.97249999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 979 rect from 88.98349999999992, 8.399999999999999 to 89.98349999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 980 rect from 90.04699999999991, 8.399999999999999 to 91.04699999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 981 rect from 91.11749999999992, 8.399999999999999 to 92.11749999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 982 rect from 92.14499999999992, 8.399999999999999 to 93.14499999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 983 rect from 93.21149999999992, 8.399999999999999 to 94.21149999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 984 rect from 94.24599999999992, 8.399999999999999 to 95.24599999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 985 rect from 95.31249999999991, 8.399999999999999 to 96.31249999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 986 rect from 96.36399999999992, 8.399999999999999 to 97.36399999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 987 rect from 97.39349999999992, 8.399999999999999 to 98.39349999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 988 rect from 98.46299999999991, 8.399999999999999 to 99.46299999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 989 rect from 99.48249999999992, 8.399999999999999 to 100.48249999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 990 rect from 100.56199999999993, 8.399999999999999 to 101.56199999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 991 rect from 101.62199999999993, 8.399999999999999 to 102.62199999999993, 8.2 fc rgb \"#DD0000\"",
+  "set object 992 rect from 102.63099999999991, 8.399999999999999 to 103.63099999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 993 rect from 103.67849999999991, 8.399999999999999 to 104.67849999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 994 rect from 104.73949999999991, 8.399999999999999 to 105.73949999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 995 rect from 105.77499999999992, 8.399999999999999 to 106.77499999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 996 rect from 106.85949999999991, 8.399999999999999 to 108.7474999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 997 rect from 109.87949999999991, 8.399999999999999 to 110.87949999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 998 rect from 110.93299999999991, 8.399999999999999 to 111.93299999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 999 rect from 112.00149999999991, 8.399999999999999 to 113.9859999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1000 rect from 114.0484999999999, 8.399999999999999 to 115.0484999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1001 rect from 115.0789999999999, 8.399999999999999 to 116.0789999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1002 rect from 116.14449999999991, 8.399999999999999 to 117.14449999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 1003 rect from 117.26799999999992, 8.399999999999999 to 118.26799999999992, 8.2 fc rgb \"#DD0000\"",
+  "set object 1004 rect from 118.3064999999999, 8.399999999999999 to 119.3064999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1005 rect from 119.3669999999999, 8.399999999999999 to 120.3669999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1006 rect from 120.4439999999999, 8.399999999999999 to 121.4439999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1007 rect from 121.46899999999991, 8.399999999999999 to 122.46899999999991, 8.2 fc rgb \"#DD0000\"",
+  "set object 1008 rect from 122.52449999999989, 8.399999999999999 to 123.52449999999989, 8.2 fc rgb \"#DD0000\"",
+  "set object 1009 rect from 123.56399999999988, 8.399999999999999 to 124.56399999999988, 8.2 fc rgb \"#DD0000\"",
+  "set object 1010 rect from 124.6324999999999, 8.399999999999999 to 125.6324999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1011 rect from 125.6929999999999, 8.399999999999999 to 126.6929999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1012 rect from 126.7234999999999, 8.399999999999999 to 127.7234999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1013 rect from 127.77299999999991, 8.399999999999999 to 128.7729999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1014 rect from 128.8479999999999, 8.399999999999999 to 129.8479999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1015 rect from 129.8879999999999, 8.399999999999999 to 131.8519999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1016 rect from 131.90949999999987, 8.399999999999999 to 132.90949999999987, 8.2 fc rgb \"#DD0000\"",
+  "set object 1017 rect from 132.9344999999999, 8.399999999999999 to 133.9344999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1018 rect from 133.9804999999999, 8.399999999999999 to 134.9804999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1019 rect from 135.0459999999999, 8.399999999999999 to 136.0459999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1020 rect from 136.08249999999987, 8.399999999999999 to 137.08249999999987, 8.2 fc rgb \"#DD0000\"",
+  "set object 1021 rect from 137.1609999999999, 8.399999999999999 to 138.1609999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1022 rect from 138.2054999999999, 8.399999999999999 to 139.2054999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1023 rect from 139.24899999999988, 8.399999999999999 to 140.24899999999988, 8.2 fc rgb \"#DD0000\"",
+  "set object 1024 rect from 140.3004999999999, 8.399999999999999 to 141.3004999999999, 8.2 fc rgb \"#DD0000\"",
+  "set object 1025 rect from 19.8815, 8.149999999999999 to 20.8815, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1026 rect from 20.910999999999998, 8.149999999999999 to 21.910999999999998, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1027 rect from 45.50300000000001, 8.149999999999999 to 48.4035, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1028 rect from 48.49, 8.149999999999999 to 53.228999999999985, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1029 rect from 54.33049999999998, 8.149999999999999 to 55.33049999999998, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1030 rect from 57.33799999999997, 8.149999999999999 to 59.19399999999997, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1031 rect from 61.17299999999995, 8.149999999999999 to 62.17299999999995, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1032 rect from 62.20049999999995, 8.149999999999999 to 63.20049999999995, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1033 rect from 63.23999999999996, 8.149999999999999 to 64.23999999999995, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1034 rect from 64.28099999999995, 8.149999999999999 to 65.28099999999995, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1035 rect from 65.31249999999996, 8.149999999999999 to 66.31249999999996, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1036 rect from 66.37099999999995, 8.149999999999999 to 68.35049999999995, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1037 rect from 68.37699999999995, 8.149999999999999 to 70.37999999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1038 rect from 70.39199999999994, 8.149999999999999 to 71.39199999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1039 rect from 71.44949999999994, 8.149999999999999 to 72.44949999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1040 rect from 72.48699999999994, 8.149999999999999 to 73.48699999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1041 rect from 73.55549999999994, 8.149999999999999 to 75.56249999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1042 rect from 75.59449999999994, 8.149999999999999 to 76.59449999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1043 rect from 76.64899999999994, 8.149999999999999 to 77.64899999999994, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1044 rect from 77.68599999999995, 8.149999999999999 to 78.68599999999995, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1045 rect from 78.74099999999993, 8.149999999999999 to 79.74099999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1046 rect from 79.81349999999993, 8.149999999999999 to 80.81349999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1047 rect from 80.83699999999993, 8.149999999999999 to 81.83699999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1048 rect from 81.90449999999993, 8.149999999999999 to 82.90449999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1049 rect from 82.96499999999995, 8.149999999999999 to 86.90099999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1050 rect from 87.97249999999993, 8.149999999999999 to 88.97249999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1051 rect from 88.98349999999992, 8.149999999999999 to 89.98349999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1052 rect from 90.04699999999991, 8.149999999999999 to 91.04699999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1053 rect from 91.11749999999992, 8.149999999999999 to 92.11749999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1054 rect from 92.14499999999992, 8.149999999999999 to 93.14499999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1055 rect from 93.21149999999992, 8.149999999999999 to 94.21149999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1056 rect from 94.24599999999992, 8.149999999999999 to 95.24599999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1057 rect from 95.31249999999991, 8.149999999999999 to 96.31249999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1058 rect from 96.36399999999992, 8.149999999999999 to 97.36399999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1059 rect from 97.39349999999992, 8.149999999999999 to 98.39349999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1060 rect from 98.46299999999991, 8.149999999999999 to 99.46299999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1061 rect from 99.48249999999992, 8.149999999999999 to 100.48249999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1062 rect from 100.56199999999993, 8.149999999999999 to 101.56199999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1063 rect from 101.62199999999993, 8.149999999999999 to 102.62199999999993, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1064 rect from 102.63099999999991, 8.149999999999999 to 103.63099999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1065 rect from 103.67849999999991, 8.149999999999999 to 104.67849999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1066 rect from 104.73949999999991, 8.149999999999999 to 105.73949999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1067 rect from 105.77499999999992, 8.149999999999999 to 106.77499999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1068 rect from 106.85949999999991, 8.149999999999999 to 108.7474999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1069 rect from 109.87949999999991, 8.149999999999999 to 110.87949999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1070 rect from 110.93299999999991, 8.149999999999999 to 111.93299999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1071 rect from 112.00149999999991, 8.149999999999999 to 113.9859999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1072 rect from 114.0484999999999, 8.149999999999999 to 115.0484999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1073 rect from 115.0789999999999, 8.149999999999999 to 116.0789999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1074 rect from 116.14449999999991, 8.149999999999999 to 117.14449999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1075 rect from 117.26799999999992, 8.149999999999999 to 118.26799999999992, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1076 rect from 118.3064999999999, 8.149999999999999 to 119.3064999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1077 rect from 119.3669999999999, 8.149999999999999 to 120.3669999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1078 rect from 120.4439999999999, 8.149999999999999 to 121.4439999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1079 rect from 121.46899999999991, 8.149999999999999 to 122.46899999999991, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1080 rect from 122.52449999999989, 8.149999999999999 to 123.52449999999989, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1081 rect from 123.56399999999988, 8.149999999999999 to 124.56399999999988, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1082 rect from 124.6324999999999, 8.149999999999999 to 125.6324999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1083 rect from 125.6929999999999, 8.149999999999999 to 126.6929999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1084 rect from 126.7234999999999, 8.149999999999999 to 127.7234999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1085 rect from 127.77299999999991, 8.149999999999999 to 128.7729999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1086 rect from 128.8479999999999, 8.149999999999999 to 129.8479999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1087 rect from 129.8879999999999, 8.149999999999999 to 131.8519999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1088 rect from 131.90949999999987, 8.149999999999999 to 132.90949999999987, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1089 rect from 132.9344999999999, 8.149999999999999 to 133.9344999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1090 rect from 133.9804999999999, 8.149999999999999 to 134.9804999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1091 rect from 135.0459999999999, 8.149999999999999 to 136.0459999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1092 rect from 136.08249999999987, 8.149999999999999 to 137.08249999999987, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1093 rect from 137.1609999999999, 8.149999999999999 to 138.1609999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1094 rect from 138.2054999999999, 8.149999999999999 to 139.2054999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1095 rect from 139.24899999999988, 8.149999999999999 to 140.24899999999988, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1096 rect from 140.3004999999999, 8.149999999999999 to 141.3004999999999, 7.949999999999999 fc rgb \"#DD0000\"",
+  "set object 1097 rect from 19.8815, 7.899999999999999 to 20.8815, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1098 rect from 20.910999999999998, 7.899999999999999 to 21.910999999999998, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1099 rect from 45.50300000000001, 7.899999999999999 to 48.4035, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1100 rect from 48.49, 7.899999999999999 to 53.228999999999985, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1101 rect from 54.33049999999998, 7.899999999999999 to 55.33049999999998, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1102 rect from 57.33799999999997, 7.899999999999999 to 59.19399999999997, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1103 rect from 61.17299999999995, 7.899999999999999 to 62.17299999999995, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1104 rect from 62.20049999999995, 7.899999999999999 to 63.20049999999995, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1105 rect from 63.23999999999996, 7.899999999999999 to 64.23999999999995, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1106 rect from 64.28099999999995, 7.899999999999999 to 65.28099999999995, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1107 rect from 65.31249999999996, 7.899999999999999 to 66.31249999999996, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1108 rect from 66.37099999999995, 7.899999999999999 to 68.35049999999995, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1109 rect from 68.37699999999995, 7.899999999999999 to 70.37999999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1110 rect from 70.39199999999994, 7.899999999999999 to 71.39199999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1111 rect from 71.44949999999994, 7.899999999999999 to 72.44949999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1112 rect from 72.48699999999994, 7.899999999999999 to 73.48699999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1113 rect from 73.55549999999994, 7.899999999999999 to 75.56249999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1114 rect from 75.59449999999994, 7.899999999999999 to 76.59449999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1115 rect from 76.64899999999994, 7.899999999999999 to 77.64899999999994, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1116 rect from 77.68599999999995, 7.899999999999999 to 78.68599999999995, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1117 rect from 78.74099999999993, 7.899999999999999 to 79.74099999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1118 rect from 79.81349999999993, 7.899999999999999 to 80.81349999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1119 rect from 80.83699999999993, 7.899999999999999 to 81.83699999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1120 rect from 81.90449999999993, 7.899999999999999 to 82.90449999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1121 rect from 82.96499999999995, 7.899999999999999 to 86.90099999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1122 rect from 87.97249999999993, 7.899999999999999 to 88.97249999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1123 rect from 88.98349999999992, 7.899999999999999 to 89.98349999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1124 rect from 90.04699999999991, 7.899999999999999 to 91.04699999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1125 rect from 91.11749999999992, 7.899999999999999 to 92.11749999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1126 rect from 92.14499999999992, 7.899999999999999 to 93.14499999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1127 rect from 93.21149999999992, 7.899999999999999 to 94.21149999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1128 rect from 94.24599999999992, 7.899999999999999 to 95.24599999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1129 rect from 95.31249999999991, 7.899999999999999 to 96.31249999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1130 rect from 96.36399999999992, 7.899999999999999 to 97.36399999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1131 rect from 97.39349999999992, 7.899999999999999 to 98.39349999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1132 rect from 98.46299999999991, 7.899999999999999 to 99.46299999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1133 rect from 99.48249999999992, 7.899999999999999 to 100.48249999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1134 rect from 100.56199999999993, 7.899999999999999 to 101.56199999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1135 rect from 101.62199999999993, 7.899999999999999 to 102.62199999999993, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1136 rect from 102.63099999999991, 7.899999999999999 to 103.63099999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1137 rect from 103.67849999999991, 7.899999999999999 to 104.67849999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1138 rect from 104.73949999999991, 7.899999999999999 to 105.73949999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1139 rect from 105.77499999999992, 7.899999999999999 to 106.77499999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1140 rect from 106.85949999999991, 7.899999999999999 to 108.7474999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1141 rect from 109.87949999999991, 7.899999999999999 to 110.87949999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1142 rect from 110.93299999999991, 7.899999999999999 to 111.93299999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1143 rect from 112.00149999999991, 7.899999999999999 to 113.9859999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1144 rect from 114.0484999999999, 7.899999999999999 to 115.0484999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1145 rect from 115.0789999999999, 7.899999999999999 to 116.0789999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1146 rect from 116.14449999999991, 7.899999999999999 to 117.14449999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1147 rect from 117.26799999999992, 7.899999999999999 to 118.26799999999992, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1148 rect from 118.3064999999999, 7.899999999999999 to 119.3064999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1149 rect from 119.3669999999999, 7.899999999999999 to 120.3669999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1150 rect from 120.4439999999999, 7.899999999999999 to 121.4439999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1151 rect from 121.46899999999991, 7.899999999999999 to 122.46899999999991, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1152 rect from 122.52449999999989, 7.899999999999999 to 123.52449999999989, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1153 rect from 123.56399999999988, 7.899999999999999 to 124.56399999999988, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1154 rect from 124.6324999999999, 7.899999999999999 to 125.6324999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1155 rect from 125.6929999999999, 7.899999999999999 to 126.6929999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1156 rect from 126.7234999999999, 7.899999999999999 to 127.7234999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1157 rect from 127.77299999999991, 7.899999999999999 to 128.7729999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1158 rect from 128.8479999999999, 7.899999999999999 to 129.8479999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1159 rect from 129.8879999999999, 7.899999999999999 to 131.8519999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1160 rect from 131.90949999999987, 7.899999999999999 to 132.90949999999987, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1161 rect from 132.9344999999999, 7.899999999999999 to 133.9344999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1162 rect from 133.9804999999999, 7.899999999999999 to 134.9804999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1163 rect from 135.0459999999999, 7.899999999999999 to 136.0459999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1164 rect from 136.08249999999987, 7.899999999999999 to 137.08249999999987, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1165 rect from 137.1609999999999, 7.899999999999999 to 138.1609999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1166 rect from 138.2054999999999, 7.899999999999999 to 139.2054999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1167 rect from 139.24899999999988, 7.899999999999999 to 140.24899999999988, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1168 rect from 140.3004999999999, 7.899999999999999 to 141.3004999999999, 7.699999999999999 fc rgb \"#DD0000\"",
+  "set object 1169 rect from 19.8815, 7.649999999999999 to 20.8815, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1170 rect from 20.910999999999998, 7.649999999999999 to 21.910999999999998, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1171 rect from 45.50300000000001, 7.649999999999999 to 48.4035, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1172 rect from 48.49, 7.649999999999999 to 53.228999999999985, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1173 rect from 54.33049999999998, 7.649999999999999 to 55.33049999999998, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1174 rect from 57.33799999999997, 7.649999999999999 to 59.19399999999997, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1175 rect from 61.17299999999995, 7.649999999999999 to 62.17299999999995, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1176 rect from 62.20049999999995, 7.649999999999999 to 63.20049999999995, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1177 rect from 63.23999999999996, 7.649999999999999 to 64.23999999999995, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1178 rect from 64.28099999999995, 7.649999999999999 to 65.28099999999995, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1179 rect from 65.31249999999996, 7.649999999999999 to 66.31249999999996, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1180 rect from 66.37099999999995, 7.649999999999999 to 68.35049999999995, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1181 rect from 68.37699999999995, 7.649999999999999 to 70.37999999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1182 rect from 70.39199999999994, 7.649999999999999 to 71.39199999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1183 rect from 71.44949999999994, 7.649999999999999 to 72.44949999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1184 rect from 72.48699999999994, 7.649999999999999 to 73.48699999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1185 rect from 73.55549999999994, 7.649999999999999 to 75.56249999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1186 rect from 75.59449999999994, 7.649999999999999 to 76.59449999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1187 rect from 76.64899999999994, 7.649999999999999 to 77.64899999999994, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1188 rect from 77.68599999999995, 7.649999999999999 to 78.68599999999995, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1189 rect from 78.74099999999993, 7.649999999999999 to 79.74099999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1190 rect from 79.81349999999993, 7.649999999999999 to 80.81349999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1191 rect from 80.83699999999993, 7.649999999999999 to 81.83699999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1192 rect from 81.90449999999993, 7.649999999999999 to 82.90449999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1193 rect from 82.96499999999995, 7.649999999999999 to 86.90099999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1194 rect from 87.97249999999993, 7.649999999999999 to 88.97249999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1195 rect from 88.98349999999992, 7.649999999999999 to 89.98349999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1196 rect from 90.04699999999991, 7.649999999999999 to 91.04699999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1197 rect from 91.11749999999992, 7.649999999999999 to 92.11749999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1198 rect from 92.14499999999992, 7.649999999999999 to 93.14499999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1199 rect from 93.21149999999992, 7.649999999999999 to 94.21149999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1200 rect from 94.24599999999992, 7.649999999999999 to 95.24599999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1201 rect from 95.31249999999991, 7.649999999999999 to 96.31249999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1202 rect from 96.36399999999992, 7.649999999999999 to 97.36399999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1203 rect from 97.39349999999992, 7.649999999999999 to 98.39349999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1204 rect from 98.46299999999991, 7.649999999999999 to 99.46299999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1205 rect from 99.48249999999992, 7.649999999999999 to 100.48249999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1206 rect from 100.56199999999993, 7.649999999999999 to 101.56199999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1207 rect from 101.62199999999993, 7.649999999999999 to 102.62199999999993, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1208 rect from 102.63099999999991, 7.649999999999999 to 103.63099999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1209 rect from 103.67849999999991, 7.649999999999999 to 104.67849999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1210 rect from 104.73949999999991, 7.649999999999999 to 105.73949999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1211 rect from 105.77499999999992, 7.649999999999999 to 106.77499999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1212 rect from 106.85949999999991, 7.649999999999999 to 108.7474999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1213 rect from 109.87949999999991, 7.649999999999999 to 110.87949999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1214 rect from 110.93299999999991, 7.649999999999999 to 111.93299999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1215 rect from 112.00149999999991, 7.649999999999999 to 113.9859999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1216 rect from 114.0484999999999, 7.649999999999999 to 115.0484999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1217 rect from 115.0789999999999, 7.649999999999999 to 116.0789999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1218 rect from 116.14449999999991, 7.649999999999999 to 117.14449999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1219 rect from 117.26799999999992, 7.649999999999999 to 118.26799999999992, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1220 rect from 118.3064999999999, 7.649999999999999 to 119.3064999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1221 rect from 119.3669999999999, 7.649999999999999 to 120.3669999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1222 rect from 120.4439999999999, 7.649999999999999 to 121.4439999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1223 rect from 121.46899999999991, 7.649999999999999 to 122.46899999999991, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1224 rect from 122.52449999999989, 7.649999999999999 to 123.52449999999989, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1225 rect from 123.56399999999988, 7.649999999999999 to 124.56399999999988, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1226 rect from 124.6324999999999, 7.649999999999999 to 125.6324999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1227 rect from 125.6929999999999, 7.649999999999999 to 126.6929999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1228 rect from 126.7234999999999, 7.649999999999999 to 127.7234999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1229 rect from 127.77299999999991, 7.649999999999999 to 128.7729999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1230 rect from 128.8479999999999, 7.649999999999999 to 129.8479999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1231 rect from 129.8879999999999, 7.649999999999999 to 131.8519999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1232 rect from 131.90949999999987, 7.649999999999999 to 132.90949999999987, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1233 rect from 132.9344999999999, 7.649999999999999 to 133.9344999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1234 rect from 133.9804999999999, 7.649999999999999 to 134.9804999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1235 rect from 135.0459999999999, 7.649999999999999 to 136.0459999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1236 rect from 136.08249999999987, 7.649999999999999 to 137.08249999999987, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1237 rect from 137.1609999999999, 7.649999999999999 to 138.1609999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1238 rect from 138.2054999999999, 7.649999999999999 to 139.2054999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1239 rect from 139.24899999999988, 7.649999999999999 to 140.24899999999988, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1240 rect from 140.3004999999999, 7.649999999999999 to 141.3004999999999, 7.449999999999999 fc rgb \"#DD0000\"",
+  "set object 1241 rect from 64.28099999999995, 10.2 to 65.28099999999995, 9.8 fc rgb \"#00EE00\"",
+  "set object 1242 rect from 70.39199999999994, 10.2 to 71.39199999999994, 9.8 fc rgb \"#00EE00\"",
+  "set object 1243 rect from 74.56249999999994, 10.2 to 75.56249999999994, 9.8 fc rgb \"#00EE00\"",
+  "set object 1244 rect from 75.59449999999994, 10.2 to 76.59449999999994, 9.8 fc rgb \"#00EE00\"",
+  "set object 1245 rect from 77.68599999999995, 10.2 to 78.68599999999995, 9.8 fc rgb \"#00EE00\"",
+  "set object 1246 rect from 82.96499999999995, 10.2 to 83.96499999999995, 9.8 fc rgb \"#00EE00\"",
+  "set object 1247 rect from 85.90099999999993, 10.2 to 86.90099999999993, 9.8 fc rgb \"#00EE00\"",
+  "set object 1248 rect from 87.97249999999993, 10.2 to 88.97249999999993, 9.8 fc rgb \"#00EE00\"",
+  "set object 1249 rect from 92.14499999999992, 10.2 to 93.14499999999992, 9.8 fc rgb \"#00EE00\"",
+  "set object 1250 rect from 95.31249999999991, 10.2 to 96.31249999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1251 rect from 97.39349999999992, 10.2 to 98.39349999999992, 9.8 fc rgb \"#00EE00\"",
+  "set object 1252 rect from 98.46299999999991, 10.2 to 99.46299999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1253 rect from 99.48249999999992, 10.2 to 100.48249999999992, 9.8 fc rgb \"#00EE00\"",
+  "set object 1254 rect from 100.56199999999993, 10.2 to 101.56199999999993, 9.8 fc rgb \"#00EE00\"",
+  "set object 1255 rect from 101.62199999999993, 10.2 to 102.62199999999993, 9.8 fc rgb \"#00EE00\"",
+  "set object 1256 rect from 102.63099999999991, 10.2 to 103.63099999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1257 rect from 103.67849999999991, 10.2 to 104.67849999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1258 rect from 104.73949999999991, 10.2 to 105.73949999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1259 rect from 105.77499999999992, 10.2 to 106.77499999999992, 9.8 fc rgb \"#00EE00\"",
+  "set object 1260 rect from 107.7474999999999, 10.2 to 108.7474999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1261 rect from 110.93299999999991, 10.2 to 111.93299999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1262 rect from 115.0789999999999, 10.2 to 116.0789999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1263 rect from 116.14449999999991, 10.2 to 117.14449999999991, 9.8 fc rgb \"#00EE00\"",
+  "set object 1264 rect from 117.26799999999992, 10.2 to 118.26799999999992, 9.8 fc rgb \"#00EE00\"",
+  "set object 1265 rect from 118.3064999999999, 10.2 to 119.3064999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1266 rect from 122.52449999999989, 10.2 to 123.52449999999989, 9.8 fc rgb \"#00EE00\"",
+  "set object 1267 rect from 123.56399999999988, 10.2 to 124.56399999999988, 9.8 fc rgb \"#00EE00\"",
+  "set object 1268 rect from 124.6324999999999, 10.2 to 125.6324999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1269 rect from 125.6929999999999, 10.2 to 126.6929999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1270 rect from 128.8479999999999, 10.2 to 129.8479999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1271 rect from 129.8879999999999, 10.2 to 131.8519999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1272 rect from 131.90949999999987, 10.2 to 132.90949999999987, 9.8 fc rgb \"#00EE00\"",
+  "set object 1273 rect from 133.9804999999999, 10.2 to 134.9804999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1274 rect from 136.08249999999987, 10.2 to 137.08249999999987, 9.8 fc rgb \"#00EE00\"",
+  "set object 1275 rect from 140.3004999999999, 10.2 to 141.3004999999999, 9.8 fc rgb \"#00EE00\"",
+  "set object 1276 rect from 61.17299999999995, 9.399999999999999 to 62.17299999999995, 9.2 fc rgb \"#00EE00\"",
+  "set object 1277 rect from 63.23999999999996, 9.399999999999999 to 64.23999999999995, 9.2 fc rgb \"#00EE00\"",
+  "set object 1278 rect from 65.31249999999996, 9.399999999999999 to 66.31249999999996, 9.2 fc rgb \"#00EE00\"",
+  "set object 1279 rect from 66.37099999999995, 9.399999999999999 to 67.37099999999995, 9.2 fc rgb \"#00EE00\"",
+  "set object 1280 rect from 68.37699999999995, 9.399999999999999 to 70.37999999999994, 9.2 fc rgb \"#00EE00\"",
+  "set object 1281 rect from 70.39199999999994, 9.399999999999999 to 71.39199999999994, 9.2 fc rgb \"#00EE00\"",
+  "set object 1282 rect from 72.48699999999994, 9.399999999999999 to 73.48699999999994, 9.2 fc rgb \"#00EE00\"",
+  "set object 1283 rect from 73.55549999999994, 9.399999999999999 to 75.56249999999994, 9.2 fc rgb \"#00EE00\"",
+  "set object 1284 rect from 76.64899999999994, 9.399999999999999 to 77.64899999999994, 9.2 fc rgb \"#00EE00\"",
+  "set object 1285 rect from 79.81349999999993, 9.399999999999999 to 80.81349999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1286 rect from 80.83699999999993, 9.399999999999999 to 81.83699999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1287 rect from 81.90449999999993, 9.399999999999999 to 82.90449999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1288 rect from 84.90049999999992, 9.399999999999999 to 86.90099999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1289 rect from 87.97249999999993, 9.399999999999999 to 88.97249999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1290 rect from 92.14499999999992, 9.399999999999999 to 93.14499999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1291 rect from 93.21149999999992, 9.399999999999999 to 94.21149999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1292 rect from 95.31249999999991, 9.399999999999999 to 96.31249999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1293 rect from 96.36399999999992, 9.399999999999999 to 97.36399999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1294 rect from 97.39349999999992, 9.399999999999999 to 98.39349999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1295 rect from 99.48249999999992, 9.399999999999999 to 100.48249999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1296 rect from 100.56199999999993, 9.399999999999999 to 101.56199999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1297 rect from 101.62199999999993, 9.399999999999999 to 102.62199999999993, 9.2 fc rgb \"#00EE00\"",
+  "set object 1298 rect from 102.63099999999991, 9.399999999999999 to 103.63099999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1299 rect from 103.67849999999991, 9.399999999999999 to 104.67849999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1300 rect from 104.73949999999991, 9.399999999999999 to 105.73949999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1301 rect from 105.77499999999992, 9.399999999999999 to 106.77499999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1302 rect from 110.93299999999991, 9.399999999999999 to 111.93299999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1303 rect from 112.00149999999991, 9.399999999999999 to 113.9859999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1304 rect from 114.0484999999999, 9.399999999999999 to 115.0484999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1305 rect from 116.14449999999991, 9.399999999999999 to 117.14449999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1306 rect from 117.26799999999992, 9.399999999999999 to 118.26799999999992, 9.2 fc rgb \"#00EE00\"",
+  "set object 1307 rect from 118.3064999999999, 9.399999999999999 to 119.3064999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1308 rect from 120.4439999999999, 9.399999999999999 to 121.4439999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1309 rect from 121.46899999999991, 9.399999999999999 to 122.46899999999991, 9.2 fc rgb \"#00EE00\"",
+  "set object 1310 rect from 122.52449999999989, 9.399999999999999 to 123.52449999999989, 9.2 fc rgb \"#00EE00\"",
+  "set object 1311 rect from 124.6324999999999, 9.399999999999999 to 125.6324999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1312 rect from 125.6929999999999, 9.399999999999999 to 126.6929999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1313 rect from 126.7234999999999, 9.399999999999999 to 127.7234999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1314 rect from 129.8879999999999, 9.399999999999999 to 131.8519999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1315 rect from 133.9804999999999, 9.399999999999999 to 134.9804999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1316 rect from 135.0459999999999, 9.399999999999999 to 136.0459999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1317 rect from 136.08249999999987, 9.399999999999999 to 137.08249999999987, 9.2 fc rgb \"#00EE00\"",
+  "set object 1318 rect from 137.1609999999999, 9.399999999999999 to 138.1609999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1319 rect from 139.24899999999988, 9.399999999999999 to 140.24899999999988, 9.2 fc rgb \"#00EE00\"",
+  "set object 1320 rect from 140.3004999999999, 9.399999999999999 to 141.3004999999999, 9.2 fc rgb \"#00EE00\"",
+  "set object 1321 rect from 84.90049999999992, 9.149999999999999 to 85.90049999999992, 8.95 fc rgb \"#00EE00\"",
+  "set object 1322 rect from 94.24599999999992, 9.149999999999999 to 95.24599999999992, 8.95 fc rgb \"#00EE00\"",
+  "set object 1323 rect from 95.31249999999991, 9.149999999999999 to 96.31249999999991, 8.95 fc rgb \"#00EE00\"",
+  "set object 1324 rect from 97.39349999999992, 9.149999999999999 to 98.39349999999992, 8.95 fc rgb \"#00EE00\"",
+  "set object 1325 rect from 99.48249999999992, 9.149999999999999 to 100.48249999999992, 8.95 fc rgb \"#00EE00\"",
+  "set object 1326 rect from 100.56199999999993, 9.149999999999999 to 101.56199999999993, 8.95 fc rgb \"#00EE00\"",
+  "set object 1327 rect from 103.67849999999991, 9.149999999999999 to 104.67849999999991, 8.95 fc rgb \"#00EE00\"",
+  "set object 1328 rect from 105.77499999999992, 9.149999999999999 to 106.77499999999992, 8.95 fc rgb \"#00EE00\"",
+  "set object 1329 rect from 114.0484999999999, 9.149999999999999 to 115.0484999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1330 rect from 116.14449999999991, 9.149999999999999 to 117.14449999999991, 8.95 fc rgb \"#00EE00\"",
+  "set object 1331 rect from 118.3064999999999, 9.149999999999999 to 119.3064999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1332 rect from 119.3669999999999, 9.149999999999999 to 120.3669999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1333 rect from 124.6324999999999, 9.149999999999999 to 125.6324999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1334 rect from 125.6929999999999, 9.149999999999999 to 126.6929999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1335 rect from 129.8879999999999, 9.149999999999999 to 131.8519999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1336 rect from 135.0459999999999, 9.149999999999999 to 136.0459999999999, 8.95 fc rgb \"#00EE00\"",
+  "set object 1337 rect from 136.08249999999987, 9.149999999999999 to 137.08249999999987, 8.95 fc rgb \"#00EE00\"",
+  "set object 1338 rect from 139.24899999999988, 9.149999999999999 to 140.24899999999988, 8.95 fc rgb \"#00EE00\"",
+  "set object 1339 rect from 78.74099999999993, 10.2 to 79.74099999999993, 9.8 fc rgb \"#FF00FF\"",
+  "set object 1340 rect from 93.21149999999992, 10.2 to 94.21149999999992, 9.8 fc rgb \"#FF00FF\"",
+  "set object 1341 rect from 112.00149999999991, 10.2 to 113.00149999999991, 9.8 fc rgb \"#FF00FF\"",
+  "set object 1342 rect from 80.83699999999993, 10.2 to 81.83699999999993, 9.8 fc rgb \"#AA00AA\"",
+  "set object 1343 rect from 57.33799999999997, 10.2 to 58.33799999999997, 9.8 fc rgb \"#4444AA\"",
+  "set object 1344 rect from 67.35049999999995, 10.2 to 68.35049999999995, 9.8 fc rgb \"#4444AA\"",
+  "set object 1345 rect from 71.44949999999994, 10.2 to 72.44949999999994, 9.8 fc rgb \"#4444AA\"",
+  "set object 1346 rect from 138.2054999999999, 10.2 to 139.2054999999999, 9.8 fc rgb \"#4444AA\"",
+  "set label \"external \" at 11.092156249999992,11 textcolor rgb \"#3399FF\" font \"Helvetica,9'\"",
+  "set label \"runtime  \" at 19.763812499999986,11 textcolor rgb \"#000000\" font \"Helvetica,9'\"",
+  "set label \"full code\" at 28.435468749999977,11 textcolor rgb \"#DD0000\" font \"Helvetica,9'\"",
+  "set label \"opt code \" at 37.10712499999997,11 textcolor rgb \"#00EE00\" font \"Helvetica,9'\"",
+  "set label \"code stub\" at 45.77878124999996,11 textcolor rgb \"#FF00FF\" font \"Helvetica,9'\"",
+  "set label \"built-in \" at 54.45043749999995,11 textcolor rgb \"#AA00AA\" font \"Helvetica,9'\"",
+  "set label \"inl.cache\" at 63.12209374999994,11 textcolor rgb \"#4444AA\" font \"Helvetica,9'\"",
+  "set label \"reg.exp. \" at 71.79374999999993,11 textcolor rgb \"#0000FF\" font \"Helvetica,9'\"",
+  "set label \"13 ms\" at 42.32008281250001,5.5 font \"Helvetica,7'\"",
+  "set label \"1 ms\" at 4.2255828125,1 font \"Helvetica,7'\"",
+  "set label \"1 ms\" at 10.8385828125,1 font \"Helvetica,7'\"",
+  "set label \"1 ms\" at 7.8065828125,1 font \"Helvetica,7'\"",
+  "set label \"1 ms\" at 14.3305828125,1 font \"Helvetica,7'\"",
+  "set label \"0 ms\" at 18.204082812499998,1 font \"Helvetica,7'\"",
+  "set label \"0 ms\" at 85.27908281249994,1 font \"Helvetica,7'\"",
+  "set y2range [0:59.54259090909095]",
+  "plot '-' using 1:2 axes x1y2 with impulses ls 1",
+  "41.88650000000001 13.935500000000008",
+  "3.7920000000000003 1.3375000000000004",
+  "10.405000000000001 1.113500000000002",
+  "7.373 1.1035000000000004",
+  "13.897 1.0205000000000002",
+  "17.7705 0.7759999999999998",
+  "84.84549999999993 0.75",
+  "86.05649999999993 0.6779999999999973",
+  "87.36899999999991 0.6134999999999877",
+  "131.1209999999999 0.5784999999999911",
+  "108.09449999999991 0.5775000000000006",
+  "60.65699999999996 0.4855000000000018",
+  "23.1135 0.44849999999999923",
+  "21.063999999999997 0.4394999999999989",
+  "56.198999999999984 0.3990000000000009",
+  "63.024999999999956 0.39799999999999613",
+  "51.02349999999999 0.39399999999999835",
+  "110.4839999999999 0.3930000000000007",
+  "54.951999999999984 0.392000000000003",
+  "69.49599999999995 0.38750000000000284",
+  "62.548999999999964 0.38750000000000284",
+  "89.21399999999991 0.3744999999999976",
+  "133.4079999999999 0.3645000000000209",
+  "61.253999999999955 0.3374999999999986",
+  "104.4429999999999 0.30999999999997385",
+  "56.52499999999998 0.2734999999999985",
+  "63.41299999999995 0.26549999999999585",
+  "102.99499999999992 0.2535000000000025",
+  "47.3935 0.25250000000000483",
+  "58.65749999999996 0.24799999999999756",
+  "23.8365 0.2469999999999999",
+  "74.63849999999994 0.23149999999998272",
+  "16.9595 0.22250000000000014",
+  "85.13799999999992 0.22049999999998704",
+  "51.78349999999999 0.2085000000000008",
+  "64.61749999999995 0.20849999999998658",
+  "70.58649999999994 0.1775000000000091",
+  "55.66249999999998 0.17649999999999721",
+  "57.205999999999975 0.1700000000000017",
+  "75.20099999999994 0.1529999999999916",
+  "61.464999999999954 0.1524999999999963",
+  "18.017000000000003 0.14550000000000196",
+  "67.48749999999995 0.14500000000001023",
+  "42.05100000000001 0.1385000000000005",
+  "25.4055 0.13799999999999812",
+  "46.9925 0.1314999999999955",
+  "18.1735 0.12750000000000128",
+  "109.38599999999991 0.12000000000000455",
+  "59.042999999999964 0.1180000000000021",
+  "56.97649999999997 0.117999999999995",
+  "22.3815 0.11400000000000077",
+  "58.07699999999997 0.1039999999999992",
+  "23.336000000000002 0.10300000000000153",
+  "21.8475 0.10050000000000026",
+  "56.845999999999975 0.09949999999999903",
+  "46.28150000000001 0.09649999999999892",
+  "121.0104999999999 0.09099999999999397",
+  "25.507500000000004 0.08800000000000452",
+  "52.448999999999984 0.08599999999999852",
+  "46.74 0.08499999999999375",
+  "57.64849999999997 0.08249999999999602",
+  "58.316999999999965 0.08099999999999596",
+  "23.506 0.08050000000000068",
+  "46.37200000000001 0.08050000000000068",
+  "42.70600000000002 0.07900000000000063",
+  "129.4124999999999 0.07800000000000296",
+  "20.5975 0.07750000000000057",
+  "56.634499999999974 0.07749999999999346",
+  "19.0685 0.07649999999999935",
+  "21.363 0.07549999999999812",
+  "49.9695 0.07500000000000284",
+  "24.544000000000004 0.07400000000000162",
+  "21.727 0.07349999999999923",
+  "58.21549999999997 0.07249999999999801",
+  "44.917000000000016 0.07200000000000273",
+  "25.591500000000003 0.07199999999999918",
+  "50.62049999999999 0.07150000000000034",
+  "46.621 0.07099999999999795",
+  "88.82299999999992 0.07099999999999795",
+  "78.23049999999994 0.0660000000000025",
+  "46.060500000000005 0.0659999999999954",
+  "50.43099999999999 0.06400000000000006",
+  "129.48849999999987 0.06349999999997635",
+  "45.55900000000001 0.06150000000000233",
+  "19.152 0.06050000000000111",
+  "50.20799999999999 0.060499999999997556",
+  "57.33299999999997 0.060499999999997556",
+  "68.76649999999995 0.06049999999999045",
+  "23.5775 0.059499999999999886",
+  "47.135000000000005 0.05850000000000222",
+  "72.28049999999995 0.05849999999999511",
+  "45.626500000000014 0.05750000000000455",
+  "21.2695 0.057500000000000995",
+  "50.14149999999999 0.05749999999999744",
+  "91.96649999999993 0.056500000000013983",
+  "57.934999999999974 0.05649999999999977",
+  "83.63999999999993 0.05649999999999977",
+  "132.92249999999987 0.05649999999997135",
+  "67.59199999999996 0.056000000000011596",
+  "99.92199999999991 0.055499999999995",
+  "59.69699999999996 0.055499999999995",
+  "45.84850000000001 0.054999999999999716",
+  "56.69449999999998 0.05449999999999733",
+  "97.26099999999992 0.05350000000001387",
+  "112.6564999999999 0.05349999999999966",
+  "45.92300000000001 0.05349999999999966",
+  "136.19799999999987 0.05349999999998545",
+  "47.465 0.05250000000000199",
+  "105.93349999999991 0.052499999999994884",
+  "65.61699999999995 0.052499999999994884",
+  "47.5235 0.051499999999997215",
+  "102.61199999999991 0.05149999999999011",
+  "138.98049999999986 0.0514999999999759",
+  "123.8254999999999 0.050500000000013756",
+  "75.46799999999995 0.04950000000000898",
+  "45.76150000000001 0.049500000000001876",
+  "94.6054999999999 0.04949999999998056",
+  "45.97850000000001 0.048500000000004206",
+  "115.4124999999999 0.048500000000004206",
+  "118.19199999999991 0.048500000000004206",
+  "49.780499999999996 0.0484999999999971",
+  "42.795000000000016 0.04800000000000182",
+  "126.59899999999989 0.04749999999999943",
+  "51.56899999999999 0.04650000000000176",
+  "80.95049999999993 0.04649999999999466",
+  "140.9779999999999 0.04599999999999227",
+  "59.93649999999996 0.04549999999999699",
+  "46.13100000000001 0.04449999999999932",
+  "51.91599999999998 0.04299999999999926",
+  "45.70300000000001 0.042499999999996874",
+  "49.4955 0.04100000000000392",
+  "45.361500000000014 0.04099999999999682",
+  "70.35799999999995 0.04050000000000864",
+  "49.726 0.040500000000001535",
+  "45.08700000000001 0.03999999999999915",
+  "45.13500000000002 0.03900000000000858",
+  "52.15399999999998 0.0379999999999967",
+  "42.88200000000001 0.0379999999999967",
+  "24.430500000000002 0.03750000000000142",
+  "23.907 0.036499999999996646",
+  "60.08349999999996 0.036499999999996646",
+  "50.32899999999999 0.036000000000001364",
+  "42.31450000000002 0.034000000000006025",
+  "45.02900000000001 0.032999999999994145",
+  "23.189 0.031500000000001194",
+  "21.49 0.03049999999999997",
+  "42.83300000000001 0.030000000000001137",
+  "58.12149999999997 0.030000000000001137",
+  "45.41750000000002 0.030000000000001137",
+  "140.89599999999987 0.028999999999996362",
+  "2.4490000000000003 0.028500000000000636",
+  "52.31499999999998 0.027999999999998693",
+  "45.17200000000002 0.027999999999998693",
+  "43.632500000000014 0.027000000000001023",
+  "49.8685 0.027000000000001023",
+  "51.30249999999999 0.027000000000001023",
+  "21.175 0.026499999999998636",
+  "44.82200000000002 0.026000000000003354",
+  "22.528 0.02599999999999625",
+  "49.82449999999999 0.02499999999999858",
+  "21.1335 0.024499999999999744",
+  "21.588 0.021500000000003183",
+  "21.525499999999997 0.02049999999999841",
+  "23.3945 0.018499999999999517",
+  "47.057500000000005 0.018000000000000682",
+  "22.570999999999998 0.01799999999999713",
+  "24.458 0.017499999999998295",
+  "22.4625 0.017499999999998295",
+  "141.04699999999988 0.016999999999995907",
+  "22.416999999999998 0.016500000000000625",
+  "45.44850000000002 0.015999999999998238",
+  "21.619500000000002 0.015499999999999403",
+  "109.41799999999989 0.015499999999988745",
+  "22.486 0.014500000000001734",
+  "50.53499999999999 0.013999999999995794",
+  "52.338999999999984 0.012000000000000455",
+  "45.489500000000014 0.012000000000000455",
+  "45.470500000000015 0.00999999999999801",
+  "50.007 0.008500000000005059",
+  "23.9205 0.008499999999997954",
+  "10.43 0.006499999999999062",
+  "13.915999999999999 0.005499999999999616",
+  "7.3919999999999995 0.005499999999999616",
+  "3.8129999999999997 0.005499999999999616",
+  "121.0314999999999 0.00549999999999784",
+  "78.23649999999994 0.0005000000000023874",
+  "e",
+  "# start: 2.4204999999999997",
+  "# end: 141.1669999999999",
+  "# objects: 1547"
+]
diff --git a/test/mjsunit/tools/profviz-test.log b/test/mjsunit/tools/profviz-test.log
new file mode 100644
index 0000000..2071320
--- /dev/null
+++ b/test/mjsunit/tools/profviz-test.log
@@ -0,0 +1,2613 @@
+shared-library,"/usr/local/google/home/yangguo/v8/out/ia32.release/d8",0x08048000,0x08557000
+shared-library,"2506f000-25070000",0x2506f000,0x25070000
+shared-library,"31e60000-31e61000",0x31e60000,0x31e61000
+shared-library,"35dff000-35e00000",0x35dff000,0x35e00000
+shared-library,"48218000-48219000",0x48218000,0x48219000
+shared-library,"4af7d000-4af7e000",0x4af7d000,0x4af7e000
+shared-library,"55bf2000-55bf3000",0x55bf2000,0x55bf3000
+shared-library,"/lib/i386-linux-gnu/libc-2.15.so",0xf7450000,0xf75f3000
+shared-library,"/lib/i386-linux-gnu/libpthread-2.15.so",0xf75f9000,0xf7610000
+shared-library,"/lib/i386-linux-gnu/libgcc_s.so.1",0xf7614000,0xf7630000
+shared-library,"/lib/i386-linux-gnu/libm-2.15.so",0xf7633000,0xf765d000
+shared-library,"/usr/lib/i386-linux-gnu/libstdc++.so.6.0.16",0xf765f000,0xf7737000
+shared-library,"[vdso]",0xf776d000,0xf776e000
+shared-library,"/lib/i386-linux-gnu/ld-2.15.so",0xf776e000,0xf778e000
+profiler,"begin",1
+timer-event-start,"V8.GCCompactor",2425
+timer-event-start,"V8.External",2458
+timer-event-end,"V8.External",2468
+timer-event-start,"V8.External",3810
+timer-event-end,"V8.External",3830
+timer-event-end,"V8.GCCompactor",3840
+code-creation,Stub,2,0x2b80a000,484,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80a200,622,"CEntryStub"
+code-creation,Stub,2,0x2b80a480,540,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,13,0x2b80a6a0,116,"CompareICStub"
+code-creation,Stub,2,0x2b80a720,1428,"RecordWriteStub"
+code-creation,Stub,2,0x2b80acc0,97,"StoreBufferOverflowStub"
+code-creation,Stub,2,0x2b80ad40,611,"RecordWriteStub"
+code-creation,Stub,2,0x2b80afc0,76,"InterruptStub"
+code-creation,Stub,13,0x2b80b020,104,"CompareICStub"
+code-creation,Stub,2,0x2b80b0a0,130,"ArgumentsAccessStub"
+code-creation,Stub,2,0x2b80b140,160,"FastNewContextStub"
+code-creation,Stub,2,0x2b80b1e0,79,"StubFailureTrampolineStub"
+code-creation,Stub,2,0x2b80b240,704,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,14,0x2b80b500,93,"CompareNilICStub"
+code-creation,Stub,2,0x2b80b560,289,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80b6a0,664,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80b940,740,"NameDictionaryLookupStub"
+code-creation,Stub,13,0x2b80bc40,156,"CompareICStub"
+code-creation,Stub,2,0x2b80bce0,611,"RecordWriteStub"
+code-creation,Stub,13,0x2b80bf60,122,"CompareICStub"
+code-creation,Stub,2,0x2b80bfe0,217,"CreateAllocationSiteStub"
+code-creation,Stub,2,0x2b80c0c0,1456,"RecordWriteStub"
+code-creation,Stub,2,0x2b80c680,245,"StoreArrayLiteralElementStub"
+code-creation,Stub,2,0x2b80c780,1448,"RecordWriteStub"
+code-creation,Stub,2,0x2b80cd40,1471,"StringAddStub"
+code-creation,Stub,2,0x2b80d300,1448,"RecordWriteStub"
+code-creation,Stub,2,0x2b80d8c0,1453,"RecordWriteStub"
+code-creation,Stub,12,0x2b80de80,146,"BinaryOpStub"
+code-creation,Stub,2,0x2b80df20,640,"InternalArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e1a0,517,"ArrayConstructorStub"
+code-creation,Stub,2,0x2b80e3c0,305,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e500,305,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e640,349,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e7a0,349,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e900,289,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80ea40,680,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80ed00,692,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80efc0,704,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80f280,664,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80f520,488,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80f720,540,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80f940,432,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80fb00,432,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80fcc0,1453,"RecordWriteStub"
+code-creation,Stub,2,0x2b810280,400,"InternalArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b810420,611,"RecordWriteStub"
+code-creation,Stub,2,0x2b8106a0,213,"JSEntryStub"
+code-creation,Stub,13,0x2b810780,104,"CompareICStub"
+code-creation,Stub,12,0x2b810800,124,"BinaryOpStub"
+code-creation,Stub,2,0x2b810880,1447,"StringAddStub"
+code-creation,Stub,2,0x2b810e40,640,"InternalArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b8110c0,400,"InternalArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b811260,261,"FastCloneShallowArrayStub"
+code-creation,Stub,12,0x2b811380,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b8113e0,76,"StackCheckStub"
+code-creation,Stub,2,0x2b811440,1437,"RecordWriteStub"
+code-creation,Stub,2,0x2b8119e0,289,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b811b20,331,"CallFunctionStub"
+code-creation,Builtin,3,0x2b811c80,174,"A builtin from the snapshot"
+code-creation,Stub,14,0x2b811d40,124,"CompareNilICStub"
+code-creation,Stub,2,0x2b811dc0,1420,"RecordWriteStub"
+code-creation,Stub,13,0x2b812360,104,"CompareICStub"
+code-creation,Stub,2,0x2b8123e0,76,"LoadFieldStub"
+code-creation,Stub,13,0x2b812440,104,"CompareICStub"
+code-creation,Stub,2,0x2b8124c0,195,"NumberToStringStub"
+code-creation,Stub,15,0x2b8125a0,148,"ToBooleanStub"
+code-creation,Stub,2,0x2b812640,351,"ArgumentsAccessStub"
+code-creation,Stub,2,0x2b8127a0,664,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b812a40,1420,"RecordWriteStub"
+code-creation,Stub,12,0x2b812fe0,133,"BinaryOpStub"
+code-creation,Stub,2,0x2b813080,1664,"StringAddStub"
+code-creation,Stub,2,0x2b813700,1661,"StringAddStub"
+code-creation,Stub,2,0x2b813d80,472,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b813f60,80,"StubFailureTrampolineStub"
+code-creation,Stub,13,0x2b813fc0,104,"CompareICStub"
+code-creation,Stub,2,0x2b814040,331,"CallFunctionStub"
+code-creation,Stub,2,0x2b8141a0,660,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b814440,1433,"RecordWriteStub"
+code-creation,Stub,12,0x2b8149e0,146,"BinaryOpStub"
+code-creation,Stub,2,0x2b814a80,271,"CallConstructStub"
+code-creation,Stub,15,0x2b814ba0,136,"ToBooleanStub"
+code-creation,Stub,2,0x2b814c40,468,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,15,0x2b814e20,128,"ToBooleanStub"
+code-creation,Stub,2,0x2b814ea0,163,"FastNewContextStub"
+code-creation,Stub,2,0x2b814f60,1425,"RecordWriteStub"
+code-creation,LoadIC,5,0x2b815500,145,"A load IC from the snapshot"
+code-creation,Builtin,3,0x2b8155a0,83,"A builtin from the snapshot"
+code-creation,Stub,12,0x2b815600,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b815660,1433,"RecordWriteStub"
+code-creation,Stub,2,0x2b815c00,331,"CallFunctionStub"
+code-creation,Stub,13,0x2b815d60,104,"CompareICStub"
+code-creation,Stub,2,0x2b815de0,304,"FastNewClosureStub"
+code-creation,Stub,2,0x2b815f20,285,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b816040,1433,"RecordWriteStub"
+code-creation,Stub,2,0x2b8165e0,233,"InternalArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b8166e0,740,"NameDictionaryLookupStub"
+code-creation,Stub,2,0x2b8169e0,740,"NameDictionaryLookupStub"
+code-creation,Stub,12,0x2b816ce0,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b816d40,216,"StringCompareStub"
+code-creation,Stub,15,0x2b816e20,93,"ToBooleanStub"
+code-creation,Stub,12,0x2b816e80,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b816ee0,1433,"RecordWriteStub"
+code-creation,Stub,12,0x2b817480,155,"BinaryOpStub"
+code-creation,Stub,2,0x2b817520,169,"InternalArrayConstructorStub"
+code-creation,Stub,2,0x2b8175e0,233,"InternalArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b8176e0,1433,"RecordWriteStub"
+code-creation,Stub,12,0x2b817c80,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b817ce0,328,"KeyedLoadElementStub"
+code-creation,Stub,2,0x2b817e40,1461,"RecordWriteStub"
+code-creation,Stub,2,0x2b818400,98,"ToNumberStub"
+code-creation,Stub,13,0x2b818480,122,"CompareICStub"
+code-creation,Stub,12,0x2b818500,124,"BinaryOpStub"
+code-creation,Stub,2,0x2b818580,148,"CallConstructStub"
+code-creation,Stub,13,0x2b818620,491,"CompareICStub"
+code-creation,Stub,2,0x2b818820,213,"JSEntryStub"
+code-creation,CallIC,7,0x2b818900,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8189c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818a80,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818b40,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818c00,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818cc0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818d80,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818e40,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818f00,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818fc0,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819080,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819140,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819200,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8192c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819380,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819440,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819500,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8195c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819680,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819740,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819800,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8198c0,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819980,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819a40,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819b00,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819bc0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819c80,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819d40,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819e00,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819ec0,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819f80,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a040,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a100,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a1c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a280,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a340,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a400,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a4c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a580,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a640,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a700,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a7c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a880,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a940,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81aa00,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81aac0,180,"A call IC from the snapshot"
+code-creation,Builtin,3,0x2b81ab80,107,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81ac00,105,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81ac80,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81ace0,432,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81afc0,101,"A builtin from the snapshot"
+code-creation,LoadIC,5,0x2b81b1a0,83,"A load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b81bf00,83,"A keyed load IC from the snapshot"
+code-creation,StoreIC,9,0x2b81c680,84,"A store IC from the snapshot"
+code-creation,Builtin,3,0x2b8262e0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826340,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8263a0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826400,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826460,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8264c0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826520,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826580,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8265e0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826640,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8266a0,80,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826700,80,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826760,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8267c0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826820,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826880,75,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8268e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826960,491,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826b60,406,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826d00,157,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826da0,131,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826e40,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826ec0,107,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826f40,143,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826fe0,143,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827080,143,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827120,94,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827180,91,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8271e0,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827240,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8272a0,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827300,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827360,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8273c0,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827420,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827480,84,"A builtin from the snapshot"
+code-creation,LoadIC,5,0x2b8274e0,83,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b827540,313,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b827680,266,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b8277a0,80,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b827800,83,"A load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827860,83,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b8278c0,896,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827c40,499,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827e40,144,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827ee0,216,"A keyed load IC from the snapshot"
+code-creation,StoreIC,9,0x2b827fc0,365,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828140,293,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828280,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b8282e0,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828340,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b8283a0,84,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828400,365,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828580,293,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b8286c0,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828720,82,"A store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b828780,84,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b8287e0,2082,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b829020,84,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b829080,2082,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b8298c0,286,"A keyed store IC from the snapshot"
+code-creation,Builtin,3,0x2b8299e0,355,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b829b60,416,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b829d00,376,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b829e80,388,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a020,78,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a080,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a0e0,357,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a260,359,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a3e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a460,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a4e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a560,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a5e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a660,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a6e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a760,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a7e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a860,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a8e0,104,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a960,106,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a9e0,110,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82aa60,112,"A builtin from the snapshot"
+code-creation,LoadIC,5,0x2b82aae0,106,"A load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b82ab60,106,"A keyed load IC from the snapshot"
+code-creation,StoreIC,9,0x2b82abe0,108,"A store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b82ac60,108,"A keyed store IC from the snapshot"
+code-creation,Stub,14,0x2b82ace0,104,"CallFunctionStub"
+code-creation,Builtin,3,0x2b82ad60,65,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82adc0,93,"A builtin from the snapshot"
+timer-event-start,"V8.GCCompactor",6301
+timer-event-start,"V8.External",6312
+timer-event-end,"V8.External",6321
+timer-event-start,"V8.External",7418
+timer-event-end,"V8.External",7436
+timer-event-end,"V8.GCCompactor",7446
+code-creation,LazyCompile,3,0x2b81ac80,77,"Empty :1",0x4420e5cc,
+code-creation,LazyCompile,0,0x2b81aea0,264," native uri.js:1",0x4420e668,
+code-creation,LazyCompile,0,0x2b81b040,336,"SetUpUri native uri.js:442",0x4420f5b4,
+code-creation,LazyCompile,0,0x2b81b200,1880," native messages.js:1",0x4420f670,
+code-creation,LazyCompile,0,0x2b81b960,1429,"FormatString native messages.js:187",0x4420f918,
+code-creation,LazyCompile,0,0x2b81bf60,280,"MakeGenericError native messages.js:282",0x44211088,
+code-creation,LazyCompile,0,0x2b81c080,264,"FormatMessage native messages.js:301",0x4421113c,
+code-creation,LazyCompile,0,0x2b81c1a0,200,"MakeRangeError native messages.js:335",0x442112f0,
+code-creation,LazyCompile,0,0x2b81c280,1012,"captureStackTrace native messages.js:1123",0x44212280,
+code-creation,LazyCompile,0,0x2b81c6e0,460,"SetUpError native messages.js:1173",0x44212410,
+code-creation,LazyCompile,0,0x2b81c8c0,692,"SetUpError.a native messages.js:1176",0x442124c0,
+code-creation,LazyCompile,0,0x2b81cb80,164,"d native messages.js:1192",0x44212548,
+code-creation,LazyCompile,0,0x2b81cc40,360," native messages.js:1202",0x442125d0,
+code-creation,LazyCompile,0,0x2b81cc40,360,"Error",0x44212698,
+code-creation,LazyCompile,0,0x2b81cc40,360,"TypeError",0x442126f8,
+code-creation,LazyCompile,0,0x2b81cc40,360,"RangeError",0x44212758,
+code-creation,LazyCompile,0,0x2b81cc40,360,"SyntaxError",0x442127b8,
+code-creation,LazyCompile,0,0x2b81cc40,360,"ReferenceError",0x44212818,
+code-creation,LazyCompile,0,0x2b81cc40,360,"EvalError",0x44212878,
+code-creation,LazyCompile,0,0x2b81cc40,360,"URIError",0x442128d8,
+code-creation,LazyCompile,0,0x2b81cdc0,424,"SetUpStackOverflowBoilerplate native messages.js:1301",0x44212a74,
+code-creation,LazyCompile,0,0x2b81cf80,216," native messages.js:294",0x44214b3c,
+code-creation,LazyCompile,0,0x2b81d060,408," native string.js:1",0x44214c2c,
+code-creation,LazyCompile,0,0x2b81d200,380,"StringConstructor native string.js:35",0x44214e2c,
+code-creation,LazyCompile,0,0x2b81d380,1132,"SetUpString native string.js:962",0x44216ea8,
+code-creation,LazyCompile,0,0x2b81d800,616," native date.js:1",0x44216fa0,
+code-creation,LazyCompile,0,0x2b81da80,1392,"DateConstructor native date.js:141",0x442182bc,
+code-creation,LazyCompile,0,0x2b81e000,1396,"SetUpDate native date.js:761",0x44219944,
+code-creation,LazyCompile,0,0x2b81e580,268," native array.js:1",0x44219b20,
+code-creation,LazyCompile,0,0x2b81e6a0,2272,"SetUpArray native array.js:1591",0x4421c6ac,
+code-creation,LazyCompile,0,0x2b81ef80,292,"SetUpArray.b native array.js:1605",0x4421c814,
+code-creation,LazyCompile,0,0x2b81f0c0,1084," native v8natives.js:1",0x4421c904,
+code-creation,LazyCompile,0,0x2b81f500,561,"InstallFunctions native v8natives.js:46",0x4421cc1c,
+code-creation,LazyCompile,0,0x2b81f740,304,"InstallGetterSetter native v8natives.js:72",0x4421ea1c,
+code-creation,LazyCompile,0,0x2b81f880,814,"SetUpLockedPrototype native v8natives.js:87",0x4421eab4,
+code-creation,LazyCompile,0,0x2b81fbc0,452,"SetUpGlobal native v8natives.js:197",0x4421ed3c,
+code-creation,LazyCompile,0,0x2b81fda0,404,"hasOwnProperty native v8natives.js:251",0x4421eee4,
+code-creation,LazyCompile,0,0x2b81ff40,308,"ObjectConstructor native v8natives.js:1371",0x442200b4,
+code-creation,LazyCompile,0,0x2b820080,1044,"SetUpObject native v8natives.js:1385",0x44220140,
+code-creation,LazyCompile,0,0x2b8204a0,292,"BooleanConstructor native v8natives.js:1437",0x442201c8,
+code-creation,LazyCompile,0,0x2b8205e0,448,"SetUpBoolean native v8natives.js:1472",0x44220314,
+code-creation,LazyCompile,0,0x2b8207a0,336,"NumberConstructor native v8natives.js:1491",0x442203ac,
+code-creation,LazyCompile,0,0x2b820900,924,"SetUpNumber native v8natives.js:1635",0x4422073c,
+code-creation,LazyCompile,0,0x2b820ca0,440,"FunctionConstructor native v8natives.js:1813",0x44220954,
+code-creation,LazyCompile,0,0x2b820e60,380,"SetUpFunction native v8natives.js:1826",0x442209f8,
+code-creation,LazyCompile,0,0x2b820fe0,264," native json.js:1",0x44221238,
+code-creation,LazyCompile,0,0x2b821100,260,"SetUpJSON native json.js:219",0x44221940,
+code-creation,LazyCompile,0,0x2b821220,340," native math.js:1",0x44221a5c,
+code-creation,LazyCompile,0,0x2b821380,164,"MathConstructor native math.js:40",0x44221ba4,
+code-creation,LazyCompile,0,0x2b821440,1112,"SetUpMath native math.js:226",0x4422283c,
+code-creation,LazyCompile,0,0x2b8218a0,404," native regexp.js:1",0x442228f8,
+code-creation,LazyCompile,0,0x2b821a40,324,"RegExpConstructor native regexp.js:90",0x44223264,
+code-creation,LazyCompile,0,0x2b821ba0,224,"RegExpMakeCaptureGetter native regexp.js:360",0x44223784,
+code-creation,LazyCompile,0,0x2b821c80,1561,"SetUpRegExp native regexp.js:400",0x44223878,
+code-creation,LazyCompile,0,0x2b8222a0,280," native apinatives.js:1",0x44223b98,
+code-creation,LazyCompile,0,0x2b8223c0,612," native runtime.js:1",0x44223e30,
+code-creation,LazyCompile,0,0x2b822640,1728,"EQUALS native runtime.js:54",0x44224078,
+code-creation,LazyCompile,0,0x2b822d00,376,"STRICT_EQUALS native runtime.js:108",0x44224c18,
+code-creation,LazyCompile,0,0x2b822e80,924,"COMPARE native runtime.js:128",0x44224ca4,
+code-creation,LazyCompile,0,0x2b823220,596,"ADD native runtime.js:171",0x44224d44,
+code-creation,LazyCompile,0,0x2b823480,572,"STRING_ADD_LEFT native runtime.js:191",0x44224dd8,
+code-creation,LazyCompile,0,0x2b8236c0,580,"STRING_ADD_RIGHT native runtime.js:206",0x44224e64,
+code-creation,LazyCompile,0,0x2b823920,296,"SUB native runtime.js:222",0x44224ef4,
+code-creation,LazyCompile,0,0x2b823a60,296,"MUL native runtime.js:230",0x44224f84,
+code-creation,LazyCompile,0,0x2b823ba0,296,"DIV native runtime.js:238",0x44225014,
+code-creation,LazyCompile,0,0x2b823ce0,296,"MOD native runtime.js:246",0x442250a4,
+code-creation,LazyCompile,0,0x2b823e20,296,"BIT_OR native runtime.js:260",0x44225134,
+code-creation,LazyCompile,0,0x2b823f60,384,"BIT_AND native runtime.js:268",0x442251c4,
+code-creation,LazyCompile,0,0x2b8240e0,296,"BIT_XOR native runtime.js:290",0x44225254,
+code-creation,LazyCompile,0,0x2b824220,244,"UNARY_MINUS native runtime.js:298",0x442252e4,
+code-creation,LazyCompile,0,0x2b824320,244,"BIT_NOT native runtime.js:305",0x44225370,
+code-creation,LazyCompile,0,0x2b824420,296,"SHL native runtime.js:312",0x442253fc,
+code-creation,LazyCompile,0,0x2b824560,384,"SAR native runtime.js:320",0x4422548c,
+code-creation,LazyCompile,0,0x2b8246e0,296,"SHR native runtime.js:342",0x4422551c,
+code-creation,LazyCompile,0,0x2b824820,228,"DELETE native runtime.js:356",0x442255ac,
+code-creation,LazyCompile,0,0x2b824920,368,"IN native runtime.js:362",0x4422563c,
+code-creation,LazyCompile,0,0x2b824aa0,644,"INSTANCE_OF native runtime.js:375",0x442256e8,
+code-creation,LazyCompile,0,0x2b824d40,236,"FILTER_KEY native runtime.js:406",0x442257b8,
+code-creation,LazyCompile,0,0x2b824e40,380,"CALL_NON_FUNCTION native runtime.js:413",0x44225848,
+code-creation,LazyCompile,0,0x2b824fc0,380,"CALL_NON_FUNCTION_AS_CONSTRUCTOR native runtime.js:422",0x442258f4,
+code-creation,LazyCompile,0,0x2b825140,288,"CALL_FUNCTION_PROXY native runtime.js:431",0x442259a0,
+code-creation,LazyCompile,0,0x2b825260,260,"CALL_FUNCTION_PROXY_AS_CONSTRUCTOR native runtime.js:439",0x44225a38,
+code-creation,LazyCompile,0,0x2b825380,912,"APPLY_PREPARE native runtime.js:446",0x44225acc,
+code-creation,LazyCompile,0,0x2b825720,232,"APPLY_OVERFLOW native runtime.js:484",0x44225b9c,
+code-creation,LazyCompile,0,0x2b825820,188,"TO_OBJECT native runtime.js:490",0x44225c38,
+code-creation,LazyCompile,0,0x2b8258e0,188,"TO_NUMBER native runtime.js:496",0x44225cc0,
+code-creation,LazyCompile,0,0x2b8259a0,188,"TO_STRING native runtime.js:502",0x44225d48,
+code-creation,LazyCompile,0,0x2b825a60,600,"ToPrimitive native runtime.js:514",0x44225dd0,
+code-creation,LazyCompile,0,0x2b825cc0,404,"ToBoolean native runtime.js:526",0x44225e60,
+code-creation,LazyCompile,0,0x2b825e60,504,"ToNumber native runtime.js:536",0x44225eec,
+code-creation,LazyCompile,0,0x2b826060,416,"ToString native runtime.js:561",0x44225fd8,
+code-creation,LazyCompile,0,0x2b826200,220,"ToName native runtime.js:578",0x442260c4,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227108,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227168,
+code-creation,LazyCompile,3,0x2b8262e0,77,"OpaqueReference",0x442271c8,
+code-creation,LazyCompile,3,0x2b8262e0,77,"JSON",0x44227228,
+code-creation,LazyCompile,0,0x2b8204a0,292,"Boolean",0x44227288,
+code-creation,LazyCompile,3,0x2b82a080,83,"Array",0x442272e8,
+code-creation,LazyCompile,3,0x2b826460,77,"pop",0x44227348,
+code-creation,LazyCompile,3,0x2b826400,77,"push",0x442273a8,
+code-creation,LazyCompile,3,0x2b826640,77,"concat",0x44227408,
+code-creation,LazyCompile,3,0x2b8264c0,77,"shift",0x44227468,
+code-creation,LazyCompile,3,0x2b826520,77,"unshift",0x442274c8,
+code-creation,LazyCompile,3,0x2b826580,77,"slice",0x44227528,
+code-creation,LazyCompile,3,0x2b8265e0,77,"splice",0x44227588,
+code-creation,LazyCompile,0,0x2b8207a0,336,"Number",0x442275e8,
+code-creation,LazyCompile,3,0x2b82a020,78,"InternalArray",0x44227648,
+code-creation,LazyCompile,3,0x2b82a020,78,"InternalPackedArray",0x442276b4,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227714,
+code-creation,LazyCompile,0,0x2b821a40,324,"RegExp",0x44227774,
+code-creation,LazyCompile,0,0x2b81da80,1392,"Date",0x442277d4,
+code-creation,LazyCompile,0,0x2b820ca0,440,"Function",0x44227834,
+code-creation,LazyCompile,0,0x2b81d200,380,"String",0x44227894,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x442278f4,
+code-creation,LazyCompile,0,0x2b81cf80,216,"Script",0x44227960,
+code-creation,LazyCompile,0,0x2b81ff40,308,"Object",0x44227a00,
+code-creation,LazyCompile,3,0x2b829d00,376,"call",0x44227a60,
+code-creation,LazyCompile,3,0x2b829e80,388,"apply",0x44227ac0,
+code-creation,LazyCompile,3,0x2b8262e0,77,"Arguments",0x44227b20,
+code-creation,LazyCompile,3,0x2b826820,77,"ThrowTypeError",0x44227b80,
+code-creation,LazyCompile,3,0x2b826760,77,"",0x44227be0,
+code-creation,LazyCompile,3,0x2b8267c0,77,"",0x44227c40,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227ca0,
+timer-event-start,"V8.GCCompactor",9350
+timer-event-start,"V8.External",9362
+timer-event-end,"V8.External",9370
+timer-event-start,"V8.External",10477
+timer-event-end,"V8.External",10500
+timer-event-end,"V8.GCCompactor",10511
+code-creation,Stub,2,0x2b80a000,484,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80a200,622,"CEntryStub"
+code-creation,Stub,2,0x2b80a480,540,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,13,0x2b80a6a0,116,"CompareICStub"
+code-creation,Stub,2,0x2b80a720,1428,"RecordWriteStub"
+code-creation,Stub,2,0x2b80acc0,97,"StoreBufferOverflowStub"
+code-creation,Stub,2,0x2b80ad40,611,"RecordWriteStub"
+code-creation,Stub,2,0x2b80afc0,76,"InterruptStub"
+code-creation,Stub,13,0x2b80b020,104,"CompareICStub"
+code-creation,Stub,2,0x2b80b0a0,130,"ArgumentsAccessStub"
+code-creation,Stub,2,0x2b80b140,160,"FastNewContextStub"
+code-creation,Stub,2,0x2b80b1e0,79,"StubFailureTrampolineStub"
+code-creation,Stub,2,0x2b80b240,704,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,14,0x2b80b500,93,"CompareNilICStub"
+code-creation,Stub,2,0x2b80b560,289,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80b6a0,664,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80b940,740,"NameDictionaryLookupStub"
+code-creation,Stub,13,0x2b80bc40,156,"CompareICStub"
+code-creation,Stub,2,0x2b80bce0,611,"RecordWriteStub"
+code-creation,Stub,13,0x2b80bf60,122,"CompareICStub"
+code-creation,Stub,2,0x2b80bfe0,217,"CreateAllocationSiteStub"
+code-creation,Stub,2,0x2b80c0c0,1456,"RecordWriteStub"
+code-creation,Stub,2,0x2b80c680,245,"StoreArrayLiteralElementStub"
+code-creation,Stub,2,0x2b80c780,1448,"RecordWriteStub"
+code-creation,Stub,2,0x2b80cd40,1471,"StringAddStub"
+code-creation,Stub,2,0x2b80d300,1448,"RecordWriteStub"
+code-creation,Stub,2,0x2b80d8c0,1453,"RecordWriteStub"
+code-creation,Stub,12,0x2b80de80,146,"BinaryOpStub"
+code-creation,Stub,2,0x2b80df20,640,"InternalArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e1a0,517,"ArrayConstructorStub"
+code-creation,Stub,2,0x2b80e3c0,305,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e500,305,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e640,349,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e7a0,349,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80e900,289,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b80ea40,680,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80ed00,692,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80efc0,704,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80f280,664,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b80f520,488,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80f720,540,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80f940,432,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80fb00,432,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b80fcc0,1453,"RecordWriteStub"
+code-creation,Stub,2,0x2b810280,400,"InternalArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b810420,611,"RecordWriteStub"
+code-creation,Stub,2,0x2b8106a0,213,"JSEntryStub"
+code-creation,Stub,13,0x2b810780,104,"CompareICStub"
+code-creation,Stub,12,0x2b810800,124,"BinaryOpStub"
+code-creation,Stub,2,0x2b810880,1447,"StringAddStub"
+code-creation,Stub,2,0x2b810e40,640,"InternalArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b8110c0,400,"InternalArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b811260,261,"FastCloneShallowArrayStub"
+code-creation,Stub,12,0x2b811380,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b8113e0,76,"StackCheckStub"
+code-creation,Stub,2,0x2b811440,1437,"RecordWriteStub"
+code-creation,Stub,2,0x2b8119e0,289,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b811b20,331,"CallFunctionStub"
+code-creation,Builtin,3,0x2b811c80,174,"A builtin from the snapshot"
+code-creation,Stub,14,0x2b811d40,124,"CompareNilICStub"
+code-creation,Stub,2,0x2b811dc0,1420,"RecordWriteStub"
+code-creation,Stub,13,0x2b812360,104,"CompareICStub"
+code-creation,Stub,2,0x2b8123e0,76,"LoadFieldStub"
+code-creation,Stub,13,0x2b812440,104,"CompareICStub"
+code-creation,Stub,2,0x2b8124c0,195,"NumberToStringStub"
+code-creation,Stub,15,0x2b8125a0,148,"ToBooleanStub"
+code-creation,Stub,2,0x2b812640,351,"ArgumentsAccessStub"
+code-creation,Stub,2,0x2b8127a0,664,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b812a40,1420,"RecordWriteStub"
+code-creation,Stub,12,0x2b812fe0,133,"BinaryOpStub"
+code-creation,Stub,2,0x2b813080,1664,"StringAddStub"
+code-creation,Stub,2,0x2b813700,1661,"StringAddStub"
+code-creation,Stub,2,0x2b813d80,472,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,2,0x2b813f60,80,"StubFailureTrampolineStub"
+code-creation,Stub,13,0x2b813fc0,104,"CompareICStub"
+code-creation,Stub,2,0x2b814040,331,"CallFunctionStub"
+code-creation,Stub,2,0x2b8141a0,660,"ArraySingleArgumentConstructorStub"
+code-creation,Stub,2,0x2b814440,1433,"RecordWriteStub"
+code-creation,Stub,12,0x2b8149e0,146,"BinaryOpStub"
+code-creation,Stub,2,0x2b814a80,271,"CallConstructStub"
+code-creation,Stub,15,0x2b814ba0,136,"ToBooleanStub"
+code-creation,Stub,2,0x2b814c40,468,"ArrayNArgumentsConstructorStub"
+code-creation,Stub,15,0x2b814e20,128,"ToBooleanStub"
+code-creation,Stub,2,0x2b814ea0,163,"FastNewContextStub"
+code-creation,Stub,2,0x2b814f60,1425,"RecordWriteStub"
+code-creation,LoadIC,5,0x2b815500,145,"A load IC from the snapshot"
+code-creation,Builtin,3,0x2b8155a0,83,"A builtin from the snapshot"
+code-creation,Stub,12,0x2b815600,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b815660,1433,"RecordWriteStub"
+code-creation,Stub,2,0x2b815c00,331,"CallFunctionStub"
+code-creation,Stub,13,0x2b815d60,104,"CompareICStub"
+code-creation,Stub,2,0x2b815de0,304,"FastNewClosureStub"
+code-creation,Stub,2,0x2b815f20,285,"ArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b816040,1433,"RecordWriteStub"
+code-creation,Stub,2,0x2b8165e0,233,"InternalArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b8166e0,740,"NameDictionaryLookupStub"
+code-creation,Stub,2,0x2b8169e0,740,"NameDictionaryLookupStub"
+code-creation,Stub,12,0x2b816ce0,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b816d40,216,"StringCompareStub"
+code-creation,Stub,15,0x2b816e20,93,"ToBooleanStub"
+code-creation,Stub,12,0x2b816e80,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b816ee0,1433,"RecordWriteStub"
+code-creation,Stub,12,0x2b817480,155,"BinaryOpStub"
+code-creation,Stub,2,0x2b817520,169,"InternalArrayConstructorStub"
+code-creation,Stub,2,0x2b8175e0,233,"InternalArrayNoArgumentConstructorStub"
+code-creation,Stub,2,0x2b8176e0,1433,"RecordWriteStub"
+code-creation,Stub,12,0x2b817c80,88,"BinaryOpStub"
+code-creation,Stub,2,0x2b817ce0,328,"KeyedLoadElementStub"
+code-creation,Stub,2,0x2b817e40,1461,"RecordWriteStub"
+code-creation,Stub,2,0x2b818400,98,"ToNumberStub"
+code-creation,Stub,13,0x2b818480,122,"CompareICStub"
+code-creation,Stub,12,0x2b818500,124,"BinaryOpStub"
+code-creation,Stub,2,0x2b818580,148,"CallConstructStub"
+code-creation,Stub,13,0x2b818620,491,"CompareICStub"
+code-creation,Stub,2,0x2b818820,213,"JSEntryStub"
+code-creation,CallIC,7,0x2b818900,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8189c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818a80,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818b40,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818c00,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818cc0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818d80,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818e40,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818f00,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b818fc0,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819080,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819140,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819200,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8192c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819380,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819440,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819500,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8195c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819680,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819740,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819800,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b8198c0,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819980,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819a40,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819b00,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819bc0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819c80,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819d40,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819e00,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819ec0,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b819f80,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a040,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a100,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a1c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a280,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a340,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a400,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a4c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a580,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a640,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a700,189,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a7c0,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a880,178,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81a940,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81aa00,180,"A call IC from the snapshot"
+code-creation,CallIC,7,0x2b81aac0,180,"A call IC from the snapshot"
+code-creation,Builtin,3,0x2b81ab80,107,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81ac00,105,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81ac80,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81ace0,432,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b81afc0,101,"A builtin from the snapshot"
+code-creation,LoadIC,5,0x2b81b1a0,83,"A load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b81bf00,83,"A keyed load IC from the snapshot"
+code-creation,StoreIC,9,0x2b81c680,84,"A store IC from the snapshot"
+code-creation,Builtin,3,0x2b8262e0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826340,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8263a0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826400,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826460,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8264c0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826520,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826580,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8265e0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826640,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8266a0,80,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826700,80,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826760,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8267c0,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826820,77,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826880,75,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8268e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826960,491,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826b60,406,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826d00,157,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826da0,131,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826e40,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826ec0,107,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826f40,143,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b826fe0,143,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827080,143,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827120,94,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827180,91,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8271e0,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827240,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8272a0,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827300,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827360,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b8273c0,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827420,84,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b827480,84,"A builtin from the snapshot"
+code-creation,LoadIC,5,0x2b8274e0,83,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b827540,313,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b827680,266,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b8277a0,80,"A load IC from the snapshot"
+code-creation,LoadIC,5,0x2b827800,83,"A load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827860,83,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b8278c0,896,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827c40,499,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827e40,144,"A keyed load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b827ee0,216,"A keyed load IC from the snapshot"
+code-creation,StoreIC,9,0x2b827fc0,365,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828140,293,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828280,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b8282e0,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828340,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b8283a0,84,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828400,365,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828580,293,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b8286c0,88,"A store IC from the snapshot"
+code-creation,StoreIC,9,0x2b828720,82,"A store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b828780,84,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b8287e0,2082,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b829020,84,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b829080,2082,"A keyed store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b8298c0,286,"A keyed store IC from the snapshot"
+code-creation,Builtin,3,0x2b8299e0,355,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b829b60,416,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b829d00,376,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b829e80,388,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a020,78,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a080,83,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a0e0,357,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a260,359,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a3e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a460,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a4e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a560,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a5e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a660,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a6e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a760,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a7e0,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a860,101,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a8e0,104,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a960,106,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82a9e0,110,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82aa60,112,"A builtin from the snapshot"
+code-creation,LoadIC,5,0x2b82aae0,106,"A load IC from the snapshot"
+code-creation,KeyedLoadIC,6,0x2b82ab60,106,"A keyed load IC from the snapshot"
+code-creation,StoreIC,9,0x2b82abe0,108,"A store IC from the snapshot"
+code-creation,KeyedStoreIC,10,0x2b82ac60,108,"A keyed store IC from the snapshot"
+code-creation,Stub,14,0x2b82ace0,104,"CallFunctionStub"
+code-creation,Builtin,3,0x2b82ad60,65,"A builtin from the snapshot"
+code-creation,Builtin,3,0x2b82adc0,93,"A builtin from the snapshot"
+timer-event-start,"V8.GCCompactor",12962
+timer-event-start,"V8.External",12972
+timer-event-end,"V8.External",12981
+timer-event-start,"V8.External",13996
+timer-event-end,"V8.External",14014
+timer-event-end,"V8.GCCompactor",14024
+code-creation,LazyCompile,3,0x2b81ac80,77,"Empty :1",0x4420e5cc,
+code-creation,LazyCompile,0,0x2b81b040,336,"SetUpUri native uri.js:442",0x4420f5b4,
+code-creation,LazyCompile,0,0x2b81b960,1429,"FormatString native messages.js:187",0x4420f918,
+code-creation,LazyCompile,0,0x2b81bf60,280,"MakeGenericError native messages.js:282",0x44211088,
+code-creation,LazyCompile,0,0x2b81c080,264,"FormatMessage native messages.js:301",0x4421113c,
+code-creation,LazyCompile,0,0x2b81c1a0,200,"MakeRangeError native messages.js:335",0x442112f0,
+code-creation,LazyCompile,0,0x2b81c280,1012,"captureStackTrace native messages.js:1123",0x44212280,
+code-creation,LazyCompile,0,0x2b81c6e0,460,"SetUpError native messages.js:1173",0x44212410,
+code-creation,LazyCompile,0,0x2b81c8c0,692,"SetUpError.a native messages.js:1176",0x442124c0,
+code-creation,LazyCompile,0,0x2b81cb80,164,"d native messages.js:1192",0x44212548,
+code-creation,LazyCompile,0,0x2b81cc40,360," native messages.js:1202",0x442125d0,
+code-creation,LazyCompile,0,0x2b81cc40,360,"Error",0x44212698,
+code-creation,LazyCompile,0,0x2b81cc40,360,"TypeError",0x442126f8,
+code-creation,LazyCompile,0,0x2b81cc40,360,"RangeError",0x44212758,
+code-creation,LazyCompile,0,0x2b81cc40,360,"SyntaxError",0x442127b8,
+code-creation,LazyCompile,0,0x2b81cc40,360,"ReferenceError",0x44212818,
+code-creation,LazyCompile,0,0x2b81cc40,360,"EvalError",0x44212878,
+code-creation,LazyCompile,0,0x2b81cc40,360,"URIError",0x442128d8,
+code-creation,LazyCompile,0,0x2b81cdc0,424,"SetUpStackOverflowBoilerplate native messages.js:1301",0x44212a74,
+code-creation,LazyCompile,0,0x2b81d200,380,"StringConstructor native string.js:35",0x44214e2c,
+code-creation,LazyCompile,0,0x2b81d380,1132,"SetUpString native string.js:962",0x44216ea8,
+code-creation,LazyCompile,0,0x2b81da80,1392,"DateConstructor native date.js:141",0x442182bc,
+code-creation,LazyCompile,0,0x2b81e000,1396,"SetUpDate native date.js:761",0x44219944,
+code-creation,LazyCompile,0,0x2b81e6a0,2272,"SetUpArray native array.js:1591",0x4421c6ac,
+code-creation,LazyCompile,0,0x2b81f500,561,"InstallFunctions native v8natives.js:46",0x4421cc1c,
+code-creation,LazyCompile,0,0x2b81f740,304,"InstallGetterSetter native v8natives.js:72",0x4421ea1c,
+code-creation,LazyCompile,0,0x2b81f880,814,"SetUpLockedPrototype native v8natives.js:87",0x4421eab4,
+code-creation,LazyCompile,0,0x2b81fbc0,452,"SetUpGlobal native v8natives.js:197",0x4421ed3c,
+code-creation,LazyCompile,0,0x2b81fda0,404,"hasOwnProperty native v8natives.js:251",0x4421eee4,
+code-creation,LazyCompile,0,0x2b81ff40,308,"ObjectConstructor native v8natives.js:1371",0x442200b4,
+code-creation,LazyCompile,0,0x2b820080,1044,"SetUpObject native v8natives.js:1385",0x44220140,
+code-creation,LazyCompile,0,0x2b8204a0,292,"BooleanConstructor native v8natives.js:1437",0x442201c8,
+code-creation,LazyCompile,0,0x2b8205e0,448,"SetUpBoolean native v8natives.js:1472",0x44220314,
+code-creation,LazyCompile,0,0x2b8207a0,336,"NumberConstructor native v8natives.js:1491",0x442203ac,
+code-creation,LazyCompile,0,0x2b820900,924,"SetUpNumber native v8natives.js:1635",0x4422073c,
+code-creation,LazyCompile,0,0x2b820ca0,440,"FunctionConstructor native v8natives.js:1813",0x44220954,
+code-creation,LazyCompile,0,0x2b820e60,380,"SetUpFunction native v8natives.js:1826",0x442209f8,
+code-creation,LazyCompile,0,0x2b821100,260,"SetUpJSON native json.js:219",0x44221940,
+code-creation,LazyCompile,0,0x2b821380,164,"MathConstructor native math.js:40",0x44221ba4,
+code-creation,LazyCompile,0,0x2b821440,1112,"SetUpMath native math.js:226",0x4422283c,
+code-creation,LazyCompile,0,0x2b821a40,324,"RegExpConstructor native regexp.js:90",0x44223264,
+code-creation,LazyCompile,0,0x2b821ba0,224,"RegExpMakeCaptureGetter native regexp.js:360",0x44223784,
+code-creation,LazyCompile,0,0x2b821c80,1561,"SetUpRegExp native regexp.js:400",0x44223878,
+code-creation,LazyCompile,0,0x2b822640,1728,"EQUALS native runtime.js:54",0x44224078,
+code-creation,LazyCompile,0,0x2b822d00,376,"STRICT_EQUALS native runtime.js:108",0x44224c18,
+code-creation,LazyCompile,0,0x2b822e80,924,"COMPARE native runtime.js:128",0x44224ca4,
+code-creation,LazyCompile,0,0x2b823220,596,"ADD native runtime.js:171",0x44224d44,
+code-creation,LazyCompile,0,0x2b823480,572,"STRING_ADD_LEFT native runtime.js:191",0x44224dd8,
+code-creation,LazyCompile,0,0x2b8236c0,580,"STRING_ADD_RIGHT native runtime.js:206",0x44224e64,
+code-creation,LazyCompile,0,0x2b823920,296,"SUB native runtime.js:222",0x44224ef4,
+code-creation,LazyCompile,0,0x2b823a60,296,"MUL native runtime.js:230",0x44224f84,
+code-creation,LazyCompile,0,0x2b823ba0,296,"DIV native runtime.js:238",0x44225014,
+code-creation,LazyCompile,0,0x2b823ce0,296,"MOD native runtime.js:246",0x442250a4,
+code-creation,LazyCompile,0,0x2b823e20,296,"BIT_OR native runtime.js:260",0x44225134,
+code-creation,LazyCompile,0,0x2b823f60,384,"BIT_AND native runtime.js:268",0x442251c4,
+code-creation,LazyCompile,0,0x2b8240e0,296,"BIT_XOR native runtime.js:290",0x44225254,
+code-creation,LazyCompile,0,0x2b824220,244,"UNARY_MINUS native runtime.js:298",0x442252e4,
+code-creation,LazyCompile,0,0x2b824320,244,"BIT_NOT native runtime.js:305",0x44225370,
+code-creation,LazyCompile,0,0x2b824420,296,"SHL native runtime.js:312",0x442253fc,
+code-creation,LazyCompile,0,0x2b824560,384,"SAR native runtime.js:320",0x4422548c,
+code-creation,LazyCompile,0,0x2b8246e0,296,"SHR native runtime.js:342",0x4422551c,
+code-creation,LazyCompile,0,0x2b824820,228,"DELETE native runtime.js:356",0x442255ac,
+code-creation,LazyCompile,0,0x2b824920,368,"IN native runtime.js:362",0x4422563c,
+code-creation,LazyCompile,0,0x2b824aa0,644,"INSTANCE_OF native runtime.js:375",0x442256e8,
+code-creation,LazyCompile,0,0x2b824d40,236,"FILTER_KEY native runtime.js:406",0x442257b8,
+code-creation,LazyCompile,0,0x2b824e40,380,"CALL_NON_FUNCTION native runtime.js:413",0x44225848,
+code-creation,LazyCompile,0,0x2b824fc0,380,"CALL_NON_FUNCTION_AS_CONSTRUCTOR native runtime.js:422",0x442258f4,
+code-creation,LazyCompile,0,0x2b825140,288,"CALL_FUNCTION_PROXY native runtime.js:431",0x442259a0,
+code-creation,LazyCompile,0,0x2b825260,260,"CALL_FUNCTION_PROXY_AS_CONSTRUCTOR native runtime.js:439",0x44225a38,
+code-creation,LazyCompile,0,0x2b825380,912,"APPLY_PREPARE native runtime.js:446",0x44225acc,
+code-creation,LazyCompile,0,0x2b825720,232,"APPLY_OVERFLOW native runtime.js:484",0x44225b9c,
+code-creation,LazyCompile,0,0x2b825820,188,"TO_OBJECT native runtime.js:490",0x44225c38,
+code-creation,LazyCompile,0,0x2b8258e0,188,"TO_NUMBER native runtime.js:496",0x44225cc0,
+code-creation,LazyCompile,0,0x2b8259a0,188,"TO_STRING native runtime.js:502",0x44225d48,
+code-creation,LazyCompile,0,0x2b825a60,600,"ToPrimitive native runtime.js:514",0x44225dd0,
+code-creation,LazyCompile,0,0x2b825cc0,404,"ToBoolean native runtime.js:526",0x44225e60,
+code-creation,LazyCompile,0,0x2b825e60,504,"ToNumber native runtime.js:536",0x44225eec,
+code-creation,LazyCompile,0,0x2b826060,416,"ToString native runtime.js:561",0x44225fd8,
+code-creation,LazyCompile,0,0x2b826200,220,"ToName native runtime.js:578",0x442260c4,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227108,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227168,
+code-creation,LazyCompile,3,0x2b8262e0,77,"OpaqueReference",0x442271c8,
+code-creation,LazyCompile,3,0x2b8262e0,77,"JSON",0x44227228,
+code-creation,LazyCompile,0,0x2b8204a0,292,"Boolean",0x44227288,
+code-creation,LazyCompile,3,0x2b82a080,83,"Array",0x442272e8,
+code-creation,LazyCompile,3,0x2b826460,77,"pop",0x44227348,
+code-creation,LazyCompile,3,0x2b826400,77,"push",0x442273a8,
+code-creation,LazyCompile,3,0x2b826640,77,"concat",0x44227408,
+code-creation,LazyCompile,3,0x2b8264c0,77,"shift",0x44227468,
+code-creation,LazyCompile,3,0x2b826520,77,"unshift",0x442274c8,
+code-creation,LazyCompile,3,0x2b826580,77,"slice",0x44227528,
+code-creation,LazyCompile,3,0x2b8265e0,77,"splice",0x44227588,
+code-creation,LazyCompile,0,0x2b8207a0,336,"Number",0x442275e8,
+code-creation,LazyCompile,3,0x2b82a020,78,"InternalArray",0x44227648,
+code-creation,LazyCompile,3,0x2b82a020,78,"InternalPackedArray",0x442276b4,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227714,
+code-creation,LazyCompile,0,0x2b821a40,324,"RegExp",0x44227774,
+code-creation,LazyCompile,0,0x2b81da80,1392,"Date",0x442277d4,
+code-creation,LazyCompile,0,0x2b820ca0,440,"Function",0x44227834,
+code-creation,LazyCompile,0,0x2b81d200,380,"String",0x44227894,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x442278f4,
+code-creation,LazyCompile,0,0x2b81cf80,216,"Script",0x44227960,
+code-creation,LazyCompile,0,0x2b81ff40,308,"Object",0x44227a00,
+code-creation,LazyCompile,3,0x2b829d00,376,"call",0x44227a60,
+code-creation,LazyCompile,3,0x2b829e80,388,"apply",0x44227ac0,
+code-creation,LazyCompile,3,0x2b8262e0,77,"Arguments",0x44227b20,
+code-creation,LazyCompile,3,0x2b826820,77,"ThrowTypeError",0x44227b80,
+code-creation,LazyCompile,3,0x2b826760,77,"",0x44227be0,
+code-creation,LazyCompile,3,0x2b8267c0,77,"",0x44227c40,
+code-creation,LazyCompile,3,0x2b8262e0,77,"",0x44227ca0,
+code-creation,Stub,2,0x2b81ef80,782,"CEntryStub"
+code-creation,Stub,2,0x2b81f2a0,197,"StoreBufferOverflowStub"
+code-creation,Stub,2,0x2b81f380,79,"StubFailureTrampolineStub"
+code-creation,Stub,2,0x2b81f3e0,80,"StubFailureTrampolineStub"
+tick,0xf776d430,16272,0,0x0,3
+timer-event-start,"V8.ParseLazy",16854
+timer-event-end,"V8.ParseLazy",17081
+timer-event-start,"V8.CompileLazy",17098
+timer-event-start,"V8.CompileFullCode",17125
+tick,0xf74c79de,17348,0,0xff820034,2
+code-creation,Stub,2,0x2b81b200,246,"FastCloneShallowObjectStub"
+code-creation,Stub,12,0x2b81b300,88,"BinaryOpStub_ADD_Alloc_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b81b360,88,"BinaryOpStub_ADD_OverwriteLeft_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",17910
+code-creation,LazyCompile,0,0x2b81b3c0,572,"Instantiate native apinatives.js:44",0x44223cdc,~
+timer-event-end,"V8.CompileLazy",17948
+code-creation,Stub,13,0x2b81b600,116,"CompareICStub"
+timer-event-start,"V8.ParseLazy",18020
+timer-event-end,"V8.ParseLazy",18170
+timer-event-start,"V8.CompileLazy",18187
+timer-event-start,"V8.CompileFullCode",18208
+code-creation,Stub,12,0x2b81b680,88,"BinaryOpStub_BIT_AND_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",18340
+code-creation,LazyCompile,0,0x2b82ae20,1008,"InstantiateFunction native apinatives.js:65",0x44223d3c,
+timer-event-end,"V8.CompileLazy",18396
+tick,0xf776d430,18420,0,0x90d68fc,2,0x2b81b4f0
+code-creation,Stub,2,0x2b82b220,1800,"RecordWriteStub"
+code-creation,Stub,2,0x2b82b940,236,"KeyedStoreElementStub"
+code-creation,KeyedStoreIC,10,0x2b82ba40,91,""
+code-creation,CallIC,7,0x2b82baa0,129,"InstantiateFunction"
+code-creation,LoadIC,5,0x2b82bb40,103,"kApiFunctionCache"
+code-creation,Stub,12,0x2b82bbc0,146,"BinaryOpStub_BIT_AND_Alloc_Smi+Smi"
+code-creation,Stub,15,0x2b82bc60,132,"ToBooleanStub(Smi)"
+timer-event-start,"V8.ParseLazy",19172
+timer-event-end,"V8.ParseLazy",19253
+timer-event-start,"V8.CompileLazy",19268
+timer-event-start,"V8.CompileFullCode",19285
+timer-event-end,"V8.CompileFullCode",19350
+code-creation,LazyCompile,0,0x2b82bd00,753,"ConfigureTemplateInstance native apinatives.js:105",0x44223d9c,
+timer-event-end,"V8.CompileLazy",19384
+tick,0x83c1620,19510,0,0xff81f92c,0,0x2b82b1de,0x2b81b4f0,0x2b81b576,0x2b82b0b8,0x2b81b4f0
+code-creation,Stub,2,0x2b82c000,208,"KeyedLoadElementStub"
+code-creation,KeyedLoadIC,6,0x2b82c0e0,91,""
+code-creation,Stub,15,0x2b82c140,156,"ToBooleanStub(Undefined,SpecObject)"
+code-creation,KeyedLoadIC,6,0x2b82c1e0,91,""
+code-creation,Stub,12,0x2b82c240,146,"BinaryOpStub_ADD_Alloc_Smi+Smi"
+code-creation,Stub,15,0x2b82c2e0,168,"ToBooleanStub(Undefined,String)"
+code-creation,CallIC,7,0x2b82c3a0,129,"ConfigureTemplateInstance"
+code-creation,CallIC,7,0x2b82c440,129,"Instantiate"
+code-creation,CallIC,7,0x2b82c4e0,144,"Instantiate"
+code-creation,Stub,13,0x2b82c580,469,"CompareICStub"
+code-creation,Stub,14,0x2b82c760,144,"CompareNilICStub(NullValue)(MonomorphicMap)"
+code-creation,Stub,14,0x2b82c800,144,"CompareNilICStub(NullValue)(MonomorphicMap)"
+tick,0x8132a60,20593,0,0x8141e5e,0,0x2b822c4e,0x2b82af24,0x2b81b4f0,0x2b82beff,0x2b81b59f,0x2b82beff,0x2b81b589,0x2b82b0b8,0x2b81b4f0
+code-creation,Stub,14,0x2b82c8a0,124,"CompareNilICStub(NullValue)(Undefined,Null,Undetectable,Generic)"
+code-creation,Stub,13,0x2b82c920,156,"CompareICStub"
+timer-event-start,"V8.ParseLazy",20736
+timer-event-end,"V8.ParseLazy",20818
+timer-event-start,"V8.CompileLazy",20838
+timer-event-start,"V8.CompileFullCode",20854
+code-creation,Stub,2,0x2b82c9c0,587,"FastCloneShallowArrayStub"
+timer-event-end,"V8.CompileFullCode",21298
+code-creation,LazyCompile,0,0x2b82cc20,812,"DefaultNumber native runtime.js:645",0x44226390,~
+timer-event-end,"V8.CompileLazy",21330
+timer-event-start,"V8.ParseLazy",21352
+timer-event-end,"V8.ParseLazy",21381
+timer-event-start,"V8.CompileLazy",21393
+timer-event-start,"V8.CompileFullCode",21405
+timer-event-end,"V8.CompileFullCode",21436
+code-creation,LazyCompile,0,0x2b82cf60,184,"valueOf native v8natives.js:245",0x4421ee84,~
+timer-event-end,"V8.CompileLazy",21465
+timer-event-start,"V8.ParseLazy",21482
+timer-event-end,"V8.ParseLazy",21544
+timer-event-start,"V8.CompileLazy",21557
+timer-event-start,"V8.CompileFullCode",21571
+timer-event-end,"V8.CompileFullCode",21651
+code-creation,LazyCompile,0,0x2b82d020,652,"ToObject native runtime.js:584",0x44226150,~
+timer-event-end,"V8.CompileLazy",21690
+tick,0x80eabe2,21708,0,0xff81f7a8,2,0x2b82cfe4,0x2b82cd79,0x2b825c84,0x2b822ca7,0x2b82af24,0x2b81b4f0,0x2b82beff,0x2b81b59f,0x2b82beff,0x2b81b589,0x2b82b0b8,0x2b81b4f0
+timer-event-start,"V8.ParseLazy",21761
+timer-event-end,"V8.ParseLazy",21796
+timer-event-start,"V8.CompileLazy",21808
+timer-event-start,"V8.CompileFullCode",21820
+timer-event-end,"V8.CompileFullCode",21845
+code-creation,LazyCompile,0,0x2b82d2c0,220,"IsPrimitive native runtime.js:636",0x44226330,~
+timer-event-end,"V8.CompileLazy",21873
+timer-event-start,"V8.ParseLazy",21895
+timer-event-end,"V8.ParseLazy",21921
+timer-event-start,"V8.CompileLazy",21932
+timer-event-start,"V8.CompileFullCode",21946
+timer-event-end,"V8.CompileFullCode",21966
+code-creation,LazyCompile,0,0x2b82d3a0,184,"toString native v8natives.js:1721",0x44220834,~
+timer-event-end,"V8.CompileLazy",21994
+timer-event-start,"V8.ParseLazy",22009
+timer-event-end,"V8.ParseLazy",22087
+timer-event-start,"V8.CompileLazy",22101
+timer-event-start,"V8.CompileFullCode",22116
+timer-event-end,"V8.CompileFullCode",22221
+code-creation,LazyCompile,0,0x2b82d460,681,"FunctionSourceString native v8natives.js:1693",0x442207d4,~
+timer-event-end,"V8.CompileLazy",22237
+code-creation,Stub,15,0x2b82d720,156,"ToBooleanStub(String)"
+code-creation,Stub,12,0x2b82d7c0,124,"BinaryOpStub_ADD_Alloc_String+String"
+code-creation,Stub,12,0x2b82d840,124,"BinaryOpStub_ADD_OverwriteLeft_String+String"
+code-creation,CallMiss,7,0x2b82d8c0,178,"args_count: 2"
+code-creation,CallIC,7,0x2b82d980,128,"ToPrimitive"
+code-creation,CallIC,7,0x2b82da00,128,"DefaultNumber"
+code-creation,Stub,2,0x2b82da80,116,"valueOf"
+code-creation,LoadIC,5,0x2b82db00,93,"valueOf"
+code-creation,CallIC,7,0x2b82db60,129,"ToObject"
+code-creation,CallIC,7,0x2b82dc00,128,"IsPrimitive"
+code-creation,Stub,2,0x2b82dc80,98,"toString"
+code-creation,LoadIC,5,0x2b82dd00,93,"toString"
+code-creation,CallIC,7,0x2b82dd60,129,"FunctionSourceString"
+code-creation,CallIC,7,0x2b82de00,128,"ToNumber"
+timer-event-start,"V8.Parse",22650
+tick,0xf776d430,22726,0,0x0,2
+timer-event-end,"V8.Parse",22773
+timer-event-start,"V8.Compile",22785
+timer-event-start,"V8.CompileFullCode",22801
+timer-event-end,"V8.CompileFullCode",22822
+code-creation,Script,0,0x2b82de80,264,"native arraybuffer.js",0x4423ab7c,~
+timer-event-end,"V8.Compile",22836
+timer-event-start,"V8.ParseLazy",22859
+timer-event-end,"V8.ParseLazy",22881
+timer-event-start,"V8.CompileLazy",22887
+timer-event-start,"V8.CompileFullCode",22899
+timer-event-end,"V8.CompileFullCode",22918
+code-creation,LazyCompile,0,0x2b82dfa0,480,"SetUpArrayBuffer native arraybuffer.js:84",0x4423aac0,~
+timer-event-end,"V8.CompileLazy",22934
+timer-event-start,"V8.ParseLazy",22943
+timer-event-end,"V8.ParseLazy",22962
+timer-event-start,"V8.CompileLazy",22967
+timer-event-start,"V8.CompileFullCode",22972
+timer-event-end,"V8.CompileFullCode",22987
+code-creation,LazyCompile,0,0x2b82e180,324,"ArrayBufferConstructor native arraybuffer.js:34",0x4423a9a0,~
+timer-event-end,"V8.CompileLazy",23000
+code-creation,LazyCompile,0,0x2b82e180,324,"ArrayBufferConstructor native arraybuffer.js:34",0x4423a9a0,
+timer-event-start,"V8.ParseLazy",23021
+timer-event-end,"V8.ParseLazy",23037
+timer-event-start,"V8.CompileLazy",23042
+timer-event-start,"V8.CompileFullCode",23047
+timer-event-end,"V8.CompileFullCode",23057
+code-creation,LazyCompile,0,0x2b82e2e0,252,"InstallGetter native v8natives.js:63",0x4421e9bc,~
+timer-event-end,"V8.CompileLazy",23069
+code-creation,KeyedLoadIC,6,0x2b82e3e0,91,""
+code-creation,LoadIC,5,0x2b82e440,93,"length"
+timer-event-start,"V8.Parse",23160
+timer-event-end,"V8.Parse",23613
+timer-event-start,"V8.Compile",23621
+timer-event-start,"V8.CompileFullCode",23666
+timer-event-end,"V8.CompileFullCode",23702
+code-creation,Script,0,0x2b82e4a0,720,"native typedarray.js",0x4423bc04,~
+timer-event-end,"V8.Compile",23724
+timer-event-start,"V8.ParseLazy",23755
+tick,0xf776d430,23782,0,0x0,2
+timer-event-end,"V8.ParseLazy",23867
+timer-event-start,"V8.CompileLazy",23905
+timer-event-start,"V8.CompileFullCode",23916
+timer-event-end,"V8.CompileFullCode",23939
+code-creation,LazyCompile,0,0x2b82e780,664,"SetupTypedArray native typedarray.js:170",0x4423b238,~
+timer-event-end,"V8.CompileLazy",23971
+timer-event-start,"V8.ParseLazy",23979
+timer-event-end,"V8.ParseLazy",24064
+timer-event-start,"V8.CompileLazy",24071
+timer-event-start,"V8.CompileFullCode",24085
+code-creation,Stub,2,0x2b82ea20,175,"FastNewContextStub"
+code-creation,Stub,2,0x2b82eae0,304,"FastNewClosureStub"
+code-creation,Stub,2,0x2b82ec20,1448,"RecordWriteStub"
+timer-event-end,"V8.CompileFullCode",24149
+code-creation,LazyCompile,0,0x2b82f1e0,460,"CreateTypedArrayConstructor native typedarray.js:38",0x4423af98,~
+timer-event-end,"V8.CompileLazy",24163
+timer-event-start,"V8.ParseLazy",24170
+timer-event-end,"V8.ParseLazy",24198
+timer-event-start,"V8.CompileLazy",24203
+timer-event-start,"V8.CompileFullCode",24211
+code-creation,Stub,2,0x2b82f3c0,331,"CallFunctionStub_Args4_Recording"
+code-creation,Stub,2,0x2b82f520,631,"FastCloneShallowArrayStub"
+code-creation,Stub,2,0x2b82f7a0,245,"StoreArrayLiteralElementStub"
+timer-event-end,"V8.CompileFullCode",24435
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,~
+timer-event-end,"V8.CompileLazy",24448
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+timer-event-start,"V8.ParseLazy",24478
+timer-event-end,"V8.ParseLazy",24519
+timer-event-start,"V8.CompileLazy",24525
+timer-event-start,"V8.CompileFullCode",24533
+timer-event-end,"V8.CompileFullCode",24546
+code-creation,LazyCompile,0,0x2b82fbe0,268,"CreateSubArray native typedarray.js:121",0x4423b178,~
+timer-event-end,"V8.CompileLazy",24559
+code-creation,CallMiss,7,0x2b82fd00,180,"args_count: 4"
+code-creation,CallIC,7,0x2b82fdc0,129,"CreateTypedArrayConstructor"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b82fe60,103,"$Object"
+code-creation,LoadIC,5,0x2b82fee0,103,"TypedArrayGetBuffer"
+code-creation,CallMiss,7,0x2b82ff60,180,"args_count: 3"
+code-creation,CallIC,7,0x2b830020,129,"InstallGetter"
+code-creation,LoadIC,5,0x2b8300c0,103,"TypedArrayGetByteOffset"
+code-creation,LoadIC,5,0x2b830140,103,"TypedArrayGetByteLength"
+code-creation,LoadIC,5,0x2b8301c0,103,"TypedArrayGetLength"
+code-creation,CallIC,7,0x2b830240,129,"CreateSubArray"
+code-creation,LoadIC,5,0x2b8302e0,103,"TypedArraySet"
+code-creation,CallIC,7,0x2b830360,133,"$Array"
+code-creation,CallIC,7,0x2b830400,129,"InstallFunctions"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+tick,0xf7492ece,24846,0,0xff81ff10,0,0x2b82e839,0x2b82e5f9
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+timer-event-start,"V8.ParseLazy",25032
+timer-event-end,"V8.ParseLazy",25074
+timer-event-start,"V8.CompileLazy",25081
+timer-event-start,"V8.CompileFullCode",25093
+timer-event-end,"V8.CompileFullCode",25115
+code-creation,LazyCompile,0,0x2b8304a0,888,"SetupDataView native typedarray.js:434",0x4423ba78,~
+timer-event-end,"V8.CompileLazy",25128
+timer-event-start,"V8.ParseLazy",25136
+timer-event-end,"V8.ParseLazy",25175
+timer-event-start,"V8.CompileLazy",25181
+timer-event-start,"V8.CompileFullCode",25188
+code-creation,Stub,12,0x2b830820,88,"BinaryOpStub_SUB_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",25228
+code-creation,LazyCompile,0,0x2b830880,908,"DataViewConstructor native typedarray.js:209",0x4423b298,~
+timer-event-end,"V8.CompileLazy",25241
+code-creation,LazyCompile,0,0x2b830880,908,"DataViewConstructor native typedarray.js:209",0x4423b298,
+code-creation,KeyedStorePolymorphicIC,10,0x2b830c20,101,""
+code-creation,KeyedStorePolymorphicIC,10,0x2b830c20,101,"args_count: 0"
+code-creation,CallIC,7,0x2b830ca0,144,"Instantiate"
+code-creation,CallIC,7,0x2b830d40,129,"InstantiateFunction"
+code-creation,LoadIC,5,0x2b830de0,103,"kApiFunctionCache"
+code-creation,KeyedLoadPolymorphicIC,6,0x2b830e60,105,""
+code-creation,CallIC,7,0x2b830ee0,129,"ConfigureTemplateInstance"
+code-creation,CallIC,7,0x2b830f80,129,"Instantiate"
+code-creation,Stub,2,0x2b831020,116,"valueOf"
+code-creation,LoadPolymorphicIC,5,0x2b8310a0,105,"valueOf"
+code-creation,Stub,2,0x2b831120,98,"toString"
+code-creation,LoadPolymorphicIC,5,0x2b8311a0,105,"toString"
+code-creation,CallIC,7,0x2b831220,128,"ToPrimitive"
+code-creation,CallIC,7,0x2b8312a0,128,"DefaultNumber"
+code-creation,CallIC,7,0x2b831320,129,"ToObject"
+code-creation,CallIC,7,0x2b8313c0,128,"IsPrimitive"
+code-creation,CallIC,7,0x2b831440,129,"FunctionSourceString"
+code-creation,CallIC,7,0x2b8314e0,128,"ToNumber"
+tick,0xf776d430,25914,0,0x90ec418,0,0x2b82cda7,0x2b825c84,0x2b822ca7,0x2b82af24,0x2b81b4f0,0x2b82beff,0x2b81b59f,0x2b82beff,0x2b81b589,0x2b82b0b8,0x2b81b4f0
+timer-event-start,"V8.ParseLazy",25965
+timer-event-end,"V8.ParseLazy",25985
+timer-event-start,"V8.CompileLazy",25991
+timer-event-start,"V8.RecompileSynchronous",25996
+code-creation,LazyCompile,0,0x2b831560,184,"valueOf native v8natives.js:245",0x4421ee84,~
+timer-event-end,"V8.RecompileSynchronous",26121
+code-creation,LazyCompile,1,0x2b831620,180,"valueOf native v8natives.js:245",0x4421ee84,*
+timer-event-end,"V8.CompileLazy",26138
+timer-event-start,"V8.ParseLazy",26144
+timer-event-end,"V8.ParseLazy",26156
+timer-event-start,"V8.CompileLazy",26161
+timer-event-start,"V8.RecompileSynchronous",26166
+code-creation,LazyCompile,0,0x2b8316e0,220,"IsPrimitive native runtime.js:636",0x44226330,~
+timer-event-end,"V8.RecompileSynchronous",26250
+code-creation,LazyCompile,1,0x2b8317c0,170,"IsPrimitive native runtime.js:636",0x44226330,*
+timer-event-end,"V8.CompileLazy",26266
+timer-event-start,"V8.ParseLazy",26271
+timer-event-end,"V8.ParseLazy",26282
+timer-event-start,"V8.CompileLazy",26286
+timer-event-start,"V8.RecompileSynchronous",26291
+code-creation,LazyCompile,0,0x2b831880,184,"toString native v8natives.js:1721",0x44220834,~
+timer-event-end,"V8.RecompileSynchronous",26361
+code-creation,LazyCompile,1,0x2b831940,180,"toString native v8natives.js:1721",0x44220834,*
+timer-event-end,"V8.CompileLazy",26376
+code-creation,LoadIC,5,0x2b831a00,103,"global"
+code-creation,LoadIC,5,0x2b831a80,114,"ArrayBuffer"
+code-creation,CallMiss,7,0x2b831b00,180,"args_count: 0"
+code-creation,CallIC,7,0x2b831bc0,129,"SetUpArrayBuffer"
+code-creation,LoadIC,5,0x2b831c60,103,"$ArrayBuffer"
+code-creation,LoadIC,5,0x2b831ce0,103,"ArrayBufferConstructor"
+code-creation,LazyCompile,0,0x2b82e180,324,"ArrayBufferConstructor native arraybuffer.js:34",0x4423a9a0,
+code-creation,LoadIC,5,0x2b831d60,103,"$Object"
+code-creation,LoadIC,5,0x2b831de0,103,"ArrayBufferGetByteLength"
+code-creation,CallIC,7,0x2b831e60,129,"InstallGetter"
+code-creation,LoadIC,5,0x2b831f00,103,"ArrayBufferSlice"
+code-creation,CallIC,7,0x2b831f80,133,"$Array"
+code-creation,CallIC,7,0x2b832020,129,"InstallFunctions"
+code-creation,LoadPolymorphicIC,5,0x2b8320c0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b832140,105,"length"
+code-creation,KeyedLoadPolymorphicIC,6,0x2b8321c0,105,""
+code-creation,LoadIC,5,0x2b832240,114,"Uint8Array"
+code-creation,CallIC,7,0x2b8322c0,129,"SetupTypedArray"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832360,103,"$Object"
+code-creation,LoadIC,5,0x2b8323e0,114,"Int8Array"
+code-creation,CallIC,7,0x2b832460,129,"CreateTypedArrayConstructor"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832500,103,"TypedArrayGetBuffer"
+code-creation,LoadIC,5,0x2b832580,103,"TypedArrayGetByteOffset"
+code-creation,LoadIC,5,0x2b832600,103,"TypedArrayGetByteLength"
+code-creation,LoadIC,5,0x2b832680,103,"TypedArrayGetLength"
+code-creation,CallIC,7,0x2b832700,129,"CreateSubArray"
+code-creation,LoadIC,5,0x2b8327a0,103,"TypedArraySet"
+code-creation,CallIC,7,0x2b832820,133,"$Array"
+code-creation,LoadIC,5,0x2b8328c0,114,"Uint16Array"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+tick,0xf776d430,26979,0,0x90ec418,0,0x2b82e9b7,0x2b82e593
+code-creation,LoadIC,5,0x2b832940,114,"Int16Array"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b8329c0,114,"Uint32Array"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832a40,114,"Int32Array"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832ac0,114,"Float32Array"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832b40,114,"Float64Array"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832bc0,114,"Uint8ClampedArray"
+code-creation,LazyCompile,0,0x2b82f8a0,824," native typedarray.js:88",0x4423c580,
+code-creation,LoadIC,5,0x2b832c40,114,"DataView"
+code-creation,CallIC,7,0x2b832cc0,129,"SetupDataView"
+code-creation,LoadIC,5,0x2b832d60,103,"$DataView"
+code-creation,LoadIC,5,0x2b832de0,103,"DataViewConstructor"
+code-creation,LazyCompile,0,0x2b830880,908,"DataViewConstructor native typedarray.js:209",0x4423b298,
+code-creation,LoadIC,5,0x2b832e60,103,"DataViewGetBuffer"
+code-creation,LoadIC,5,0x2b832ee0,103,"DataViewGetByteOffset"
+code-creation,LoadIC,5,0x2b832f60,103,"DataViewGetByteLength"
+code-creation,LoadIC,5,0x2b832fe0,103,"DataViewGetInt8"
+code-creation,LoadIC,5,0x2b833060,103,"DataViewSetInt8"
+code-creation,LoadIC,5,0x2b8330e0,103,"DataViewGetUint8"
+code-creation,LoadIC,5,0x2b833160,103,"DataViewSetUint8"
+code-creation,LoadIC,5,0x2b8331e0,103,"DataViewGetInt16"
+code-creation,LoadIC,5,0x2b833260,103,"DataViewSetInt16"
+code-creation,LoadIC,5,0x2b8332e0,103,"DataViewGetUint16"
+code-creation,LoadIC,5,0x2b833360,103,"DataViewSetUint16"
+code-creation,LoadIC,5,0x2b8333e0,103,"DataViewGetInt32"
+code-creation,LoadIC,5,0x2b833460,103,"DataViewSetInt32"
+code-creation,LoadIC,5,0x2b8334e0,103,"DataViewGetUint32"
+code-creation,LoadIC,5,0x2b833560,103,"DataViewSetUint32"
+code-creation,LoadIC,5,0x2b8335e0,103,"DataViewGetFloat32"
+code-creation,LoadIC,5,0x2b833660,103,"DataViewSetFloat32"
+code-creation,LoadIC,5,0x2b8336e0,103,"DataViewGetFloat64"
+code-creation,LoadIC,5,0x2b833760,103,"DataViewSetFloat64"
+code-creation,CallMiss,7,0x2b8337e0,189,"args_count: 32"
+code-creation,CallIC,7,0x2b8338a0,136,"$Array"
+code-creation,LoadIC,5,0x2b833940,93,"length"
+timer-event-start,"V8.Parse",28734
+timer-event-start,"V8.PreParse",28760
+timer-event-end,"V8.PreParse",28785
+timer-event-start,"V8.PreParse",28796
+timer-event-end,"V8.PreParse",28803
+timer-event-start,"V8.PreParse",28810
+timer-event-end,"V8.PreParse",28817
+timer-event-start,"V8.PreParse",28828
+timer-event-end,"V8.PreParse",28862
+timer-event-start,"V8.PreParse",28872
+timer-event-end,"V8.PreParse",28878
+timer-event-start,"V8.PreParse",28884
+timer-event-end,"V8.PreParse",28890
+timer-event-start,"V8.PreParse",28905
+timer-event-end,"V8.PreParse",28931
+timer-event-start,"V8.PreParse",28938
+timer-event-end,"V8.PreParse",28970
+timer-event-start,"V8.PreParse",28980
+timer-event-end,"V8.PreParse",28989
+timer-event-start,"V8.PreParse",28995
+timer-event-end,"V8.PreParse",29005
+timer-event-start,"V8.PreParse",29012
+timer-event-end,"V8.PreParse",29019
+timer-event-start,"V8.PreParse",29026
+timer-event-end,"V8.PreParse",29045
+timer-event-start,"V8.PreParse",29052
+timer-event-end,"V8.PreParse",29059
+timer-event-start,"V8.PreParse",29066
+timer-event-end,"V8.PreParse",29072
+timer-event-start,"V8.PreParse",29078
+timer-event-end,"V8.PreParse",29087
+tick,0xf776d430,29099,0,0x0,2
+timer-event-start,"V8.PreParse",29187
+timer-event-end,"V8.PreParse",29241
+timer-event-start,"V8.PreParse",29253
+timer-event-end,"V8.PreParse",29261
+timer-event-start,"V8.PreParse",29274
+timer-event-end,"V8.PreParse",29286
+timer-event-start,"V8.PreParse",29293
+timer-event-end,"V8.PreParse",29305
+timer-event-start,"V8.PreParse",29314
+timer-event-end,"V8.PreParse",29324
+timer-event-start,"V8.PreParse",29331
+timer-event-end,"V8.PreParse",29344
+timer-event-start,"V8.PreParse",29355
+timer-event-end,"V8.PreParse",29369
+timer-event-start,"V8.PreParse",29375
+timer-event-end,"V8.PreParse",29391
+timer-event-start,"V8.PreParse",29400
+timer-event-end,"V8.PreParse",29408
+timer-event-start,"V8.PreParse",29416
+timer-event-end,"V8.PreParse",29422
+timer-event-start,"V8.PreParse",29435
+timer-event-end,"V8.PreParse",29442
+timer-event-start,"V8.PreParse",29448
+timer-event-end,"V8.PreParse",29461
+timer-event-start,"V8.PreParse",29467
+timer-event-end,"V8.PreParse",29480
+timer-event-start,"V8.PreParse",29489
+timer-event-end,"V8.PreParse",29508
+timer-event-start,"V8.PreParse",29516
+timer-event-end,"V8.PreParse",29547
+timer-event-start,"V8.PreParse",29561
+timer-event-end,"V8.PreParse",29579
+timer-event-start,"V8.PreParse",29587
+timer-event-end,"V8.PreParse",29605
+timer-event-start,"V8.PreParse",29613
+timer-event-end,"V8.PreParse",29639
+timer-event-start,"V8.PreParse",29646
+timer-event-end,"V8.PreParse",29667
+timer-event-start,"V8.PreParse",29677
+timer-event-end,"V8.PreParse",29702
+timer-event-start,"V8.PreParse",29709
+timer-event-end,"V8.PreParse",29735
+timer-event-start,"V8.PreParse",29741
+timer-event-end,"V8.PreParse",29758
+timer-event-start,"V8.PreParse",29764
+timer-event-end,"V8.PreParse",29773
+timer-event-start,"V8.PreParse",29781
+timer-event-end,"V8.PreParse",29796
+timer-event-start,"V8.PreParse",29805
+timer-event-end,"V8.PreParse",29813
+timer-event-start,"V8.PreParse",29821
+timer-event-end,"V8.PreParse",29839
+timer-event-start,"V8.PreParse",29847
+timer-event-end,"V8.PreParse",29861
+timer-event-start,"V8.PreParse",29868
+timer-event-end,"V8.PreParse",29873
+timer-event-start,"V8.PreParse",29880
+timer-event-end,"V8.PreParse",29908
+timer-event-start,"V8.PreParse",29914
+timer-event-end,"V8.PreParse",29923
+timer-event-start,"V8.PreParse",29930
+timer-event-end,"V8.PreParse",29937
+timer-event-start,"V8.PreParse",29944
+timer-event-end,"V8.PreParse",29955
+timer-event-start,"V8.PreParse",29960
+timer-event-end,"V8.PreParse",29970
+timer-event-start,"V8.PreParse",29977
+timer-event-end,"V8.PreParse",29982
+timer-event-start,"V8.PreParse",29989
+timer-event-end,"V8.PreParse",29999
+timer-event-start,"V8.PreParse",30031
+timer-event-end,"V8.PreParse",30041
+timer-event-start,"V8.PreParse",30047
+timer-event-end,"V8.PreParse",30054
+timer-event-start,"V8.PreParse",30060
+timer-event-end,"V8.PreParse",30069
+timer-event-start,"V8.PreParse",30080
+timer-event-end,"V8.PreParse",30106
+timer-event-start,"V8.PreParse",30113
+timer-event-end,"V8.PreParse",30121
+timer-event-start,"V8.PreParse",30127
+timer-event-end,"V8.PreParse",30133
+timer-event-start,"V8.PreParse",30139
+timer-event-end,"V8.PreParse",30148
+tick,0x825e06c,30162,0,0x0,2
+timer-event-start,"V8.PreParse",30217
+timer-event-end,"V8.PreParse",30285
+timer-event-start,"V8.PreParse",30293
+timer-event-end,"V8.PreParse",30319
+timer-event-start,"V8.PreParse",30326
+timer-event-end,"V8.PreParse",30344
+timer-event-start,"V8.PreParse",30350
+timer-event-end,"V8.PreParse",30367
+timer-event-start,"V8.PreParse",30374
+timer-event-end,"V8.PreParse",30385
+timer-event-start,"V8.PreParse",30392
+timer-event-end,"V8.PreParse",30400
+timer-event-start,"V8.PreParse",30407
+timer-event-end,"V8.PreParse",30415
+timer-event-start,"V8.PreParse",30429
+timer-event-end,"V8.PreParse",30446
+timer-event-start,"V8.PreParse",30456
+timer-event-end,"V8.PreParse",30461
+timer-event-start,"V8.PreParse",30469
+timer-event-end,"V8.PreParse",30480
+timer-event-start,"V8.PreParse",30488
+timer-event-end,"V8.PreParse",30497
+timer-event-start,"V8.PreParse",30503
+timer-event-end,"V8.PreParse",30511
+timer-event-start,"V8.PreParse",30517
+timer-event-end,"V8.PreParse",30528
+timer-event-start,"V8.PreParse",30535
+timer-event-end,"V8.PreParse",30539
+timer-event-start,"V8.PreParse",30546
+timer-event-end,"V8.PreParse",30550
+timer-event-start,"V8.PreParse",30568
+timer-event-end,"V8.PreParse",30577
+timer-event-start,"V8.PreParse",30586
+timer-event-end,"V8.PreParse",30591
+timer-event-start,"V8.PreParse",30600
+timer-event-end,"V8.PreParse",30610
+timer-event-start,"V8.PreParse",30616
+timer-event-end,"V8.PreParse",30621
+timer-event-start,"V8.PreParse",30630
+timer-event-end,"V8.PreParse",30638
+timer-event-start,"V8.PreParse",30649
+timer-event-end,"V8.PreParse",30665
+timer-event-start,"V8.PreParse",30672
+timer-event-end,"V8.PreParse",30682
+timer-event-start,"V8.PreParse",30692
+timer-event-end,"V8.PreParse",30706
+timer-event-start,"V8.PreParse",30719
+timer-event-end,"V8.PreParse",30730
+timer-event-start,"V8.PreParse",30737
+timer-event-end,"V8.PreParse",30749
+tick,0x82b07f6,31208,0,0x0,2
+tick,0x824d3ad,32274,0,0x0,2
+tick,0x82b07c6,33327,0,0x0,2
+tick,0x82b0804,34401,0,0x0,2
+tick,0x81fc62c,35474,0,0x0,2
+tick,0x81fc62c,36534,0,0x0,2
+tick,0x824e954,37593,0,0x0,2
+tick,0x82b07f3,38662,0,0x0,2
+tick,0x81fc625,39722,0,0x0,2
+tick,0x81fc61e,40783,0,0x0,2
+tick,0x821c1a1,41846,0,0x0,2
+tick,0x81fc62c,42913,0,0x0,2
+timer-event-start,"V8.PreParse",43415
+timer-event-end,"V8.PreParse",43428
+timer-event-start,"V8.PreParse",43446
+timer-event-end,"V8.PreParse",43481
+timer-event-end,"V8.Parse",43493
+timer-event-start,"V8.Compile",43498
+timer-event-start,"V8.CompileFullCode",43528
+timer-event-end,"V8.CompileFullCode",43671
+code-creation,Script,0,0x2b8339a0,6060,"bsuite/kraken-once/stanford-crypto-ccm.js",0x2f33b684,~
+timer-event-end,"V8.Compile",43688
+timer-event-start,"V8.Execute",43739
+timer-event-start,"V8.ParseLazy",43914
+timer-event-end,"V8.ParseLazy",43936
+timer-event-start,"V8.CompileLazy",43942
+timer-event-start,"V8.CompileFullCode",43947
+timer-event-end,"V8.CompileFullCode",43966
+tick,0x820b498,43978,0,0x0,0,0x2b83464f
+code-creation,LazyCompile,0,0x2b835160,372,"sjcl.hash.sha256 bsuite/kraken-once/stanford-crypto-ccm.js:15",0x2f339fb0,~
+timer-event-end,"V8.CompileLazy",44194
+code-creation,Stub,2,0x2b8352e0,188,"KeyedLoadElementStub"
+code-creation,KeyedLoadIC,6,0x2b8353a0,91,""
+code-creation,CallPreMonomorphic,7,0x2b835400,178,"args_count: 0"
+timer-event-start,"V8.ParseLazy",44292
+timer-event-end,"V8.ParseLazy",44326
+timer-event-start,"V8.CompileLazy",44333
+timer-event-start,"V8.CompileFullCode",44340
+code-creation,Stub,12,0x2b8354c0,88,"BinaryOpStub_MOD_Alloc_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b835520,88,"BinaryOpStub_MUL_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",44389
+code-creation,LazyCompile,0,0x2b835580,906,"sjcl.hash.sha256.w bsuite/kraken-once/stanford-crypto-ccm.js:17",0x2f33a190,~
+timer-event-end,"V8.CompileLazy",44407
+code-creation,Stub,12,0x2b835920,167,"BinaryOpStub_MUL_Alloc_Smi+Smi"
+code-creation,Stub,13,0x2b8359e0,122,"CompareICStub"
+timer-event-start,"V8.ParseLazy",44439
+timer-event-end,"V8.ParseLazy",44460
+timer-event-start,"V8.CompileLazy",44465
+timer-event-start,"V8.CompileFullCode",44471
+code-creation,Stub,2,0x2b835a60,501,"MathPowStub"
+timer-event-end,"V8.CompileFullCode",44505
+code-creation,LazyCompile,0,0x2b835c60,304,"pow native math.js:181",0x4422259c,~
+timer-event-end,"V8.CompileLazy",44517
+timer-event-start,"V8.ParseLazy",44522
+timer-event-end,"V8.ParseLazy",44534
+timer-event-start,"V8.CompileLazy",44539
+timer-event-start,"V8.CompileFullCode",44545
+code-creation,Stub,12,0x2b835da0,88,"BinaryOpStub_MUL_OverwriteLeft_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b835e00,88,"BinaryOpStub_BIT_OR_OverwriteLeft_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",44570
+code-creation,LazyCompile,0,0x2b835e60,228,"a bsuite/kraken-once/stanford-crypto-ccm.js:17",0x2f33d150,~
+timer-event-end,"V8.CompileLazy",44582
+timer-event-start,"V8.ParseLazy",44590
+timer-event-end,"V8.ParseLazy",44609
+timer-event-start,"V8.CompileLazy",44614
+timer-event-start,"V8.CompileFullCode",44619
+code-creation,Stub,12,0x2b835f60,88,"BinaryOpStub_SHR_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",44646
+code-creation,LazyCompile,0,0x2b835fc0,344,"floor native math.js:99",0x4422241c,~
+timer-event-end,"V8.CompileLazy",44657
+code-creation,Stub,13,0x2b836120,404,"CompareICStub"
+code-creation,Stub,13,0x2b8362c0,232,"CompareICStub"
+code-creation,Stub,13,0x2b8363c0,404,"CompareICStub"
+code-creation,Stub,13,0x2b836560,240,"CompareICStub"
+code-creation,Stub,12,0x2b836660,349,"BinaryOpStub_SHR_Alloc_Number+Smi"
+code-creation,Stub,12,0x2b8367c0,246,"BinaryOpStub_SUB_Alloc_Number+Smi"
+code-creation,Stub,12,0x2b8368c0,245,"BinaryOpStub_MUL_OverwriteLeft_Number+Number"
+code-creation,Stub,12,0x2b8369c0,407,"BinaryOpStub_BIT_OR_OverwriteLeft_Number+Smi"
+code-creation,Stub,2,0x2b836b60,1808,"RecordWriteStub"
+code-creation,Stub,2,0x2b837280,606,"KeyedStoreElementStub"
+code-creation,KeyedStoreIC,10,0x2b8374e0,91,""
+tick,0x31e6020f,45036,0,0x2b836b61,0,0x2b8357c1,0x2b835208,0x2b83464f
+code-creation,LoadIC,5,0x2b837540,114,"Math"
+code-creation,CallIC,7,0x2b8375c0,289,"floor"
+code-creation,Stub,2,0x2b837700,80,"LoadFieldStub"
+code-creation,Stub,2,0x2b837760,95,"N"
+code-creation,LoadIC,5,0x2b8377c0,93,"N"
+code-creation,CallIC,7,0x2b837820,113,"pow"
+code-creation,Stub,2,0x2b8378a0,80,"LoadFieldStub"
+code-creation,Stub,2,0x2b837900,95,"a"
+code-creation,LoadIC,5,0x2b837960,93,"a"
+code-creation,Stub,12,0x2b8379c0,190,"BinaryOpStub_MOD_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b837a80,181,"BinaryOpStub_MOD_Alloc_Smi+Smi"
+timer-event-start,"V8.ParseLazy",45383
+timer-event-end,"V8.ParseLazy",45402
+timer-event-start,"V8.CompileLazy",45408
+timer-event-start,"V8.CompileFullCode",45413
+timer-event-end,"V8.CompileFullCode",45428
+code-creation,LazyCompile,0,0x2b837b40,264,"sjcl.hash.sha256.reset bsuite/kraken-once/stanford-crypto-ccm.js:16",0x2f33a070,~
+timer-event-end,"V8.CompileLazy",45442
+code-creation,StoreIC,9,0x2b837c60,138,"codec"
+code-creation,StoreIC,9,0x2b837d00,141,"hex"
+tick,0x8294f6f,46096,0,0xff820124,0,0x2b834ff0
+code-creation,StoreIC,9,0x2b837da0,171,"ccm"
+timer-event-start,"V8.ParseLazy",46605
+timer-event-end,"V8.ParseLazy",46625
+timer-event-start,"V8.CompileLazy",46630
+timer-event-start,"V8.CompileFullCode",46635
+timer-event-end,"V8.CompileFullCode",46649
+code-creation,LazyCompile,0,0x2b837e60,300,"sjcl.test.TestCase bsuite/kraken-once/stanford-crypto-ccm.js:99",0x2f33b210,~
+timer-event-end,"V8.CompileLazy",46663
+timer-event-start,"V8.ParseLazy",46681
+timer-event-end,"V8.ParseLazy",46712
+timer-event-start,"V8.CompileLazy",46718
+timer-event-start,"V8.CompileFullCode",46725
+code-creation,CallInitialize,7,0x2b837fa0,178,"args_count: 4"
+timer-event-end,"V8.CompileFullCode",46771
+code-creation,LazyCompile,0,0x2b838060,953,"sjcl.test.run bsuite/kraken-once/stanford-crypto-ccm.js:180",0x2f33b4b0,~
+timer-event-end,"V8.CompileLazy",46788
+code-creation,Stub,13,0x2b838420,485,"CompareICStub"
+code-creation,CallIC,7,0x2b838620,128,"ToString"
+code-creation,CallPreMonomorphic,7,0x2b8386a0,178,"args_count: 4"
+timer-event-start,"V8.ParseLazy",46859
+timer-event-end,"V8.ParseLazy",46876
+timer-event-start,"V8.CompileLazy",46881
+timer-event-start,"V8.CompileFullCode",46888
+code-creation,CallInitialize,7,0x2b838760,178,"args_count: 5"
+timer-event-end,"V8.CompileFullCode",46910
+code-creation,LazyCompile,0,0x2b838820,320,"browserUtil.cpsMap bsuite/kraken-once/stanford-crypto-ccm.js:63",0x2f33b030,~
+timer-event-end,"V8.CompileLazy",46922
+code-creation,CallPreMonomorphic,7,0x2b838960,178,"args_count: 5"
+timer-event-start,"V8.ParseLazy",46937
+timer-event-end,"V8.ParseLazy",46959
+timer-event-start,"V8.CompileLazy",46965
+timer-event-start,"V8.CompileFullCode",46972
+code-creation,Stub,2,0x2b838a20,172,"FastNewContextStub"
+timer-event-end,"V8.CompileFullCode",46995
+code-creation,LazyCompile,0,0x2b838ae0,420,"browserUtil.cpsIterate bsuite/kraken-once/stanford-crypto-ccm.js:49",0x2f33afd0,~
+timer-event-end,"V8.CompileLazy",47008
+timer-event-start,"V8.ParseLazy",47013
+timer-event-end,"V8.ParseLazy",47029
+timer-event-start,"V8.CompileLazy",47034
+timer-event-start,"V8.CompileFullCode",47041
+code-creation,Stub,2,0x2b838ca0,328,"CallFunctionStub_Args0_Recording"
+timer-event-end,"V8.CompileFullCode",47070
+code-creation,LazyCompile,0,0x2b838e00,372,"go bsuite/kraken-once/stanford-crypto-ccm.js:50",0x2f33da7c,~
+timer-event-end,"V8.CompileLazy",47082
+timer-event-start,"V8.ParseLazy",47088
+timer-event-end,"V8.ParseLazy",47110
+timer-event-start,"V8.CompileLazy",47115
+timer-event-start,"V8.CompileFullCode",47121
+timer-event-end,"V8.CompileFullCode",47134
+code-creation,LazyCompile,0,0x2b838f80,236," bsuite/kraken-once/stanford-crypto-ccm.js:64",0x2f33d9d4,~
+timer-event-end,"V8.CompileLazy",47146
+tick,0xf776d430,47160,0,0x90ec418,2,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,KeyedLoadIC,6,0x2b839080,91,""
+timer-event-start,"V8.ParseLazy",47296
+timer-event-end,"V8.ParseLazy",47317
+timer-event-start,"V8.CompileLazy",47323
+timer-event-start,"V8.CompileFullCode",47329
+code-creation,CallInitialize,7,0x2b8390e0,178,"args_count: 3"
+timer-event-end,"V8.CompileFullCode",47355
+code-creation,LazyCompile,0,0x2b8391a0,260," bsuite/kraken-once/stanford-crypto-ccm.js:192",0x2f33d920,~
+timer-event-end,"V8.CompileLazy",47368
+code-creation,CallPreMonomorphic,7,0x2b8392c0,178,"args_count: 3"
+timer-event-start,"V8.ParseLazy",47390
+timer-event-end,"V8.ParseLazy",47409
+timer-event-start,"V8.CompileLazy",47415
+timer-event-start,"V8.CompileFullCode",47421
+timer-event-end,"V8.CompileFullCode",47438
+code-creation,LazyCompile,0,0x2b839380,344,"sjcl.test.TestCase.run bsuite/kraken-once/stanford-crypto-ccm.js:168",0x2f33b450,~
+timer-event-end,"V8.CompileLazy",47452
+timer-event-start,"V8.ParseLazy",47462
+timer-event-end,"V8.ParseLazy",47476
+timer-event-start,"V8.CompileLazy",47481
+timer-event-start,"V8.CompileFullCode",47485
+timer-event-end,"V8.CompileFullCode",47496
+code-creation,LazyCompile,0,0x2b8394e0,208,"valueOf native date.js:361",0x44218984,~
+timer-event-end,"V8.CompileLazy",47507
+timer-event-start,"V8.ParseLazy",47517
+timer-event-end,"V8.ParseLazy",47526
+timer-event-start,"V8.CompileLazy",47531
+timer-event-start,"V8.CompileFullCode",47536
+timer-event-end,"V8.CompileFullCode",47545
+code-creation,LazyCompile,0,0x2b8395c0,192,"browserUtil.pauseAndThen bsuite/kraken-once/stanford-crypto-ccm.js:47",0x2f33af70,~
+timer-event-end,"V8.CompileLazy",47557
+timer-event-start,"V8.ParseLazy",47561
+timer-event-end,"V8.ParseLazy",47571
+timer-event-start,"V8.CompileLazy",47576
+timer-event-start,"V8.CompileFullCode",47581
+timer-event-end,"V8.CompileFullCode",47591
+code-creation,LazyCompile,0,0x2b839680,192," bsuite/kraken-once/stanford-crypto-ccm.js:171",0x2f33dc70,~
+timer-event-end,"V8.CompileLazy",47602
+timer-event-start,"V8.ParseLazy",47608
+timer-event-end,"V8.ParseLazy",47674
+timer-event-start,"V8.CompileLazy",47681
+timer-event-start,"V8.CompileFullCode",47693
+code-creation,Stub,2,0x2b839740,196,"FastNewContextStub"
+code-creation,Stub,12,0x2b839820,88,"BinaryOpStub_DIV_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",47755
+code-creation,LazyCompile,0,0x2b839880,716," bsuite/kraken-once/stanford-crypto-ccm.js:7235",0x2f33b5d0,~
+timer-event-end,"V8.CompileLazy",47768
+code-creation,Stub,12,0x2b839b60,196,"BinaryOpStub_DIV_Alloc_Smi+Smi"
+timer-event-start,"V8.ParseLazy",47798
+timer-event-end,"V8.ParseLazy",47845
+timer-event-start,"V8.CompileLazy",47851
+timer-event-start,"V8.CompileFullCode",47863
+code-creation,Stub,12,0x2b839c40,88,"BinaryOpStub_MUL_OverwriteRight_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",47917
+code-creation,LazyCompile,0,0x2b839ca0,2065," bsuite/kraken-once/stanford-crypto-ccm.js:7243",0x2f33de10,
+timer-event-end,"V8.CompileLazy",47930
+code-creation,Stub,12,0x2b83a4c0,167,"BinaryOpStub_MUL_OverwriteRight_Smi+Smi"
+timer-event-start,"V8.ParseLazy",47958
+timer-event-end,"V8.ParseLazy",47986
+timer-event-start,"V8.CompileLazy",47992
+timer-event-start,"V8.CompileFullCode",47998
+code-creation,Stub,12,0x2b83a580,88,"BinaryOpStub_BIT_XOR_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",48031
+code-creation,LazyCompile,0,0x2b83a5e0,717,"sjcl.codec.hex.toBits bsuite/kraken-once/stanford-crypto-ccm.js:13",0x2f339e90,~
+timer-event-end,"V8.CompileLazy",48044
+timer-event-start,"V8.ParseLazy",48061
+timer-event-end,"V8.ParseLazy",48119
+timer-event-start,"V8.CompileLazy",48126
+timer-event-start,"V8.CompileFullCode",48135
+timer-event-end,"V8.CompileFullCode",48188
+code-creation,LazyCompile,0,0x2b83a8c0,1601,"DoConstructRegExp native regexp.js:39",0x44222a28,~
+timer-event-end,"V8.CompileLazy",48203
+timer-event-start,"V8.ParseLazy",48213
+tick,0x80eabd3,48226,0,0xff81fb44,2,0x2b821ae3,0x2b83a6a4,0x2b839e4e,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.ParseLazy",48288
+timer-event-start,"V8.CompileLazy",48309
+timer-event-start,"V8.CompileFullCode",48323
+timer-event-end,"V8.CompileFullCode",48372
+code-creation,LazyCompile,0,0x2b83af20,1284,"charAt native string.js:64",0x44215fa8,~
+timer-event-end,"V8.CompileLazy",48386
+code-creation,Stub,14,0x2b83b440,144,"CompareNilICStub(NullValue)(MonomorphicMap)"
+code-creation,Stub,5,0x2b83b4e0,97,"StringLengthStub"
+timer-event-start,"V8.ParseLazy",48435
+timer-event-end,"V8.ParseLazy",48536
+timer-event-start,"V8.CompileLazy",48543
+timer-event-start,"V8.CompileFullCode",48555
+code-creation,Stub,2,0x2b83b560,828,"SubStringStub"
+timer-event-end,"V8.CompileFullCode",48640
+code-creation,LazyCompile,0,0x2b83b8a0,2428,"replace native string.js:213",0x44216248,~
+timer-event-end,"V8.CompileLazy",48654
+code-creation,StoreIC,9,0x2b83c220,135,"lastIndex"
+code-creation,Stub,14,0x2b83c2c0,124,"CompareNilICStub(NullValue)(Null)"
+code-creation,RegExp,4,0x2b83c340,758,"\\s|0x"
+timer-event-start,"V8.ParseLazy",48827
+timer-event-end,"V8.ParseLazy",48873
+timer-event-start,"V8.CompileLazy",48879
+timer-event-start,"V8.CompileFullCode",48886
+timer-event-end,"V8.CompileFullCode",48916
+code-creation,LazyCompile,0,0x2b83c640,960,"substr native string.js:749",0x44216608,~
+timer-event-end,"V8.CompileLazy",48930
+code-creation,Stub,14,0x2b83ca00,144,"CompareNilICStub(NullValue)(MonomorphicMap)"
+code-creation,Stub,13,0x2b83caa0,122,"CompareICStub"
+timer-event-start,"V8.ParseLazy",48959
+timer-event-end,"V8.ParseLazy",49000
+timer-event-start,"V8.CompileLazy",49006
+timer-event-start,"V8.CompileFullCode",49012
+code-creation,Stub,12,0x2b83cb20,88,"BinaryOpStub_BIT_OR_Alloc_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b83cb80,88,"BinaryOpStub_SAR_Alloc_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",49062
+code-creation,LazyCompile,0,0x2b83cbe0,1096,"parseInt native v8natives.js:130",0x4421ec1c,~
+timer-event-end,"V8.CompileLazy",49075
+code-creation,Stub,12,0x2b83d040,399,"BinaryOpStub_BIT_XOR_Alloc_Number+Smi"
+code-creation,CallIC,7,0x2b83d1e0,147,"substr"
+code-creation,CallIC,7,0x2b83d280,129,"parseInt"
+code-creation,Stub,2,0x2b83d320,1433,"RecordWriteStub"
+code-creation,Stub,2,0x2b83d8c0,611,"RecordWriteStub"
+code-creation,CallIC,7,0x2b83db40,656,"push"
+timer-event-start,"V8.ParseLazy",49192
+timer-event-end,"V8.ParseLazy",49229
+timer-event-start,"V8.CompileLazy",49235
+timer-event-start,"V8.CompileFullCode",49242
+code-creation,Stub,12,0x2b83dde0,88,"BinaryOpStub_SAR_OverwriteRight_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b83de40,88,"BinaryOpStub_BIT_AND_OverwriteRight_Uninitialized+Uninitialized"
+tick,0x8250358,49284,0,0xff81fe84,2,0x2b83a871,0x2b839e4e,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.CompileFullCode",49346
+code-creation,LazyCompile,0,0x2b83dea0,536,"sjcl.bitArray.clamp bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339b30,~
+timer-event-end,"V8.CompileLazy",49390
+timer-event-start,"V8.ParseLazy",49402
+timer-event-end,"V8.ParseLazy",49416
+timer-event-start,"V8.CompileLazy",49421
+timer-event-start,"V8.CompileFullCode",49426
+timer-event-end,"V8.CompileFullCode",49438
+code-creation,LazyCompile,0,0x2b83e0c0,248,"ceil native math.js:81",0x442222fc,~
+timer-event-end,"V8.CompileLazy",49450
+timer-event-start,"V8.ParseLazy",49466
+timer-event-end,"V8.ParseLazy",49529
+timer-event-start,"V8.CompileLazy",49535
+timer-event-start,"V8.CompileFullCode",49544
+code-creation,Stub,2,0x2b83e1c0,647,"FastCloneShallowArrayStub"
+code-creation,Stub,12,0x2b83e460,88,"BinaryOpStub_SHL_Alloc_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b83e4c0,88,"BinaryOpStub_BIT_AND_OverwriteLeft_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b83e520,88,"BinaryOpStub_BIT_XOR_OverwriteLeft_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",49801
+code-creation,LazyCompile,0,0x2b83e580,3002,"sjcl.cipher.aes bsuite/kraken-once/stanford-crypto-ccm.js:4",0x2f339830,~
+timer-event-end,"V8.CompileLazy",49816
+timer-event-start,"V8.ParseLazy",49829
+timer-event-end,"V8.ParseLazy",49886
+timer-event-start,"V8.CompileLazy",49893
+timer-event-start,"V8.CompileFullCode",49902
+code-creation,Stub,12,0x2b83f140,88,"BinaryOpStub_BIT_XOR_OverwriteRight_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",49958
+code-creation,LazyCompile,0,0x2b83f1a0,2528,"sjcl.cipher.aes.w bsuite/kraken-once/stanford-crypto-ccm.js:6",0x2f339950,~
+timer-event-end,"V8.CompileLazy",49972
+code-creation,Stub,12,0x2b83fb80,167,"BinaryOpStub_SHL_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b83fc40,155,"BinaryOpStub_SAR_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b83fce0,167,"BinaryOpStub_MUL_OverwriteLeft_Smi+Smi"
+code-creation,Stub,12,0x2b83fda0,146,"BinaryOpStub_BIT_XOR_OverwriteLeft_Smi+Smi"
+code-creation,Stub,2,0x2b83fe40,1808,"RecordWriteStub"
+code-creation,Stub,2,0x2b840560,554,"KeyedStoreElementStub"
+code-creation,KeyedStoreIC,10,0x2b8407a0,91,""
+code-creation,Stub,12,0x2b840800,146,"BinaryOpStub_BIT_XOR_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b8408a0,146,"BinaryOpStub_BIT_XOR_OverwriteRight_Smi+Smi"
+tick,0x82d1790,50347,0,0xff81fdb8,0,0x2b83f388,0x2b83e64a,0x2b839e65,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,12,0x2b840940,383,"BinaryOpStub_BIT_XOR_OverwriteLeft_Smi+Int32"
+code-creation,Stub,12,0x2b840ac0,375,"BinaryOpStub_SHL_Alloc_Int32+Smi"
+code-creation,Stub,12,0x2b840c40,325,"BinaryOpStub_SHR_Alloc_Int32+Smi"
+code-creation,Stub,12,0x2b840da0,167,"BinaryOpStub_SHR_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b840e60,383,"BinaryOpStub_BIT_XOR_OverwriteLeft_Int32+Smi"
+code-creation,Stub,2,0x2b840fe0,794,"ElementsTransitionAndStoreStub"
+code-creation,KeyedStorePolymorphicIC,10,0x2b841300,107,""
+code-creation,KeyedStorePolymorphicIC,10,0x2b841300,107,"args_count: 0"
+code-creation,Stub,2,0x2b841380,204,"KeyedLoadElementStub"
+code-creation,KeyedLoadIC,6,0x2b841460,91,""
+code-creation,Stub,2,0x2b8414c0,405,"ElementsTransitionAndStoreStub"
+code-creation,Stub,2,0x2b841660,554,"KeyedStoreElementStub"
+code-creation,KeyedStorePolymorphicIC,10,0x2b8418a0,107,""
+code-creation,KeyedStorePolymorphicIC,10,0x2b8418a0,107,"args_count: 0"
+code-creation,Stub,12,0x2b841920,233,"BinaryOpStub_MUL_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b841a20,407,"BinaryOpStub_BIT_XOR_OverwriteLeft_Number+Smi"
+code-creation,Stub,12,0x2b841bc0,407,"BinaryOpStub_BIT_XOR_OverwriteLeft_Smi+Number"
+code-creation,Stub,12,0x2b841d60,355,"BinaryOpStub_BIT_XOR_OverwriteLeft_Int32+Int32"
+code-creation,Stub,12,0x2b841ee0,379,"BinaryOpStub_BIT_XOR_OverwriteLeft_Int32+Number"
+code-creation,Stub,15,0x2b842060,144,"ToBooleanStub(Undefined,Smi)"
+code-creation,Stub,2,0x2b842100,236,"KeyedStoreElementStub"
+code-creation,KeyedStoreIC,10,0x2b842200,91,""
+code-creation,CallIC,7,0x2b842260,136,"slice"
+code-creation,CallMegamorphic,7,0x2b842300,685,"args_count: 1"
+code-creation,Stub,12,0x2b8425c0,146,"BinaryOpStub_ADD_OverwriteLeft_Smi+Smi"
+code-creation,Stub,12,0x2b842660,148,"BinaryOpStub_SUB_Alloc_Smi+Smi"
+code-creation,Stub,2,0x2b842700,301,"KeyedLoadElementStub"
+code-creation,KeyedLoadIC,6,0x2b842840,91,""
+tick,0x817d391,51438,0,0xff81f9a4,0,0x2b83e81e,0x2b839e65,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,12,0x2b8428a0,190,"BinaryOpStub_MOD_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b842960,146,"BinaryOpStub_BIT_AND_OverwriteLeft_Smi+Smi"
+code-creation,Stub,12,0x2b842a00,347,"BinaryOpStub_BIT_XOR_Alloc_Int32+Int32"
+code-creation,Stub,12,0x2b842b60,214,"BinaryOpStub_SHL_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b842c40,375,"BinaryOpStub_SAR_Alloc_Int32+Smi"
+code-creation,Stub,12,0x2b842dc0,375,"BinaryOpStub_BIT_AND_Alloc_Int32+Smi"
+code-creation,CallIC,7,0x2b842f40,147,"replace"
+code-creation,Stub,2,0x2b842fe0,76,"LoadFieldStub"
+code-creation,LoadIC,5,0x2b843040,93,"lastIndex"
+code-creation,Stub,2,0x2b8430a0,76,"LoadFieldStub"
+code-creation,LoadIC,5,0x2b843100,93,"global"
+code-creation,LoadIC,5,0x2b843160,103,"lastMatchInfoOverride"
+code-creation,LoadIC,5,0x2b8431e0,103,"lastMatchInfo"
+code-creation,LoadIC,5,0x2b843260,103,"sjcl"
+code-creation,LoadIC,5,0x2b8432e0,93,"bitArray"
+code-creation,CallIC,7,0x2b843340,113,"clamp"
+code-creation,LoadIC,5,0x2b8433c0,93,"length"
+code-creation,CallIC,7,0x2b843420,113,"ceil"
+code-creation,CallIC,7,0x2b8434a0,136,"slice"
+code-creation,Stub,12,0x2b843540,264,"BinaryOpStub_DIV_Alloc_Smi+Smi"
+code-creation,Stub,12,0x2b843660,407,"BinaryOpStub_SAR_OverwriteRight_Number+Smi"
+code-creation,Stub,12,0x2b843800,383,"BinaryOpStub_BIT_AND_OverwriteRight_Int32+Smi"
+timer-event-start,"V8.ParseLazy",51907
+timer-event-end,"V8.ParseLazy",51924
+timer-event-start,"V8.CompileLazy",51930
+timer-event-start,"V8.CompileFullCode",51935
+code-creation,Stub,12,0x2b843980,88,"BinaryOpStub_SHL_OverwriteRight_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b8439e0,88,"BinaryOpStub_ADD_OverwriteRight_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",51966
+code-creation,LazyCompile,0,0x2b843a40,288,"sjcl.bitArray.partial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339b90,~
+timer-event-end,"V8.CompileLazy",51979
+code-creation,Stub,12,0x2b843b60,375,"BinaryOpStub_BIT_OR_Alloc_Int32+Smi"
+code-creation,Stub,12,0x2b843ce0,247,"BinaryOpStub_MUL_Alloc_Smi+Number"
+code-creation,Stub,12,0x2b843de0,268,"BinaryOpStub_ADD_OverwriteRight_Int32+Number"
+code-creation,Stub,2,0x2b843f00,240,"KeyedStoreElementStub"
+code-creation,KeyedStoreIC,10,0x2b844000,91,""
+code-creation,CallMiss,7,0x2b844060,178,"args_count: 3"
+code-creation,CallIC,7,0x2b844120,113,"partial"
+timer-event-start,"V8.ParseLazy",52165
+timer-event-end,"V8.ParseLazy",52210
+timer-event-start,"V8.CompileLazy",52217
+timer-event-start,"V8.CompileFullCode",52225
+code-creation,Stub,12,0x2b8441a0,88,"BinaryOpStub_SHR_OverwriteRight_Uninitialized+Uninitialized"
+code-creation,CallInitialize,7,0x2b844200,178,"args_count: 6"
+timer-event-end,"V8.CompileFullCode",52278
+code-creation,LazyCompile,0,0x2b8442c0,1057,"sjcl.mode.ccm.encrypt bsuite/kraken-once/stanford-crypto-ccm.js:19",0x2f33a250,~
+timer-event-end,"V8.CompileLazy",52296
+timer-event-start,"V8.ParseLazy",52306
+timer-event-end,"V8.ParseLazy",52324
+timer-event-start,"V8.CompileLazy",52329
+timer-event-start,"V8.CompileFullCode",52334
+timer-event-end,"V8.CompileFullCode",52349
+code-creation,LazyCompile,0,0x2b844700,336,"sjcl.bitArray.bitLength bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339ad0,~
+timer-event-end,"V8.CompileLazy",52362
+timer-event-start,"V8.ParseLazy",52375
+timer-event-end,"V8.ParseLazy",52388
+timer-event-start,"V8.CompileLazy",52392
+timer-event-start,"V8.CompileFullCode",52398
+timer-event-end,"V8.CompileFullCode",52420
+code-creation,LazyCompile,0,0x2b844860,236,"sjcl.bitArray.getPartial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339bf0,~
+timer-event-end,"V8.CompileLazy",52433
+code-creation,Stub,12,0x2b844960,264,"BinaryOpStub_DIV_Alloc_Int32+Number"
+timer-event-start,"V8.ParseLazy",52455
+tick,0x8092495,52475,0,0xff81fcd0,2,0x2b844833,0x2b84437f,0x2b83a0cc,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.ParseLazy",52539
+timer-event-start,"V8.CompileLazy",52558
+timer-event-start,"V8.CompileFullCode",52577
+timer-event-end,"V8.CompileFullCode",52590
+code-creation,LazyCompile,0,0x2b844a80,248,"round native math.js:193",0x4422265c,~
+timer-event-end,"V8.CompileLazy",52602
+code-creation,CallIC,7,0x2b844b80,113,"getPartial"
+code-creation,Stub,12,0x2b844c00,238,"BinaryOpStub_DIV_Alloc_Number+Number"
+code-creation,CallIC,7,0x2b844d00,113,"round"
+code-creation,Stub,12,0x2b844d80,167,"BinaryOpStub_SHR_OverwriteRight_Smi+Smi"
+code-creation,CallPreMonomorphic,7,0x2b844e40,178,"args_count: 6"
+timer-event-start,"V8.ParseLazy",52676
+timer-event-end,"V8.ParseLazy",52738
+timer-event-start,"V8.CompileLazy",52745
+timer-event-start,"V8.CompileFullCode",52753
+code-creation,Stub,12,0x2b844f00,88,"BinaryOpStub_SHL_OverwriteLeft_Uninitialized+Uninitialized"
+code-creation,Stub,12,0x2b844f60,88,"BinaryOpStub_BIT_OR_OverwriteRight_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",52818
+code-creation,LazyCompile,0,0x2b844fc0,1838,"sjcl.mode.ccm.G bsuite/kraken-once/stanford-crypto-ccm.js:20",0x2f33a310,~
+timer-event-end,"V8.CompileLazy",52833
+code-creation,Stub,13,0x2b845700,241,"CompareICStub"
+code-creation,Stub,12,0x2b845800,167,"BinaryOpStub_SHL_OverwriteLeft_Smi+Smi"
+code-creation,Stub,12,0x2b8458c0,145,"BinaryOpStub_BIT_OR_OverwriteRight_Smi+Smi"
+code-creation,Stub,12,0x2b845960,145,"BinaryOpStub_BIT_OR_OverwriteLeft_Smi+Smi"
+code-creation,Stub,12,0x2b845a00,167,"BinaryOpStub_SHL_OverwriteRight_Smi+Smi"
+timer-event-start,"V8.ParseLazy",52912
+timer-event-end,"V8.ParseLazy",52936
+timer-event-start,"V8.CompileLazy",52941
+timer-event-start,"V8.CompileFullCode",52947
+timer-event-end,"V8.CompileFullCode",52966
+code-creation,LazyCompile,0,0x2b845ac0,560,"sjcl.bitArray.concat bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339a70,~
+timer-event-end,"V8.CompileLazy",52980
+code-creation,Stub,12,0x2b845d00,399,"BinaryOpStub_BIT_OR_Alloc_Number+Smi"
+timer-event-start,"V8.ParseLazy",53013
+timer-event-end,"V8.ParseLazy",53049
+timer-event-start,"V8.CompileLazy",53055
+timer-event-start,"V8.CompileFullCode",53062
+timer-event-end,"V8.CompileFullCode",53095
+code-creation,LazyCompile,0,0x2b845ea0,1126,"sjcl.bitArray.P bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339cb0,~
+timer-event-end,"V8.CompileLazy",53110
+code-creation,Stub,13,0x2b846320,485,"CompareICStub"
+code-creation,Stub,12,0x2b846520,383,"BinaryOpStub_BIT_OR_OverwriteRight_Int32+Smi"
+code-creation,Stub,12,0x2b8466a0,383,"BinaryOpStub_SHL_OverwriteRight_Int32+Smi"
+code-creation,Stub,12,0x2b846820,407,"BinaryOpStub_BIT_OR_OverwriteRight_Number+Smi"
+timer-event-start,"V8.ParseLazy",53194
+timer-event-end,"V8.ParseLazy",53206
+timer-event-start,"V8.CompileLazy",53211
+timer-event-start,"V8.CompileFullCode",53216
+timer-event-end,"V8.CompileFullCode",53226
+code-creation,LazyCompile,0,0x2b8469c0,184,"sjcl.cipher.aes.encrypt bsuite/kraken-once/stanford-crypto-ccm.js:6",0x2f339890,~
+timer-event-end,"V8.CompileLazy",53243
+timer-event-start,"V8.ParseLazy",53249
+timer-event-end,"V8.ParseLazy",53325
+timer-event-start,"V8.CompileLazy",53332
+timer-event-start,"V8.CompileFullCode",53343
+code-creation,Stub,12,0x2b846a80,88,"BinaryOpStub_SUB_OverwriteLeft_Uninitialized+Uninitialized"
+tick,0x8376055,53535,0,0x81bab7d,2,0x2b846a46,0x2b845312,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,2,0x2b846ae0,683,"FastCloneShallowArrayStub"
+code-creation,Stub,11,0x2b846da0,132,"UnaryOpStubMinus(None)"
+timer-event-end,"V8.CompileFullCode",53746
+code-creation,LazyCompile,0,0x2b846e40,3418,"sjcl.cipher.aes.H bsuite/kraken-once/stanford-crypto-ccm.js:7",0x2f3399b0,~
+timer-event-end,"V8.CompileLazy",53763
+code-creation,Stub,12,0x2b847ba0,375,"BinaryOpStub_BIT_XOR_Alloc_Smi+Int32"
+code-creation,Stub,12,0x2b847d20,375,"BinaryOpStub_BIT_XOR_Alloc_Int32+Smi"
+code-creation,Stub,12,0x2b847ea0,148,"BinaryOpStub_SUB_OverwriteLeft_Smi+Smi"
+code-creation,Stub,15,0x2b847f40,164,"ToBooleanStub(Smi,HeapNumber)"
+code-creation,CallMiss,7,0x2b848000,178,"args_count: 4"
+code-creation,CallIC,7,0x2b8480c0,113,"P"
+code-creation,LoadIC,5,0x2b848140,103,"undefined"
+timer-event-start,"V8.ParseLazy",54007
+timer-event-end,"V8.ParseLazy",54027
+timer-event-start,"V8.CompileLazy",54032
+timer-event-start,"V8.CompileFullCode",54038
+timer-event-end,"V8.CompileFullCode",54052
+code-creation,LazyCompile,0,0x2b8481c0,388,"sjcl.bitArray.k bsuite/kraken-once/stanford-crypto-ccm.js:11",0x2f339d10,~
+timer-event-end,"V8.CompileLazy",54065
+code-creation,CallIC,7,0x2b848360,132,"H"
+code-creation,LoadIC,5,0x2b848400,93,"a"
+code-creation,Stub,2,0x2b848460,95,"h"
+code-creation,LoadIC,5,0x2b8484c0,93,"h"
+code-creation,CallIC,7,0x2b848520,132,"encrypt"
+code-creation,Stub,12,0x2b8485c0,371,"BinaryOpStub_BIT_XOR_Alloc_Int32+Number"
+timer-event-start,"V8.ParseLazy",54281
+timer-event-end,"V8.ParseLazy",54332
+timer-event-start,"V8.CompileLazy",54339
+timer-event-start,"V8.CompileFullCode",54347
+code-creation,Stub,2,0x2b848740,663,"FastCloneShallowArrayStub"
+timer-event-end,"V8.CompileFullCode",54560
+code-creation,LazyCompile,0,0x2b8489e0,1221,"sjcl.mode.ccm.I bsuite/kraken-once/stanford-crypto-ccm.js:21",0x2f33a370,~
+timer-event-end,"V8.CompileLazy",54577
+tick,0x82f2dd2,54590,0,0xff81f67c,2,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,12,0x2b848ec0,371,"BinaryOpStub_BIT_XOR_Alloc_Number+Int32"
+timer-event-start,"V8.ParseLazy",54663
+timer-event-end,"V8.ParseLazy",54685
+timer-event-start,"V8.CompileLazy",54691
+timer-event-start,"V8.CompileFullCode",54697
+code-creation,Stub,12,0x2b849040,88,"BinaryOpStub_SUB_OverwriteRight_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",54724
+code-creation,LazyCompile,0,0x2b8490a0,392,"sjcl.bitArray.bitSlice bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339a10,~
+timer-event-end,"V8.CompileLazy",54737
+code-creation,Stub,12,0x2b849240,148,"BinaryOpStub_SUB_OverwriteRight_Smi+Smi"
+code-creation,Stub,13,0x2b8492e0,494,"CompareICStub"
+code-creation,CallMegamorphic,7,0x2b8494e0,685,"args_count: 2"
+code-creation,Stub,12,0x2b8497a0,246,"BinaryOpStub_ADD_Alloc_Number+Smi"
+code-creation,LoadPolymorphicIC,5,0x2b8498a0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b849920,105,"length"
+timer-event-start,"V8.ParseLazy",54933
+timer-event-end,"V8.ParseLazy",54956
+timer-event-start,"V8.CompileLazy",54962
+timer-event-start,"V8.CompileFullCode",54968
+timer-event-end,"V8.CompileFullCode",54989
+code-creation,LazyCompile,0,0x2b8499a0,585,"sjcl.bitArray.equal bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339c50,~
+timer-event-end,"V8.CompileLazy",55003
+code-creation,Stub,12,0x2b849c00,395,"BinaryOpStub_BIT_XOR_Alloc_Number+Number"
+code-creation,Stub,12,0x2b849da0,133,"BinaryOpStub_ADD_Alloc_String+Smi"
+code-creation,Stub,12,0x2b849e40,133,"BinaryOpStub_ADD_OverwriteLeft_String+Smi"
+timer-event-start,"V8.ParseLazy",55131
+timer-event-end,"V8.ParseLazy",55149
+timer-event-start,"V8.CompileLazy",55155
+timer-event-start,"V8.CompileFullCode",55160
+timer-event-end,"V8.CompileFullCode",55177
+code-creation,LazyCompile,0,0x2b849ee0,292,"sjcl.test.TestCase.require bsuite/kraken-once/stanford-crypto-ccm.js:131",0x2f33b390,~
+timer-event-end,"V8.CompileLazy",55190
+timer-event-start,"V8.ParseLazy",55198
+timer-event-end,"V8.ParseLazy",55206
+timer-event-start,"V8.CompileLazy",55211
+timer-event-start,"V8.CompileFullCode",55216
+timer-event-end,"V8.CompileFullCode",55228
+code-creation,LazyCompile,0,0x2b84a020,208,"sjcl.test.TestCase.pass bsuite/kraken-once/stanford-crypto-ccm.js:110",0x2f33b270,~
+timer-event-end,"V8.CompileLazy",55240
+code-creation,StoreIC,9,0x2b84a100,103,"passes"
+timer-event-start,"V8.ParseLazy",55261
+timer-event-end,"V8.ParseLazy",55307
+timer-event-start,"V8.CompileLazy",55313
+timer-event-start,"V8.CompileFullCode",55321
+code-creation,Stub,12,0x2b84a180,88,"BinaryOpStub_DIV_OverwriteLeft_Uninitialized+Uninitialized"
+timer-event-end,"V8.CompileFullCode",55365
+code-creation,LazyCompile,0,0x2b84a1e0,1229,"sjcl.mode.ccm.decrypt bsuite/kraken-once/stanford-crypto-ccm.js:19",0x2f33a2b0,~
+timer-event-end,"V8.CompileLazy",55379
+code-creation,CallIC,7,0x2b84a6c0,136,"slice"
+code-creation,CallIC,7,0x2b84a760,128,"P"
+code-creation,LoadPolymorphicIC,5,0x2b84a7e0,105,"length"
+code-creation,KeyedLoadPolymorphicIC,6,0x2b84a860,105,""
+code-creation,CallIC,7,0x2b84a8e0,656,"push"
+code-creation,Stub,12,0x2b84ab80,407,"BinaryOpStub_SHL_OverwriteRight_Number+Smi"
+code-creation,LoadPolymorphicIC,5,0x2b84ad20,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b84ada0,105,"length"
+code-creation,CallIC,7,0x2b84ae20,136,"slice"
+code-creation,Stub,12,0x2b84aec0,196,"BinaryOpStub_DIV_OverwriteLeft_Smi+Smi"
+code-creation,Stub,2,0x2b84afa0,70,"k"
+code-creation,LoadIC,5,0x2b84b000,93,"k"
+code-creation,CallIC,7,0x2b84b060,113,"bitLength"
+code-creation,CallIC,7,0x2b84b0e0,128,"partial"
+code-creation,CallIC,7,0x2b84b160,113,"concat"
+code-creation,LoadPolymorphicIC,5,0x2b84b1e0,105,"length"
+code-creation,CallIC,7,0x2b84b260,136,"concat"
+code-creation,CallIC,7,0x2b84b300,113,"bitSlice"
+code-creation,CallIC,7,0x2b84b380,136,"concat"
+tick,0x8118ca4,55654,0,0x90ec418,0,0x2b848b2e,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,CallIC,7,0x2b84b420,136,"slice"
+code-creation,StoreIC,9,0x2b84b4c0,138,"tag"
+code-creation,StoreIC,9,0x2b84b560,138,"data"
+code-creation,Stub,12,0x2b84b600,214,"BinaryOpStub_SHL_OverwriteRight_Smi+Smi"
+code-creation,LoadPolymorphicIC,5,0x2b84b6e0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b84b760,105,"length"
+code-creation,CallMiss,7,0x2b84b7e0,178,"args_count: 0"
+code-creation,CallIC,7,0x2b84b8a0,132,"pass"
+code-creation,Stub,2,0x2b84b940,76,"LoadFieldStub"
+code-creation,LoadIC,5,0x2b84b9a0,93,"passes"
+code-creation,LoadIC,5,0x2b84ba00,93,"key"
+code-creation,LoadIC,5,0x2b84ba60,93,"cipher"
+code-creation,Stub,2,0x2b84bac0,70,"aes"
+code-creation,LoadIC,5,0x2b84bb20,93,"aes"
+code-creation,CallIC,7,0x2b84bb80,113,"toBits"
+code-creation,Stub,2,0x2b84bc00,95,"h"
+code-creation,LoadIC,5,0x2b84bc60,93,"h"
+code-creation,StoreIC,9,0x2b84bcc0,246,"a"
+code-creation,LoadIC,5,0x2b84bdc0,93,"iv"
+code-creation,Stub,2,0x2b84be20,76,"LoadFieldStub"
+code-creation,LoadIC,5,0x2b84be80,93,"adata"
+code-creation,LoadIC,5,0x2b84bee0,93,"pt"
+code-creation,Stub,2,0x2b84bf40,76,"LoadFieldStub"
+code-creation,LoadIC,5,0x2b84bfa0,93,"ct"
+code-creation,LoadIC,5,0x2b84c000,93,"tag"
+code-creation,LoadIC,5,0x2b84c060,93,"mode"
+code-creation,LoadIC,5,0x2b84c0c0,93,"ccm"
+code-creation,CallMiss,7,0x2b84c120,178,"args_count: 5"
+code-creation,CallIC,7,0x2b84c1e0,113,"encrypt"
+code-creation,CallMiss,7,0x2b84c260,178,"args_count: 6"
+code-creation,CallIC,7,0x2b84c320,113,"G"
+code-creation,CallIC,7,0x2b84c3a0,193,"pop"
+code-creation,CallIC,7,0x2b84c480,113,"I"
+code-creation,LoadIC,5,0x2b84c500,93,"data"
+code-creation,LoadIC,5,0x2b84c560,93,"tag"
+code-creation,CallIC,7,0x2b84c5c0,113,"equal"
+code-creation,CallIC,7,0x2b84c640,132,"require"
+code-creation,CallIC,7,0x2b84c6e0,113,"decrypt"
+code-creation,CallIC,7,0x2b84c760,128,"bitSlice"
+code-creation,CallMegamorphic,7,0x2b84c7e0,685,"args_count: 0"
+tick,0xf776d430,56728,0,0x90ec418,0,0x2b84a349,0x2b83a281,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,15,0x2b84caa0,172,"ToBooleanStub(Undefined,Smi,HeapNumber)"
+code-creation,CallIC,7,0x2b84cb60,193,"pop"
+code-creation,Stub,2,0x2b84cc40,725,"ElementsTransitionAndStoreStub"
+code-creation,Stub,2,0x2b84cf20,1800,"RecordWriteStub"
+code-creation,Stub,2,0x2b84d640,578,"KeyedStoreElementStub"
+code-creation,KeyedStorePolymorphicIC,10,0x2b84d8a0,107,""
+code-creation,KeyedStorePolymorphicIC,10,0x2b84d8a0,107,"args_count: 0"
+timer-event-start,"V8.RecompileSynchronous",57494
+timer-event-start,"V8.ParseLazy",57505
+timer-event-end,"V8.ParseLazy",57586
+code-creation,LazyCompile,0,0x2b84d920,3418,"sjcl.cipher.aes.H bsuite/kraken-once/stanford-crypto-ccm.js:7",0x2f3399b0,~
+tick,0x8092457,57778,0,0x19e,2,0x2b846a46,0x2b8455f6,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.RecompileSynchronous",57904
+timer-event-start,"V8.RecompileParallel",57929
+code-creation,Stub,2,0x2b84e680,559,"ElementsTransitionAndStoreStub"
+code-creation,KeyedStorePolymorphicIC,10,0x2b84e8c0,107,""
+code-creation,KeyedStorePolymorphicIC,10,0x2b84e8c0,107,"args_count: 0"
+code-creation,LoadPolymorphicIC,5,0x2b84e940,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b84e9c0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b84ea40,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b84eac0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b84eb40,105,"length"
+timer-event-start,"V8.RecompileSynchronous",58447
+timer-event-start,"V8.ParseLazy",58457
+timer-event-end,"V8.ParseLazy",58501
+code-creation,LazyCompile,0,0x2b84ebc0,1096,"parseInt native v8natives.js:130",0x4421ec1c,~
+timer-event-end,"V8.RecompileSynchronous",58637
+timer-event-start,"V8.GCScavenger",58779
+timer-event-start,"V8.External",58787
+timer-event-end,"V8.External",58791
+tick,0x810f40c,58868,0,0x0,1
+timer-event-start,"V8.External",59191
+timer-event-end,"V8.External",59200
+timer-event-end,"V8.GCScavenger",59205
+timer-event-end,"V8.RecompileParallel",59219
+timer-event-start,"V8.RecompileParallel",59254
+timer-event-start,"V8.RecompileSynchronous",59271
+code-creation,LazyCompile,1,0x2b84f020,4592,"sjcl.cipher.aes.H bsuite/kraken-once/stanford-crypto-ccm.js:7",0x2f3399b0,*
+timer-event-end,"V8.RecompileSynchronous",59549
+timer-event-end,"V8.RecompileParallel",59567
+timer-event-start,"V8.RecompileSynchronous",59590
+code-creation,LazyCompile,1,0x2b850220,1662,"parseInt native v8natives.js:130",0x4421ec1c,*
+timer-event-end,"V8.RecompileSynchronous",59672
+timer-event-start,"V8.RecompileSynchronous",59682
+timer-event-start,"V8.ParseLazy",59687
+timer-event-end,"V8.ParseLazy",59701
+code-creation,LazyCompile,0,0x2b8508a0,236,"sjcl.bitArray.getPartial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339bf0,~
+timer-event-end,"V8.RecompileSynchronous",59750
+timer-event-start,"V8.RecompileParallel",59776
+timer-event-start,"V8.RecompileSynchronous",59811
+timer-event-start,"V8.ParseLazy",59820
+timer-event-end,"V8.ParseLazy",59838
+code-creation,LazyCompile,0,0x2b8509a0,388,"sjcl.bitArray.k bsuite/kraken-once/stanford-crypto-ccm.js:11",0x2f339d10,~
+timer-event-end,"V8.RecompileParallel",59909
+timer-event-start,"V8.RecompileParallel",59926
+timer-event-end,"V8.RecompileSynchronous",59933
+timer-event-start,"V8.RecompileSynchronous",59950
+tick,0xf776d430,59966,0,0x90ec418,2,0x2b8455e6,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,LazyCompile,1,0x2b850b40,536,"sjcl.bitArray.getPartial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339bf0,*
+timer-event-end,"V8.RecompileSynchronous",60077
+timer-event-start,"V8.RecompileSynchronous",60141
+timer-event-start,"V8.ParseLazy",60149
+timer-event-end,"V8.RecompileParallel",60177
+timer-event-end,"V8.ParseLazy",60195
+code-creation,LazyCompile,0,0x2b850d60,960,"substr native string.js:749",0x44216608,~
+timer-event-end,"V8.RecompileSynchronous",60329
+timer-event-start,"V8.RecompileParallel",60356
+code-deopt,60375,544
+timer-event-start,"V8.RecompileSynchronous",60409
+code-creation,LazyCompile,1,0x2b851120,1534,"sjcl.bitArray.k bsuite/kraken-once/stanford-crypto-ccm.js:11",0x2f339d10,*
+timer-event-end,"V8.RecompileSynchronous",60474
+code-creation,LoadPolymorphicIC,5,0x2b851720,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b8517a0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b851820,105,"length"
+timer-event-end,"V8.RecompileParallel",60691
+timer-event-start,"V8.RecompileSynchronous",60716
+code-creation,LazyCompile,1,0x2b8518a0,1792,"substr native string.js:749",0x44216608,*
+timer-event-end,"V8.RecompileSynchronous",60803
+tick,0x2b849c4b,60997,0,0x2b849afa,0,0x2b83a0df,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.RecompileSynchronous",61042
+timer-event-start,"V8.ParseLazy",61054
+timer-event-end,"V8.ParseLazy",61066
+code-creation,LazyCompile,0,0x2b851fa0,184,"sjcl.cipher.aes.encrypt bsuite/kraken-once/stanford-crypto-ccm.js:6",0x2f339890,~
+timer-event-end,"V8.RecompileSynchronous",61112
+timer-event-start,"V8.RecompileParallel",61139
+timer-event-start,"V8.RecompileSynchronous",61159
+timer-event-start,"V8.ParseLazy",61168
+timer-event-end,"V8.ParseLazy",61186
+timer-event-end,"V8.RecompileParallel",61201
+code-creation,LazyCompile,0,0x2b852060,336,"sjcl.bitArray.bitLength bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339ad0,~
+timer-event-start,"V8.ParseLazy",61249
+timer-event-end,"V8.ParseLazy",61264
+timer-event-end,"V8.RecompileSynchronous",61290
+timer-event-start,"V8.RecompileSynchronous",61309
+timer-event-start,"V8.RecompileParallel",61317
+code-creation,LazyCompile,1,0x2b8521c0,196,"sjcl.cipher.aes.encrypt bsuite/kraken-once/stanford-crypto-ccm.js:6",0x2f339890,*
+timer-event-end,"V8.RecompileSynchronous",61348
+timer-event-start,"V8.RecompileSynchronous",61374
+timer-event-start,"V8.ParseLazy",61381
+timer-event-end,"V8.ParseLazy",61394
+timer-event-end,"V8.RecompileSynchronous",61418
+timer-event-start,"V8.RecompileSynchronous",61424
+timer-event-start,"V8.ParseLazy",61429
+timer-event-end,"V8.ParseLazy",61442
+code-creation,LazyCompile,0,0x2b8522a0,248,"round native math.js:193",0x4422265c,~
+timer-event-end,"V8.RecompileParallel",61471
+timer-event-start,"V8.RecompileParallel",61480
+timer-event-end,"V8.RecompileSynchronous",61487
+timer-event-start,"V8.RecompileSynchronous",61512
+timer-event-end,"V8.RecompileParallel",61536
+timer-event-start,"V8.RecompileParallel",61543
+code-creation,LazyCompile,1,0x2b8523a0,888,"sjcl.bitArray.bitLength bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339ad0,*
+timer-event-end,"V8.RecompileSynchronous",61565
+timer-event-start,"V8.RecompileSynchronous",61570
+code-creation,LazyCompile,1,0x2b852720,536,"sjcl.bitArray.getPartial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339bf0,*
+timer-event-end,"V8.RecompileSynchronous",61599
+timer-event-start,"V8.RecompileSynchronous",61606
+timer-event-end,"V8.RecompileParallel",61610
+code-creation,LazyCompile,1,0x2b852940,242,"round native math.js:193",0x4422265c,*
+timer-event-end,"V8.RecompileSynchronous",61629
+code-creation,LoadPolymorphicIC,5,0x2b852a40,105,"length"
+timer-event-start,"V8.RecompileSynchronous",61726
+timer-event-start,"V8.ParseLazy",61731
+timer-event-end,"V8.ParseLazy",61757
+code-creation,LazyCompile,0,0x2b852ac0,536,"sjcl.bitArray.clamp bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339b30,~
+timer-event-start,"V8.ParseLazy",61847
+timer-event-end,"V8.ParseLazy",61865
+code-creation,Function,0,0x2b852ce0,288,"sjcl.bitArray.partial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339b90,~
+timer-event-end,"V8.RecompileSynchronous",61926
+timer-event-start,"V8.RecompileSynchronous",61933
+timer-event-start,"V8.ParseLazy",61939
+timer-event-end,"V8.ParseLazy",61953
+timer-event-start,"V8.RecompileParallel",61961
+code-creation,LazyCompile,0,0x2b852e00,248,"ceil native math.js:81",0x442222fc,~
+timer-event-end,"V8.RecompileSynchronous",62019
+tick,0x811e913,62060,0,0xf773bff4,2,0x2b83dfae,0x2b8445e0,0x2b83a0cc,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-deopt,62122,544
+timer-event-end,"V8.RecompileParallel",62287
+timer-event-start,"V8.RecompileParallel",62297
+timer-event-start,"V8.RecompileSynchronous",62309
+timer-event-end,"V8.RecompileParallel",62353
+code-creation,Stub,2,0x2b852f00,1785,"RecordWriteStub"
+code-creation,LazyCompile,1,0x2b853600,1514,"sjcl.bitArray.clamp bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339b30,*
+timer-event-end,"V8.RecompileSynchronous",62415
+timer-event-start,"V8.RecompileSynchronous",62421
+code-creation,LazyCompile,1,0x2b853c00,242,"ceil native math.js:81",0x442222fc,*
+timer-event-end,"V8.RecompileSynchronous",62445
+code-creation,LoadPolymorphicIC,5,0x2b853d00,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b853d80,105,"length"
+timer-event-start,"V8.RecompileSynchronous",63048
+timer-event-start,"V8.ParseLazy",63067
+timer-event-end,"V8.ParseLazy",63085
+timer-event-end,"V8.RecompileSynchronous",63117
+tick,0xf776d430,63132,0,0x90ec418,0,0x2b8462cc,0x2b845cd7,0x2b848b0a,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.RecompileParallel",63203
+timer-event-end,"V8.RecompileParallel",63315
+timer-event-start,"V8.RecompileSynchronous",63329
+code-creation,LazyCompile,1,0x2b853e00,644,"sjcl.bitArray.partial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339b90,*
+timer-event-end,"V8.RecompileSynchronous",63379
+timer-event-start,"V8.RecompileSynchronous",63494
+timer-event-start,"V8.ParseLazy",63503
+timer-event-end,"V8.ParseLazy",63517
+timer-event-end,"V8.RecompileSynchronous",63544
+timer-event-start,"V8.RecompileParallel",63572
+timer-event-start,"V8.RecompileSynchronous",63641
+timer-event-start,"V8.ParseLazy",63651
+timer-event-end,"V8.RecompileParallel",63664
+timer-event-end,"V8.ParseLazy",63678
+code-creation,LazyCompile,0,0x2b8540a0,560,"sjcl.bitArray.concat bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339a70,~
+timer-event-start,"V8.ParseLazy",63757
+timer-event-end,"V8.ParseLazy",63772
+timer-event-start,"V8.ParseLazy",63808
+timer-event-end,"V8.ParseLazy",63848
+code-creation,Function,0,0x2b8542e0,1126,"sjcl.bitArray.P bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339cb0,~
+timer-event-start,"V8.ParseLazy",63977
+timer-event-end,"V8.ParseLazy",63994
+timer-event-start,"V8.ParseLazy",64023
+timer-event-end,"V8.ParseLazy",64039
+timer-event-end,"V8.RecompileSynchronous",64072
+timer-event-start,"V8.RecompileSynchronous",64079
+timer-event-start,"V8.RecompileParallel",64099
+code-creation,LazyCompile,1,0x2b854760,536,"sjcl.bitArray.getPartial bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339bf0,*
+timer-event-end,"V8.RecompileSynchronous",64194
+tick,0xf776d430,64209,0,0x4059,2,0x2b845c29,0x2b848b0a,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-deopt,64271,544
+timer-event-start,"V8.RecompileSynchronous",64467
+timer-event-start,"V8.ParseLazy",64476
+timer-event-end,"V8.ParseLazy",64542
+code-creation,LazyCompile,0,0x2b854980,3002,"sjcl.cipher.aes bsuite/kraken-once/stanford-crypto-ccm.js:4",0x2f339830,~
+timer-event-end,"V8.RecompileSynchronous",64818
+timer-event-end,"V8.RecompileParallel",64871
+timer-event-start,"V8.RecompileParallel",64883
+timer-event-start,"V8.RecompileSynchronous",64890
+code-creation,LazyCompile,1,0x2b855540,3364,"sjcl.bitArray.concat bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339a70,*
+timer-event-end,"V8.RecompileSynchronous",65047
+code-deopt,65079,4608
+code-creation,LoadPolymorphicIC,5,0x2b856280,105,"length"
+tick,0x2b8472a7,65264,0,0x52f0b0e1,0,0x2b852252,0x2b848c4b,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,LoadPolymorphicIC,5,0x2b856300,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b856380,105,"length"
+timer-event-start,"V8.GCScavenger",65757
+timer-event-start,"V8.External",65766
+timer-event-end,"V8.External",65770
+timer-event-start,"V8.External",66154
+timer-event-end,"V8.External",66162
+timer-event-end,"V8.GCScavenger",66166
+timer-event-end,"V8.RecompileParallel",66181
+timer-event-start,"V8.RecompileSynchronous",66254
+tick,0x81c09b0,66332,0,0x91632e8,2,0x2b839e65,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,2,0x2b856400,1785,"RecordWriteStub"
+code-creation,Stub,2,0x2b856b00,1785,"RecordWriteStub"
+code-creation,Stub,2,0x2b857200,783,"RecordWriteStub"
+code-creation,Stub,2,0x2b857520,1772,"RecordWriteStub"
+code-creation,Stub,2,0x2b857c20,1785,"RecordWriteStub"
+code-creation,LazyCompile,1,0x2b858320,4397,"sjcl.cipher.aes bsuite/kraken-once/stanford-crypto-ccm.js:4",0x2f339830,*
+timer-event-end,"V8.RecompileSynchronous",66661
+timer-event-start,"V8.RecompileSynchronous",66788
+timer-event-start,"V8.ParseLazy",66797
+timer-event-end,"V8.ParseLazy",66878
+timer-event-end,"V8.RecompileSynchronous",67067
+timer-event-start,"V8.RecompileParallel",67094
+tick,0x2b8473da,67403,0,0x2f392d35,0,0x2b852252,0x2b8455f6,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.RecompileParallel",68064
+timer-event-start,"V8.RecompileSynchronous",68081
+code-creation,LazyCompile,1,0x2b859460,4752,"sjcl.cipher.aes.H bsuite/kraken-once/stanford-crypto-ccm.js:7",0x2f3399b0,*
+timer-event-end,"V8.RecompileSynchronous",68294
+code-creation,LoadPolymorphicIC,5,0x2b85a700,105,"length"
+tick,0x2b85055a,68462,0,0x527b30d9,0,0x2b83a782,0x2b839f55,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",69250
+timer-event-start,"V8.External",69260
+timer-event-end,"V8.External",69264
+timer-event-start,"V8.External",69314
+timer-event-end,"V8.External",69320
+timer-event-end,"V8.GCScavenger",69324
+tick,0x82ec00c,69525,0,0xff81fcf4,0,0x2b85056f,0x2b83a782,0x2b839fd2,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,LoadPolymorphicIC,5,0x2b85a780,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b85a800,117,"length"
+code-creation,LoadPolymorphicIC,5,0x2b85a880,117,"length"
+code-creation,LoadPolymorphicIC,5,0x2b85a900,117,"length"
+code-creation,LoadPolymorphicIC,5,0x2b85a980,117,"length"
+code-creation,LoadPolymorphicIC,5,0x2b85aa00,117,"length"
+tick,0x81168ba,70588,0,0x90d5060,0,0x2b85056f,0x2b83a782,0x2b839f04,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.RecompileSynchronous",71064
+timer-event-start,"V8.ParseLazy",71076
+timer-event-end,"V8.ParseLazy",71094
+code-creation,LazyCompile,0,0x2b85aa80,292,"sjcl.test.TestCase.require bsuite/kraken-once/stanford-crypto-ccm.js:131",0x2f33b390,~
+timer-event-start,"V8.ParseLazy",71142
+timer-event-end,"V8.ParseLazy",71152
+code-creation,Function,0,0x2b85abc0,208,"sjcl.test.TestCase.pass bsuite/kraken-once/stanford-crypto-ccm.js:110",0x2f33b270,~
+timer-event-end,"V8.RecompileSynchronous",71195
+timer-event-start,"V8.RecompileSynchronous",71204
+timer-event-start,"V8.ParseLazy",71210
+timer-event-start,"V8.RecompileParallel",71216
+timer-event-end,"V8.ParseLazy",71228
+timer-event-end,"V8.RecompileSynchronous",71254
+timer-event-end,"V8.RecompileParallel",71304
+timer-event-start,"V8.RecompileParallel",71312
+timer-event-start,"V8.RecompileSynchronous",71316
+code-creation,LazyCompile,1,0x2b85aca0,322,"sjcl.test.TestCase.require bsuite/kraken-once/stanford-crypto-ccm.js:131",0x2f33b390,*
+timer-event-end,"V8.RecompileSynchronous",71361
+timer-event-start,"V8.RecompileSynchronous",71367
+timer-event-end,"V8.RecompileParallel",71373
+code-creation,LazyCompile,1,0x2b85ae00,198,"sjcl.test.TestCase.pass bsuite/kraken-once/stanford-crypto-ccm.js:110",0x2f33b270,*
+timer-event-end,"V8.RecompileSynchronous",71390
+tick,0x2b83c3b1,71653,0,0xffffff6b,0,0x2b83bd35,0x2b83a725,0x2b839f55,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",72513
+timer-event-start,"V8.External",72524
+timer-event-end,"V8.External",72530
+timer-event-start,"V8.External",72583
+timer-event-end,"V8.External",72591
+timer-event-end,"V8.GCScavenger",72596
+tick,0x8116878,72711,0,0x90d5060,0,0x2b85056f,0x2b83a782,0x2b839f04,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,CallIC,7,0x2b85aee0,136,"concat"
+timer-event-start,"V8.RecompileSynchronous",72947
+timer-event-start,"V8.ParseLazy",72956
+timer-event-end,"V8.ParseLazy",72977
+code-creation,LazyCompile,0,0x2b85af80,392,"sjcl.bitArray.bitSlice bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339a10,~
+timer-event-start,"V8.ParseLazy",73044
+timer-event-end,"V8.ParseLazy",73083
+timer-event-start,"V8.ParseLazy",73169
+timer-event-end,"V8.ParseLazy",73185
+timer-event-start,"V8.ParseLazy",73217
+timer-event-end,"V8.ParseLazy",73232
+timer-event-start,"V8.ParseLazy",73263
+timer-event-end,"V8.ParseLazy",73289
+timer-event-start,"V8.ParseLazy",73339
+timer-event-end,"V8.ParseLazy",73356
+timer-event-end,"V8.RecompileSynchronous",73393
+timer-event-start,"V8.RecompileParallel",73422
+tick,0x82eea09,73786,0,0x90de9b0,0,0x2b85056f,0x2b83a782,0x2b839e4e,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.ParseLazy",74228
+timer-event-end,"V8.RecompileParallel",74243
+timer-event-end,"V8.ParseLazy",74259
+timer-event-start,"V8.CompileLazy",74267
+timer-event-start,"V8.CompileFullCode",74273
+timer-event-end,"V8.CompileFullCode",74291
+code-creation,LazyCompile,0,0x2b85b120,332," bsuite/kraken-once/stanford-crypto-ccm.js:55",0x2f33db50,~
+timer-event-end,"V8.CompileLazy",74304
+timer-event-start,"V8.RecompileSynchronous",74351
+code-creation,LazyCompile,1,0x2b85b280,4132,"sjcl.bitArray.bitSlice bsuite/kraken-once/stanford-crypto-ccm.js:9",0x2f339a10,*
+timer-event-end,"V8.RecompileSynchronous",74533
+tick,0x2b85a2b8,74843,0,0xf5,0,0x2b852252,0x2b8454f6,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b84a934,75905,0,0x2b855c42,0,0x2b8446a3,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",76182
+timer-event-start,"V8.External",76193
+timer-event-end,"V8.External",76197
+timer-event-start,"V8.External",76251
+timer-event-end,"V8.External",76258
+timer-event-end,"V8.GCScavenger",76262
+tick,0x81168ba,76974,0,0x90d5060,0,0x2b85056f,0x2b83a782,0x2b839fd2,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x81168ba,78047,0,0x90d5060,0,0x2b85056f,0x2b83a782,0x2b839f55,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.RecompileSynchronous",78403
+timer-event-start,"V8.ParseLazy",78415
+timer-event-end,"V8.ParseLazy",78444
+code-creation,LazyCompile,0,0x2b85c2c0,717,"sjcl.codec.hex.toBits bsuite/kraken-once/stanford-crypto-ccm.js:13",0x2f339e90,~
+timer-event-start,"V8.ParseLazy",78530
+timer-event-end,"V8.ParseLazy",78559
+timer-event-start,"V8.ParseLazy",78614
+timer-event-end,"V8.ParseLazy",78632
+timer-event-end,"V8.RecompileSynchronous",78666
+timer-event-start,"V8.RecompileParallel",78695
+timer-event-end,"V8.RecompileParallel",79073
+timer-event-start,"V8.RecompileSynchronous",79089
+tick,0x2b859d1c,79108,0,0x6,0,0x2b852252,0x2b8455f6,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,2,0x2b85c5a0,1421,"StringAddStub"
+code-creation,LazyCompile,1,0x2b85cb40,2261,"sjcl.codec.hex.toBits bsuite/kraken-once/stanford-crypto-ccm.js:13",0x2f339e90,*
+timer-event-end,"V8.RecompileSynchronous",79251
+timer-event-start,"V8.GCScavenger",79473
+timer-event-start,"V8.External",79482
+timer-event-end,"V8.External",79486
+timer-event-start,"V8.External",79534
+timer-event-end,"V8.External",79540
+timer-event-end,"V8.GCScavenger",79544
+tick,0x2b85b446,80176,0,0x256b20d1,0,0x2b848b8c,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x80c4222,81235,0,0x90d5060,0,0x2b85b578,0x2b84a349,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",82255
+timer-event-start,"V8.External",82266
+timer-event-end,"V8.External",82270
+tick,0x2b858631,82290,0,0x2b80a276,0,0x2b839e65,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.External",82339
+timer-event-end,"V8.External",82349
+timer-event-end,"V8.GCScavenger",82353
+tick,0x2b82f581,83363,0,0x2b84539a,0,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x808cf8f,84440,0,0x90dabb0,0,0x2b85599a,0x2b845482,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",85035
+timer-event-start,"V8.External",85046
+timer-event-end,"V8.External",85050
+timer-event-start,"V8.External",85093
+timer-event-end,"V8.External",85099
+timer-event-end,"V8.GCScavenger",85103
+tick,0x2b829c56,85495,0,0x3e60ce29,0,0x2b852252,0x2b8454f6,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x808b74f,86567,0,0x2f308081,0,0x2b8537a0,0x2b8456a8,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b85d04c,87632,0,0x2b839f55,0,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",87755
+timer-event-start,"V8.External",87766
+timer-event-end,"V8.External",87770
+timer-event-start,"V8.External",87822
+timer-event-end,"V8.External",87829
+timer-event-end,"V8.GCScavenger",87833
+timer-event-start,"V8.RecompileSynchronous",88294
+timer-event-start,"V8.ParseLazy",88303
+timer-event-end,"V8.ParseLazy",88361
+code-creation,LazyCompile,0,0x2b85d420,1221,"sjcl.mode.ccm.I bsuite/kraken-once/stanford-crypto-ccm.js:21",0x2f33a370,~
+timer-event-start,"V8.ParseLazy",88473
+timer-event-end,"V8.ParseLazy",88492
+timer-event-start,"V8.ParseLazy",88532
+timer-event-end,"V8.ParseLazy",88545
+timer-event-start,"V8.ParseLazy",88572
+timer-event-end,"V8.ParseLazy",88588
+timer-event-start,"V8.ParseLazy",88612
+timer-event-end,"V8.ParseLazy",88645
+timer-event-start,"V8.ParseLazy",88688
+timer-event-end,"V8.ParseLazy",88714
+tick,0x81fc61b,88727,0,0xff81ebbc,2,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.ParseLazy",88792
+timer-event-end,"V8.ParseLazy",88867
+timer-event-start,"V8.ParseLazy",88951
+timer-event-end,"V8.ParseLazy",88967
+timer-event-start,"V8.ParseLazy",88996
+timer-event-end,"V8.ParseLazy",89012
+timer-event-end,"V8.RecompileSynchronous",89134
+timer-event-start,"V8.RecompileParallel",89160
+timer-event-start,"V8.RecompileSynchronous",89215
+timer-event-start,"V8.ParseLazy",89224
+timer-event-end,"V8.ParseLazy",89245
+code-creation,LazyCompile,0,0x2b85d900,585,"sjcl.bitArray.equal bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339c50,~
+timer-event-start,"V8.ParseLazy",89309
+timer-event-end,"V8.ParseLazy",89326
+timer-event-start,"V8.ParseLazy",89356
+timer-event-end,"V8.ParseLazy",89369
+timer-event-start,"V8.ParseLazy",89391
+timer-event-end,"V8.ParseLazy",89406
+timer-event-start,"V8.ParseLazy",89433
+timer-event-end,"V8.ParseLazy",89445
+timer-event-end,"V8.RecompileSynchronous",89485
+timer-event-start,"V8.RecompileSynchronous",89730
+timer-event-start,"V8.ParseLazy",89740
+tick,0x81168ba,89761,0,0x90d5060,0,0x2b85056f,0x2b85cd2d,0x2b839f04,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.ParseLazy",89805
+code-creation,LazyCompile,0,0x2b85db60,1838,"sjcl.mode.ccm.G bsuite/kraken-once/stanford-crypto-ccm.js:20",0x2f33a310,~
+timer-event-start,"V8.ParseLazy",89969
+timer-event-end,"V8.ParseLazy",89990
+timer-event-start,"V8.ParseLazy",90016
+timer-event-end,"V8.ParseLazy",90042
+timer-event-start,"V8.ParseLazy",90084
+timer-event-end,"V8.ParseLazy",90098
+timer-event-start,"V8.ParseLazy",90129
+timer-event-end,"V8.ParseLazy",90170
+timer-event-start,"V8.ParseLazy",90271
+timer-event-end,"V8.ParseLazy",90286
+timer-event-start,"V8.ParseLazy",90326
+timer-event-end,"V8.ParseLazy",90344
+timer-event-end,"V8.RecompileSynchronous",90480
+tick,0x2b8596f9,90829,0,0x8,0,0x2b852252,0x2b8454f6,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.RecompileParallel",91133
+timer-event-start,"V8.RecompileParallel",91145
+timer-event-start,"V8.RecompileSynchronous",91197
+code-creation,Stub,2,0x2b85e2a0,1800,"RecordWriteStub"
+code-creation,Stub,2,0x2b85e9c0,1805,"RecordWriteStub"
+code-creation,Stub,2,0x2b85f0e0,1785,"RecordWriteStub"
+code-creation,Stub,2,0x2b85f7e0,1797,"RecordWriteStub"
+timer-event-end,"V8.RecompileParallel",91529
+timer-event-start,"V8.RecompileParallel",91540
+code-creation,Stub,2,0x2b85ff00,1789,"RecordWriteStub"
+code-creation,Stub,2,0x2b860600,1805,"RecordWriteStub"
+code-creation,LazyCompile,1,0x2b860d20,9288,"sjcl.mode.ccm.I bsuite/kraken-once/stanford-crypto-ccm.js:21",0x2f33a370,*
+timer-event-end,"V8.RecompileSynchronous",91729
+timer-event-start,"V8.RecompileSynchronous",91735
+code-creation,LazyCompile,1,0x2b863180,2119,"sjcl.bitArray.equal bsuite/kraken-once/stanford-crypto-ccm.js:10",0x2f339c50,*
+timer-event-end,"V8.RecompileSynchronous",91833
+tick,0xf74c34b6,91883,0,0x90ebc51,2,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-deopt,91990,9312
+code-creation,LoadPolymorphicIC,5,0x2b8639e0,105,"length"
+tick,0x2b859a99,92950,0,0x4,0,0x2b852252,0x2b8455f6,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",93234
+timer-event-start,"V8.External",93245
+timer-event-end,"V8.External",93249
+timer-event-end,"V8.RecompileParallel",93304
+timer-event-start,"V8.External",93319
+timer-event-end,"V8.External",93327
+timer-event-end,"V8.GCScavenger",93331
+timer-event-start,"V8.RecompileSynchronous",93353
+code-creation,Stub,2,0x2b863a60,1800,"RecordWriteStub"
+code-creation,Stub,2,0x2b864180,1780,"RecordWriteStub"
+code-creation,LazyCompile,1,0x2b864880,7990,"sjcl.mode.ccm.G bsuite/kraken-once/stanford-crypto-ccm.js:20",0x2f33a310,*
+timer-event-end,"V8.RecompileSynchronous",93732
+code-creation,LoadPolymorphicIC,5,0x2b8667c0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b866840,105,"length"
+code-creation,LoadPolymorphicIC,5,0x2b8668c0,105,"length"
+tick,0x2b848cbd,94006,0,0xa,0,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,LoadPolymorphicIC,5,0x2b866940,105,"length"
+tick,0x8231000,95074,0,0x90d5060,0,0x2b848e54,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x83b9d75,96149,0,0x527db159,0,0x2b82364b,0x2b83a13d,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",96446
+timer-event-start,"V8.External",96457
+timer-event-end,"V8.External",96461
+timer-event-start,"V8.External",96513
+timer-event-end,"V8.External",96520
+timer-event-end,"V8.GCScavenger",96524
+tick,0x2b85960c,97208,0,0xfee0,0,0x2b852252,0x2b848c4b,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b83b5b3,98279,0,0x2b851c24,0,0x2b85cd19,0x2b839f04,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",99128
+timer-event-start,"V8.External",99139
+timer-event-end,"V8.External",99143
+timer-event-start,"V8.External",99189
+timer-event-end,"V8.External",99195
+timer-event-end,"V8.GCScavenger",99199
+tick,0x821c54b,99345,0,0x5270e530,0,0x2b83bd35,0x2b85ccab,0x2b839fd2,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b85a010,100416,0,0x0,0,0x2b852252,0x2b865810,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x808b5f1,101472,0,0x2f308081,0,0x2b8537a0,0x2b84a325,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",101820
+timer-event-start,"V8.External",101831
+timer-event-end,"V8.External",101835
+timer-event-start,"V8.External",101885
+timer-event-end,"V8.External",101891
+timer-event-end,"V8.GCScavenger",101895
+tick,0x2b85a376,102533,0,0x9c155cd6,0,0x2b852252,0x2b865810,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b863678,103607,0,0x4c0,0,0x2b83a0df,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",104515
+timer-event-start,"V8.External",104529
+timer-event-end,"V8.External",104533
+timer-event-start,"V8.External",104581
+timer-event-end,"V8.External",104588
+timer-event-end,"V8.GCScavenger",104592
+tick,0x2b85a2dc,104658,0,0x29,0,0x2b852252,0x2b8658f7,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b859e24,105742,0,0x80c5e06,0,0x2b852252,0x2b8654d2,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-deopt,106093,4416
+code-creation,Stub,12,0x2b8669c0,190,"BinaryOpStub_MOD_Alloc_Smi+Smi"
+tick,0x2b8514f9,106811,0,0xd1b6f5df,0,0x2b8657f1,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",107254
+timer-event-start,"V8.External",107264
+timer-event-end,"V8.External",107268
+timer-event-start,"V8.External",107317
+timer-event-end,"V8.External",107323
+timer-event-end,"V8.GCScavenger",107327
+timer-event-start,"V8.RecompileSynchronous",107462
+timer-event-start,"V8.ParseLazy",107471
+timer-event-end,"V8.ParseLazy",107537
+timer-event-end,"V8.RecompileSynchronous",107729
+timer-event-start,"V8.RecompileParallel",107764
+tick,0x2b859da9,107874,0,0x2,0,0x2b852252,0x2b848b65,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-end,"V8.RecompileParallel",108795
+timer-event-start,"V8.RecompileSynchronous",108885
+tick,0x2b859d60,108935,0,0x0,0,0x2b852252,0x2b8658f7,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,Stub,2,0x2b866a80,783,"RecordWriteStub"
+code-creation,Stub,2,0x2b866da0,1772,"RecordWriteStub"
+code-creation,LazyCompile,1,0x2b8674a0,4040,"sjcl.cipher.aes bsuite/kraken-once/stanford-crypto-ccm.js:4",0x2f339830,*
+timer-event-end,"V8.RecompileSynchronous",109204
+tick,0x2b851bd9,110005,0,0x68,0,0x2b85cd19,0x2b839f04,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",110651
+timer-event-start,"V8.External",110662
+timer-event-end,"V8.External",110666
+timer-event-start,"V8.External",110715
+timer-event-end,"V8.External",110721
+timer-event-end,"V8.GCScavenger",110725
+tick,0x2b85a1d8,111072,0,0x0,0,0x2b852252,0x2b8658f7,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b848d38,112161,0,0x4c,0,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.RecompileSynchronous",112323
+timer-event-start,"V8.ParseLazy",112335
+timer-event-end,"V8.ParseLazy",112387
+timer-event-start,"V8.ParseLazy",112444
+timer-event-end,"V8.ParseLazy",112463
+timer-event-start,"V8.ParseLazy",112496
+timer-event-end,"V8.ParseLazy",112509
+timer-event-start,"V8.ParseLazy",112536
+timer-event-end,"V8.ParseLazy",112552
+timer-event-start,"V8.ParseLazy",112576
+timer-event-end,"V8.ParseLazy",112598
+timer-event-start,"V8.ParseLazy",112639
+timer-event-end,"V8.ParseLazy",112653
+timer-event-start,"V8.ParseLazy",112685
+timer-event-end,"V8.ParseLazy",112722
+timer-event-start,"V8.ParseLazy",112803
+timer-event-end,"V8.ParseLazy",112819
+timer-event-start,"V8.ParseLazy",112848
+timer-event-end,"V8.ParseLazy",112863
+timer-event-end,"V8.RecompileSynchronous",112986
+timer-event-start,"V8.RecompileParallel",113012
+tick,0x2b867dc3,113148,0,0x100,0,0x2b839e65,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",114171
+timer-event-start,"V8.External",114182
+timer-event-end,"V8.External",114186
+tick,0x82c920e,114254,0,0x0,1
+timer-event-start,"V8.External",114309
+timer-event-end,"V8.External",114330
+timer-event-end,"V8.GCScavenger",114350
+timer-event-end,"V8.RecompileParallel",115013
+timer-event-start,"V8.RecompileSynchronous",115032
+tick,0x8369515,115325,0,0x9135ff0,2,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,LazyCompile,1,0x5120a000,9284,"sjcl.mode.ccm.I bsuite/kraken-once/stanford-crypto-ccm.js:21",0x2f33a370,*
+timer-event-end,"V8.RecompileSynchronous",115434
+code-deopt,115666,9312
+tick,0x2b85056f,116392,0,0x52f8f619,0,0x2b85cd2d,0x2b839fd2,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b812420,117465,0,0x2b85592e,0,0x2b86573b,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",117571
+timer-event-start,"V8.External",117583
+timer-event-end,"V8.External",117587
+timer-event-start,"V8.External",117636
+timer-event-end,"V8.External",117642
+timer-event-end,"V8.GCScavenger",117646
+tick,0x811db13,118481,0,0x90d5060,0,0x2b85cd53,0x2b839eb3,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x80c4222,119548,0,0x90d5060,0,0x2b85599a,0x2b86573b,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",120368
+timer-event-start,"V8.External",120379
+timer-event-end,"V8.External",120383
+timer-event-start,"V8.External",120428
+timer-event-end,"V8.External",120434
+timer-event-end,"V8.GCScavenger",120438
+tick,0x2b867eb3,120610,0,0x100,0,0x2b839e65,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b859eae,121680,0,0x80c5e06,0,0x2b852252,0x2b8658f7,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b85981d,122808,0,0x21,0,0x2b852252,0x2b848c4b,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",123188
+timer-event-start,"V8.External",123199
+timer-event-end,"V8.External",123203
+timer-event-start,"V8.External",123248
+timer-event-end,"V8.External",123254
+timer-event-end,"V8.GCScavenger",123258
+tick,0x2b859ca8,123878,0,0x0,0,0x2b852252,0x2b865810,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x80fa2d1,124943,0,0x5279ab29,0,0x2b83bd35,0x2b85ccab,0x2b839fd2,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",126000
+timer-event-start,"V8.External",126017
+timer-event-end,"V8.External",126022
+tick,0x808b6b0,126038,0,0x2f308081,0,0x2b855838,0x2b848b0a,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.External",126109
+timer-event-end,"V8.External",126129
+timer-event-end,"V8.GCScavenger",126139
+tick,0x808b656,127081,0,0x2f308081,0,0x2b8658be,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b85a1f0,128141,0,0x1f,0,0x2b852252,0x2b848c4b,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",128896
+timer-event-start,"V8.External",128907
+timer-event-end,"V8.External",128911
+timer-event-start,"V8.External",128958
+timer-event-end,"V8.External",128964
+timer-event-end,"V8.GCScavenger",128968
+tick,0x2b867d2b,129212,0,0x100,0,0x2b839e65,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b859a7b,130285,0,0x80c5e06,0,0x2b852252,0x2b865810,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b859c3b,131350,0,0x0,0,0x2b852252,0x2b8658f7,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",131713
+timer-event-start,"V8.External",131723
+timer-event-end,"V8.External",131727
+timer-event-start,"V8.External",131772
+timer-event-end,"V8.External",131778
+timer-event-end,"V8.GCScavenger",131782
+tick,0x80c413f,132412,0,0x90d5060,0,0x2b855ca8,0x2b8446a3,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x80a1baf,133466,0,0x811e5c0,0,0x2b848b2e,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",134532
+tick,0x2b85d126,134550,0,0x2,0,0x2b839f04,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.External",134619
+timer-event-end,"V8.External",134636
+timer-event-start,"V8.External",134702
+timer-event-end,"V8.External",134708
+timer-event-end,"V8.GCScavenger",134712
+tick,0x2b8594d3,135617,0,0x80c5e06,0,0x2b852252,0x2b8654d2,0x2b844628,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.RecompileSynchronous",135776
+timer-event-start,"V8.ParseLazy",135787
+timer-event-end,"V8.ParseLazy",135838
+timer-event-start,"V8.ParseLazy",135894
+timer-event-end,"V8.ParseLazy",135913
+timer-event-start,"V8.ParseLazy",135946
+timer-event-end,"V8.ParseLazy",135960
+timer-event-start,"V8.ParseLazy",135987
+timer-event-end,"V8.ParseLazy",136002
+timer-event-start,"V8.ParseLazy",136026
+timer-event-end,"V8.ParseLazy",136048
+timer-event-start,"V8.ParseLazy",136089
+timer-event-end,"V8.ParseLazy",136103
+timer-event-start,"V8.ParseLazy",136135
+timer-event-end,"V8.ParseLazy",136172
+timer-event-start,"V8.ParseLazy",136253
+timer-event-end,"V8.ParseLazy",136270
+timer-event-start,"V8.ParseLazy",136301
+timer-event-end,"V8.ParseLazy",136317
+timer-event-end,"V8.RecompileSynchronous",136440
+timer-event-start,"V8.RecompileParallel",136466
+tick,0x2b859c6e,136680,0,0x0,0,0x2b852252,0x2b8658f7,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-creation,LoadPolymorphicIC,5,0x5120c460,105,"length"
+code-creation,LoadPolymorphicIC,5,0x5120c4e0,117,"length"
+code-creation,LoadPolymorphicIC,5,0x5120c560,117,"length"
+code-creation,LoadPolymorphicIC,5,0x5120c5e0,105,"length"
+code-creation,LoadPolymorphicIC,5,0x5120c660,105,"length"
+tick,0x2b855ece,137742,0,0x527d0961,0,0x2b8446a3,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",138203
+timer-event-start,"V8.External",138213
+timer-event-end,"V8.External",138217
+timer-event-start,"V8.External",138271
+timer-event-end,"V8.External",138277
+timer-event-end,"V8.GCScavenger",138281
+timer-event-end,"V8.RecompileParallel",138393
+timer-event-start,"V8.RecompileSynchronous",138412
+code-creation,LazyCompile,1,0x5120c6e0,9284,"sjcl.mode.ccm.I bsuite/kraken-once/stanford-crypto-ccm.js:21",0x2f33a370,*
+timer-event-end,"V8.RecompileSynchronous",138781
+tick,0x83647f0,138812,0,0xf633ddf4,2,0x2b844670,0x2b83a0cc,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+code-deopt,138895,9312
+tick,0x2b851212,139867,0,0xff81fd00,0,0x2b8657f1,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x82ebff7,140937,0,0x2f33ca81,0,0x2b85056f,0x2b85cd2d,0x2b839fd2,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",141540
+timer-event-start,"V8.External",141551
+timer-event-end,"V8.External",141555
+timer-event-start,"V8.External",141605
+timer-event-end,"V8.External",141611
+timer-event-end,"V8.GCScavenger",141615
+tick,0x2b85a0a6,142005,0,0x0,0,0x2b852252,0x2b865810,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x8116886,143088,0,0x90d5060,0,0x2b85b862,0x2b848b8c,0x2b84a58b,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b83dbaf,144137,0,0x2b85cd53,0,0x2b839fd2,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.GCScavenger",144365
+timer-event-start,"V8.External",144376
+timer-event-end,"V8.External",144380
+timer-event-start,"V8.External",144428
+timer-event-end,"V8.External",144434
+timer-event-end,"V8.GCScavenger",144438
+tick,0x81168ba,145212,0,0x90d5060,0,0x2b85056f,0x2b85cd2d,0x2b839f04,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+tick,0x2b851430,146268,0,0xff81fd00,0,0x2b8657f1,0x2b84a5e0,0x2b83a281,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b85b238,0x2b83a474,0x2b838f3f,0x2b838c50,0x2b839b39,0x2b83970e,0x2b83964b,0x2b8394a8,0x2b839273,0x2b839036,0x2b838f3f,0x2b838c50,0x2b83892e,0x2b8383df,0x2b8350ac
+timer-event-start,"V8.ParseLazy",146339
+timer-event-end,"V8.ParseLazy",146358
+timer-event-start,"V8.CompileLazy",146364
+timer-event-start,"V8.CompileFullCode",146369
+timer-event-end,"V8.CompileFullCode",146386
+code-creation,LazyCompile,0,0x5120eb40,212," bsuite/kraken-once/stanford-crypto-ccm.js:172",0x2f33dd88,~
+timer-event-end,"V8.CompileLazy",146400
+code-creation,Stub,12,0x5120ec20,311,"BinaryOpStub_SUB_Alloc_Generic+Generic"
+timer-event-start,"V8.ParseLazy",146431
+timer-event-end,"V8.ParseLazy",146461
+timer-event-start,"V8.CompileLazy",146467
+timer-event-start,"V8.CompileFullCode",146475
+timer-event-end,"V8.CompileFullCode",146495
+code-creation,LazyCompile,0,0x5120ed60,580,"NonNumberToNumber native runtime.js:548",0x44225f78,~
+timer-event-end,"V8.CompileLazy",146508
+code-creation,Stub,2,0x5120efc0,98,"valueOf"
+code-creation,LoadPolymorphicIC,5,0x5120f040,117,"valueOf"
+code-creation,CallIC,7,0x5120f0c0,129,"ToNumber"
+timer-event-start,"V8.ParseLazy",146556
+timer-event-end,"V8.ParseLazy",146569
+timer-event-start,"V8.CompileLazy",146574
+timer-event-start,"V8.CompileFullCode",146580
+timer-event-end,"V8.CompileFullCode",146591
+code-creation,LazyCompile,0,0x5120f160,208,"record bsuite/kraken-once/stanford-crypto-ccm.js:7229",0x2f339680,~
+timer-event-end,"V8.CompileLazy",146603
+timer-event-start,"V8.External",146613
+timer-event-end,"V8.External",146656
+timer-event-end,"V8.Execute",146662
+timer-event-start,"V8.RecompileParallel",146700
+timer-event-end,"V8.RecompileParallel",146738
+profiler,"end"
diff --git a/test/mjsunit/tools/profviz.js b/test/mjsunit/tools/profviz.js
new file mode 100644
index 0000000..3a14f4e
--- /dev/null
+++ b/test/mjsunit/tools/profviz.js
@@ -0,0 +1,83 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Load implementations from <project root>/tools.
+// Files: tools/csvparser.js tools/splaytree.js tools/codemap.js
+// Files: tools/consarray.js tools/profile.js tools/profile_view.js
+// Files: tools/logreader.js tools/tickprocessor.js
+// Files: tools/profviz/composer.js
+// Env: TEST_FILE_NAME
+
+assertEquals('string', typeof TEST_FILE_NAME);
+var path_length = TEST_FILE_NAME.lastIndexOf('/');
+if (path_length == -1) {
+  path_length = TEST_FILE_NAME.lastIndexOf('\\');
+}
+assertTrue(path_length != -1);
+
+var path = TEST_FILE_NAME.substr(0, path_length + 1);
+var input_file = path + "profviz-test.log";
+var reference_file = path + "profviz-test.default";
+
+var content_lines = read(input_file).split("\n");
+var line_cursor = 0;
+var output_lines = [];
+
+function input() {
+  return content_lines[line_cursor++];
+}
+
+function output(line) {
+  output_lines.push(line);
+}
+
+function set_range(start, end) {
+  range_start = start;
+  range_end = end;
+}
+
+var distortion = 4500 / 1000000;
+var resx = 1600;
+var resy = 600;
+
+var psc = new PlotScriptComposer(resx, resy);
+psc.collectData(input, distortion);
+psc.findPlotRange(undefined, undefined, set_range);
+var objects = psc.assembleOutput(output);
+
+output("# start: " + range_start);
+output("# end: " + range_end);
+output("# objects: " + objects);
+
+var create_baseline = false;
+
+if (create_baseline) {
+  print(JSON.stringify(output_lines, null, 2));
+} else {
+  assertArrayEquals(output_lines,
+                    JSON.parse(read(reference_file)));
+}
diff --git a/tools/blink_tests/TestExpectations b/tools/blink_tests/TestExpectations
index 5c75db0..eeaab4c 100644
--- a/tools/blink_tests/TestExpectations
+++ b/tools/blink_tests/TestExpectations
@@ -17,3 +17,6 @@
 [ Linux Debug ] fast/text/international/danda-space.html [ Pass Failure Slow ]
 [ Linux Debug ] fast/text/international/thai-baht-space.html [ Pass Failure Slow ]
 [ Linux Debug ] fast/text/international/thai-line-breaks.html [ Pass Failure Slow ]
+crbug.com/108833 [ Win Debug ] plugins/geturlnotify-during-document-teardown.html [ Failure Timeout ]
+webkit.org/b/48655 [ Win Debug ] plugins/js-from-destroy.html [ Timeout ]
+crbug.com/178745 [ Win Debug ] plugins/open-and-close-window-with-plugin.html [ Failure Timeout ]
diff --git a/tools/gyp/v8.gyp b/tools/gyp/v8.gyp
index e251a73..19a1bc4 100644
--- a/tools/gyp/v8.gyp
+++ b/tools/gyp/v8.gyp
@@ -29,7 +29,7 @@
   'variables': {
     'v8_code': 1,
   },
-  'includes': ['../../build/common.gypi'],
+  'includes': ['../../build/toolchain.gypi', '../../build/features.gypi'],
   'targets': [
     {
       'target_name': 'v8',
@@ -335,6 +335,8 @@
         '../../src/heap-snapshot-generator.h',
         '../../src/heap.cc',
         '../../src/heap.h',
+        '../../src/hydrogen-bce.cc',
+        '../../src/hydrogen-bce.h',
         '../../src/hydrogen-dce.cc',
         '../../src/hydrogen-dce.h',
         '../../src/hydrogen-environment-liveness.cc',
@@ -351,10 +353,14 @@
         '../../src/hydrogen-infer-representation.h',
         '../../src/hydrogen-infer-types.cc',
         '../../src/hydrogen-infer-types.h',
+        '../../src/hydrogen-minus-zero.cc',
+        '../../src/hydrogen-minus-zero.h',
         '../../src/hydrogen-range-analysis.cc',
         '../../src/hydrogen-range-analysis.h',
         '../../src/hydrogen-redundant-phi.cc',
         '../../src/hydrogen-redundant-phi.h',
+        '../../src/hydrogen-representation-changes.cc',
+        '../../src/hydrogen-representation-changes.h',
         '../../src/hydrogen-sce.cc',
         '../../src/hydrogen-sce.h',
         '../../src/hydrogen-uint32-analysis.cc',
diff --git a/tools/profviz/composer.js b/tools/profviz/composer.js
index bcc17b2..cdfc0b7 100644
--- a/tools/profviz/composer.js
+++ b/tools/profviz/composer.js
@@ -337,7 +337,7 @@
     };
 
     var processTickEvent = function(
-        pc, sp, timer, unused_x, unused_y, vmstate, stack) {
+        pc, timer, unused_x, unused_y, vmstate, stack) {
       var tick = new Tick(timer);
 
       var entry = code_map.findEntry(pc);
@@ -365,7 +365,7 @@
                             processor: processCodeDeleteEvent },
         'code-deopt':     { parsers: [parseTimeStamp, parseInt],
                             processor: processCodeDeoptEvent },
-        'tick':           { parsers: [parseInt, parseInt, parseTimeStamp,
+        'tick':           { parsers: [parseInt, parseTimeStamp,
                                       null, null, parseInt, 'var-args'],
                             processor: processTickEvent }
       });