Version 3.20.12

Removed buggy ToNumber truncation (partial fix for issue 2813)

Calling Map etc without new should throw TypeError (issue 2819)

Fixed a crash for large code objects on ARM (Chromium issue 2736)

Fixed stale unhandlified value in JSObject::SetPropertyForResult. (Chromium issue 265894)

Added new Harmony methods to String.prototype object. (issue 2796,v8:2797,v8:2798,v8:2799)

Performance and stability improvements on all platforms.

git-svn-id: http://v8.googlecode.com/svn/trunk@16010 ce2b1a6d-e550-0410-aec6-3dcde31c8c00
diff --git a/test/mjsunit/array-literal-transitions.js b/test/mjsunit/array-literal-transitions.js
index fab45ed..ca6033b 100644
--- a/test/mjsunit/array-literal-transitions.js
+++ b/test/mjsunit/array-literal-transitions.js
@@ -205,7 +205,9 @@
 
 (function literals_after_osr() {
   var color = [0];
-  // Trigger OSR.
-  while (%GetOptimizationStatus(literals_after_osr, "no sync") == 2) {}
+  // Trigger OSR, if optimization is not disabled.
+  if (%GetOptimizationStatus(literals_after_osr) != 4) {
+    while (%GetOptimizationCount(literals_after_osr) == 0) {}
+  }
   return [color[0]];
 })();
diff --git a/test/mjsunit/array-store-and-grow.js b/test/mjsunit/array-store-and-grow.js
index 88f3db8..a03a753 100644
--- a/test/mjsunit/array-store-and-grow.js
+++ b/test/mjsunit/array-store-and-grow.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 // Verifies that the KeyedStoreIC correctly handles out-of-bounds stores
 // to an array that grow it by a single element. Test functions are
 // called twice to make sure that the IC is used, first call is handled
@@ -184,3 +186,24 @@
 array_store_1(a, 0, 0.5);
 assertEquals(0.5, a[0]);
 assertEquals(0.5, array_store_1([], 0, 0.5));
+
+// Verify that a grow store will deoptimize if the max gap (difference between
+// the end of an array capacity and a new index) is passed. The wrapper is to
+// make sure array_store_10 isn't inlined.
+
+(function() {
+  function grow_store(a,b,c) {
+    a[b] = c;
+  }
+
+  a = new Array(1);
+  grow_store(a,1,1);
+  grow_store(a,2,1);
+  %OptimizeFunctionOnNextCall(grow_store);
+  grow_store(a,10,1);
+  assertOptimized(grow_store);
+  grow_store(a,2048,1);
+  assertUnoptimized(grow_store);
+  %ClearFunctionTypeFeedback(grow_store);
+})();
+
diff --git a/test/mjsunit/compiler/dead-string-add-warm.js b/test/mjsunit/compiler/dead-string-add-warm.js
new file mode 100644
index 0000000..c211ebd
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-add-warm.js
@@ -0,0 +1,76 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function dead1(a, b) {
+    var x = "a" + "b";
+    return a; // x, "a", and "b" are dead code
+}
+
+function dead2(a, b) {
+    var x = "0" + a;
+    var y = "0" + b;
+    return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+    a = a ? "1" : "0";
+    b = b ? "1" : "0";
+    var x = a + "0";
+    var y = b + "0";
+    return a; // x and y are both dead
+}
+
+function run() {
+  assertEquals(33, dead1(33, 32));
+  assertEquals(33, dead2(33, 32));
+  assertEquals("1", dead3(33, 32));
+
+  assertEquals(31, dead1(31, 30));
+  assertEquals(31, dead2(31, 30));
+  assertEquals("1", dead3(31, 32));
+
+  assertEquals(0, dead1(0, 30));
+  assertEquals(0, dead2(0, 30));
+  assertEquals("0", dead3(0, 32));
+
+  assertEquals(true, dead1(true, 0));
+  assertEquals(true, dead2(true, 0));
+  assertEquals("1", dead3(true, 0));
+
+  assertEquals("true", dead1("true", 0));
+  assertEquals("true", dead2("true", 0));
+  assertEquals("1", dead3("true", 0));
+}
+
+run();
+run();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+run();
diff --git a/test/mjsunit/compiler/dead-string-add.js b/test/mjsunit/compiler/dead-string-add.js
new file mode 100644
index 0000000..04155ef
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-add.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function dead1(a, b) {
+    var x = "a" + "b";
+    return a; // x, "a", and "b" are dead code
+}
+
+function dead2(a, b) {
+    var x = a + "0";
+    var y = b + "0";
+    return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+    a = a ? "1" : "0";
+    b = b ? "1" : "0";
+    var x = a + "0";
+    var y = b + "0";
+    return a; // x and y are both dead
+}
+
+assertEquals(33, dead1(33, 32));
+assertEquals(33, dead2(33, 32));
+assertEquals("1", dead3(33, 32));
+
+assertEquals(31, dead1(31, 30));
+assertEquals(31, dead2(31, 30));
+assertEquals("1", dead3(31, 32));
+
+assertEquals(0, dead1(0, 30));
+assertEquals(0, dead2(0, 30));
+assertEquals("0", dead3(0, 32));
+
+assertEquals(true, dead1(true, 0));
+assertEquals(true, dead2(true, 0));
+assertEquals("1", dead3(true, 0));
+
+assertEquals("true", dead1("true", 0));
+assertEquals("true", dead2("true", 0));
+assertEquals("1", dead3("true", 0));
diff --git a/test/mjsunit/compiler/dead-string-char-code-at.js b/test/mjsunit/compiler/dead-string-char-code-at.js
new file mode 100644
index 0000000..56835ce
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-char-code-at.js
@@ -0,0 +1,81 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var S1 = "string1";
+var S2 = "@@string2";
+
+function dead1(a, b) {
+    var x = %StringCharCodeAt(a, 4);
+    return a; // x is dead code
+}
+
+function dead2(a, b) {
+    var x = %StringCharCodeAt(a, 3);
+    var y = %StringCharCodeAt(b, 1);
+    return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+    a = a ? "11" : "12";
+    b = b ? "13" : "14";
+    var x = %StringCharCodeAt(a, 2);
+    var y = %StringCharCodeAt(b, 0);
+    return a; // x and y are both dead
+}
+
+function test() {
+  var S3 = S1 + S2;
+
+  assertEquals(S1, dead1(S1, S2));
+  assertEquals(S1, dead2(S1, S2));
+  assertEquals("11", dead3(S1, S2));
+
+  assertEquals(S2, dead1(S2, 677));
+  assertEquals(S2, dead2(S2, S3));
+  assertEquals("11", dead3(S2, S3));
+
+  assertEquals(S3, dead1(S3, 399));
+  assertEquals(S3, dead2(S3, "false"));
+  assertEquals("12", dead3(0, 32));
+
+  assertEquals(S3, dead1(S3, 0));
+  assertEquals(S3, dead2(S3, S1));
+  assertEquals("11", dead3(S3, 0));
+
+  assertEquals("true", dead1("true", 0));
+  assertEquals("true", dead2("true", S3));
+  assertEquals("11", dead3("true", 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+test();
diff --git a/test/mjsunit/compiler/dead-string-char-code-at2.js b/test/mjsunit/compiler/dead-string-char-code-at2.js
new file mode 100644
index 0000000..9f01541
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-char-code-at2.js
@@ -0,0 +1,81 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var S1 = "string1";
+var S2 = "@@string2";
+
+function dead1(a, b) {
+    var x = %_StringCharCodeAt(a, 4);
+    return a; // x is dead code
+}
+
+function dead2(a, b) {
+    var x = %_StringCharCodeAt(a, 3);
+    var y = %_StringCharCodeAt(b, 1);
+    return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+    a = a ? "11" : "12";
+    b = b ? "13" : "14";
+    var x = %_StringCharCodeAt(a, 2);
+    var y = %_StringCharCodeAt(b, 0);
+    return a; // x and y are both dead
+}
+
+function test() {
+  var S3 = S1 + S2;
+
+  assertEquals(S1, dead1(S1, S2));
+  assertEquals(S1, dead2(S1, S2));
+  assertEquals("11", dead3(S1, S2));
+
+  assertEquals(S2, dead1(S2, 677));
+  assertEquals(S2, dead2(S2, S3));
+  assertEquals("11", dead3(S2, S3));
+
+  assertEquals(S3, dead1(S3, 399));
+  assertEquals(S3, dead2(S3, "false"));
+  assertEquals("12", dead3(0, 32));
+
+  assertEquals(S3, dead1(S3, 0));
+  assertEquals(S3, dead2(S3, S1));
+  assertEquals("11", dead3(S3, 0));
+
+  assertEquals("true", dead1("true", 0));
+  assertEquals("true", dead2("true", S3));
+  assertEquals("11", dead3("true", 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+test();
diff --git a/test/mjsunit/compiler/dead-string-char-from-code.js b/test/mjsunit/compiler/dead-string-char-from-code.js
new file mode 100644
index 0000000..1de5d9e
--- /dev/null
+++ b/test/mjsunit/compiler/dead-string-char-from-code.js
@@ -0,0 +1,76 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function dead1(a, b) {
+    var x = %_StringCharFromCode(a);
+    return a; // x is dead code
+}
+
+function dead2(a, b) {
+    var x = %_StringCharFromCode(a);
+    var y = %_StringCharFromCode(b);
+    return a; // x and y are both dead
+}
+
+function dead3(a, b) {
+    a = a ? 11 : 12;
+    b = b ? 13 : 14;
+    var x = %_StringCharFromCode(a);
+    var y = %_StringCharFromCode(b);
+    return a; // x and y are both dead
+}
+
+function test() {
+    assertEquals(33, dead1(33, 32));
+    assertEquals(33, dead2(33, 32));
+    assertEquals(11, dead3(33, 32));
+
+    assertEquals(31, dead1(31, 30));
+    assertEquals(31, dead2(31, 30));
+    assertEquals(11, dead3(31, 32));
+
+    assertEquals(0, dead1(0, 30));
+    assertEquals(0, dead2(0, 30));
+    assertEquals(12, dead3(0, 32));
+
+    assertEquals(true, dead1(true, 0));
+    assertEquals(true, dead2(true, 0));
+    assertEquals(11, dead3(true, 0));
+
+    assertEquals("true", dead1("true", 0));
+    assertEquals("true", dead2("true", 0));
+    assertEquals(11, dead3("true", 0));
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(dead1);
+%OptimizeFunctionOnNextCall(dead2);
+%OptimizeFunctionOnNextCall(dead3);
+test();
diff --git a/test/mjsunit/count-based-osr.js b/test/mjsunit/count-based-osr.js
index 5ce4dc5..f060130 100644
--- a/test/mjsunit/count-based-osr.js
+++ b/test/mjsunit/count-based-osr.js
@@ -25,15 +25,15 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --count-based-interrupts --interrupt-budget=10 --weighted-back-edges
 // Flags: --allow-natives-syntax
 
 // Test that OSR works properly when using count-based interrupting/profiling.
 
 function osr_this() {
   var a = 1;
-  // Trigger OSR.
-  while (%GetOptimizationStatus(osr_this, "no sync") == 2) {}
+  // Trigger OSR. First check if optimization is disabled.
+  if (%GetOptimizationStatus(osr_this) == 4) return 1;
+  while (%GetOptimizationCount(osr_this) == 0) {}
   return a;
 }
 assertEquals(1, osr_this());
diff --git a/test/mjsunit/elements-transition-and-store.js b/test/mjsunit/elements-transition-and-store.js
index 78ca597..7a07b3e 100644
--- a/test/mjsunit/elements-transition-and-store.js
+++ b/test/mjsunit/elements-transition-and-store.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --compiled-transitions --notrack-allocation-sites
+// Flags: --notrack-allocation-sites
 
 function foo(a, v) {
   a[0] = v;
diff --git a/test/mjsunit/generated-transition-stub.js b/test/mjsunit/generated-transition-stub.js
index 8b890c0..9e3fa92 100644
--- a/test/mjsunit/generated-transition-stub.js
+++ b/test/mjsunit/generated-transition-stub.js
@@ -25,7 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --compiled_transitions
+// Flags: --allow-natives-syntax
 
 %NeverOptimizeFunction(test);
 function test() {
diff --git a/test/mjsunit/harmony/collections.js b/test/mjsunit/harmony/collections.js
index 3e87e6b..174d3d1 100644
--- a/test/mjsunit/harmony/collections.js
+++ b/test/mjsunit/harmony/collections.js
@@ -207,10 +207,10 @@
 
 
 // Test direct constructor call
-assertTrue(Set() instanceof Set);
-assertTrue(Map() instanceof Map);
-assertTrue(WeakMap() instanceof WeakMap);
-assertTrue(WeakSet() instanceof WeakSet);
+assertThrows(function() { Set(); }, TypeError);
+assertThrows(function() { Map(); }, TypeError);
+assertThrows(function() { WeakMap(); }, TypeError);
+assertThrows(function() { WeakSet(); }, TypeError);
 
 
 // Test whether NaN values as keys are treated correctly.
@@ -308,7 +308,6 @@
 function TestConstructor(C) {
   assertFalse(C === Object.prototype.constructor);
   assertSame(C, C.prototype.constructor);
-  assertSame(C, C().__proto__.constructor);
   assertSame(C, (new C).__proto__.constructor);
 }
 TestConstructor(Set);
diff --git a/test/mjsunit/harmony/proxies-example-membrane.js b/test/mjsunit/harmony/proxies-example-membrane.js
index c6e7f9f..9e2228a 100644
--- a/test/mjsunit/harmony/proxies-example-membrane.js
+++ b/test/mjsunit/harmony/proxies-example-membrane.js
@@ -285,8 +285,8 @@
 // http://wiki.ecmascript.org/doku.php?id=harmony:proxies#an_identity-preserving_membrane
 
 function createMembrane(wetTarget) {
-  var wet2dry = WeakMap();
-  var dry2wet = WeakMap();
+  var wet2dry = new WeakMap();
+  var dry2wet = new WeakMap();
 
   function asDry(obj) {
     registerObject(obj)
diff --git a/test/mjsunit/harmony/proxies-hash.js b/test/mjsunit/harmony/proxies-hash.js
index abfc0f5..789de35 100644
--- a/test/mjsunit/harmony/proxies-hash.js
+++ b/test/mjsunit/harmony/proxies-hash.js
@@ -51,7 +51,7 @@
   var p3 = create(handler)
   fix(p3)
 
-  var s = construct();
+  var s = new construct();
   s.add(p1);
   s.add(p2);
   assertTrue(s.has(p1));
@@ -88,7 +88,7 @@
   var p3 = create(handler)
   fix(p3)
 
-  var m = construct();
+  var m = new construct();
   m.set(p1, 123);
   m.set(p2, 321);
   assertTrue(m.has(p1));
diff --git a/test/mjsunit/harmony/string-contains.js b/test/mjsunit/harmony/string-contains.js
new file mode 100644
index 0000000..700a6ed
--- /dev/null
+++ b/test/mjsunit/harmony/string-contains.js
@@ -0,0 +1,151 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --harmony-strings
+
+assertEquals(1, String.prototype.contains.length);
+
+var reString = "asdf[a-z]+(asdf)?";
+assertTrue(reString.contains("[a-z]+"));
+assertTrue(reString.contains("(asdf)?"));
+
+// Random greek letters
+var twoByteString = "\u039a\u0391\u03a3\u03a3\u0395";
+
+// Test single char pattern
+assertTrue(twoByteString.contains("\u039a"), "Lamda");
+assertTrue(twoByteString.contains("\u0391"), "Alpha");
+assertTrue(twoByteString.contains("\u03a3"), "First Sigma");
+assertTrue(twoByteString.contains("\u03a3",3), "Second Sigma");
+assertTrue(twoByteString.contains("\u0395"), "Epsilon");
+assertFalse(twoByteString.contains("\u0392"), "Not beta");
+
+// Test multi-char pattern
+assertTrue(twoByteString.contains("\u039a\u0391"), "lambda Alpha");
+assertTrue(twoByteString.contains("\u0391\u03a3"), "Alpha Sigma");
+assertTrue(twoByteString.contains("\u03a3\u03a3"), "Sigma Sigma");
+assertTrue(twoByteString.contains("\u03a3\u0395"), "Sigma Epsilon");
+
+assertFalse(twoByteString.contains("\u0391\u03a3\u0395"),
+    "Not Alpha Sigma Epsilon");
+
+//single char pattern
+assertTrue(twoByteString.contains("\u0395"));
+
+assertThrows("String.prototype.contains.call(null, 'test')", TypeError);
+assertThrows("String.prototype.contains.call(null, null)", TypeError);
+assertThrows("String.prototype.contains.call(undefined, undefined)", TypeError);
+
+assertThrows("String.prototype.contains.apply(null, ['test'])", TypeError);
+assertThrows("String.prototype.contains.apply(null, [null])", TypeError);
+assertThrows("String.prototype.contains.apply(undefined, [undefined])", TypeError);
+
+var TEST_INPUT = [{
+  msg: "Empty string", val: ""
+}, {
+  msg: "Number 1234.34", val: 1234.34
+}, {
+  msg: "Integer number 0", val: 0
+}, {
+  msg: "Negative number -1", val: -1
+}, {
+  msg: "Boolean true", val: true
+}, {
+  msg: "Boolean false", val: false
+}, {
+  msg: "Regular expression /\d+/", val: /\d+/
+}, {
+  msg: "Empty array []", val: []
+}, {
+  msg: "Empty object {}", val: {}
+}, {
+  msg: "Array of size 3", val: new Array(3)
+}];
+
+var i = 0;
+var l = TEST_INPUT.length;
+
+for (; i < l; i++) {
+  var e = TEST_INPUT[i];
+  var v = e.val;
+  var s = String(v);
+  assertTrue(s.contains(v), e.msg);
+  assertTrue(String.prototype.contains.call(v, v), e.msg);
+  assertTrue(String.prototype.contains.apply(v, [v]), e.msg);
+}
+
+// Test cases found in FF
+assertTrue("abc".contains("a"));
+assertTrue("abc".contains("b"));
+assertTrue("abc".contains("abc"));
+assertTrue("abc".contains("bc"));
+assertFalse("abc".contains("d"));
+assertFalse("abc".contains("abcd"));
+assertFalse("abc".contains("ac"));
+assertTrue("abc".contains("abc", 0));
+assertTrue("abc".contains("bc", 0));
+assertFalse("abc".contains("de", 0));
+assertTrue("abc".contains("bc", 1));
+assertTrue("abc".contains("c", 1));
+assertFalse("abc".contains("a", 1));
+assertFalse("abc".contains("abc", 1));
+assertTrue("abc".contains("c", 2));
+assertFalse("abc".contains("d", 2));
+assertFalse("abc".contains("dcd", 2));
+assertFalse("abc".contains("a", 42));
+assertFalse("abc".contains("a", Infinity));
+assertTrue("abc".contains("ab", -43));
+assertFalse("abc".contains("cd", -42));
+assertTrue("abc".contains("ab", -Infinity));
+assertFalse("abc".contains("cd", -Infinity));
+assertTrue("abc".contains("ab", NaN));
+assertFalse("abc".contains("cd", NaN));
+assertFalse("xyzzy".contains("zy\0", 2));
+
+var dots = Array(10000).join('.');
+assertFalse(dots.contains("\x01", 10000));
+assertFalse(dots.contains("\0", 10000));
+
+var myobj = {
+  toString: function () {
+    return "abc";
+  },
+  contains: String.prototype.contains
+};
+assertTrue(myobj.contains("abc"));
+assertFalse(myobj.contains("cd"));
+
+var gotStr = false;
+var gotPos = false;
+myobj = {
+  toString: function () {
+    assertFalse(gotPos);
+    gotStr = true;
+    return "xyz";
+  },
+  contains: String.prototype.contains
+};
diff --git a/test/mjsunit/harmony/string-endswith.js b/test/mjsunit/harmony/string-endswith.js
new file mode 100644
index 0000000..128cf1d
--- /dev/null
+++ b/test/mjsunit/harmony/string-endswith.js
@@ -0,0 +1,136 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --harmony-strings
+
+assertEquals(1, String.prototype.endsWith.length);
+
+var testString = "Hello World";
+assertTrue(testString.endsWith(""));
+assertTrue(testString.endsWith("World"));
+assertFalse(testString.endsWith("world"));
+assertFalse(testString.endsWith("Hello World!"));
+assertFalse(testString.endsWith(null));
+assertFalse(testString.endsWith(undefined));
+
+assertTrue("null".endsWith(null));
+assertTrue("undefined".endsWith(undefined));
+
+var georgianUnicodeString = "\u10D0\u10D1\u10D2\u10D3\u10D4\u10D5\u10D6\u10D7";
+assertTrue(georgianUnicodeString.endsWith(georgianUnicodeString));
+assertTrue(georgianUnicodeString.endsWith("\u10D4\u10D5\u10D6\u10D7"));
+assertFalse(georgianUnicodeString.endsWith("\u10D0"));
+
+assertThrows("String.prototype.endsWith.call(null, 'test')", TypeError);
+assertThrows("String.prototype.endsWith.call(null, null)", TypeError);
+assertThrows("String.prototype.endsWith.call(undefined, undefined)", TypeError);
+
+assertThrows("String.prototype.endsWith.apply(null, ['test'])", TypeError);
+assertThrows("String.prototype.endsWith.apply(null, [null])", TypeError);
+assertThrows("String.prototype.endsWith.apply(undefined, [undefined])", TypeError);
+
+var TEST_INPUT = [{
+  msg: "Empty string", val: ""
+}, {
+  msg: "Number 1234.34", val: 1234.34
+}, {
+  msg: "Integer number 0", val: 0
+}, {
+  msg: "Negative number -1", val: -1
+}, {
+  msg: "Boolean true", val: true
+}, {
+  msg: "Boolean false", val: false
+}, {
+  msg: "Regular expression /\d+/", val: /\d+/
+}, {
+  msg: "Empty array []", val: []
+}, {
+  msg: "Empty object {}", val: {}
+}, {
+  msg: "Array of size 3", val: new Array(3)
+}];
+
+function testNonStringValues() {
+  var i = 0;
+  var l = TEST_INPUT.length;
+
+  for (; i < l; i++) {
+    var e = TEST_INPUT[i];
+    var v = e.val;
+    var s = String(v);
+    assertTrue(s.endsWith(v), e.msg);
+    assertTrue(String.prototype.endsWith.call(v, v), e.msg);
+    assertTrue(String.prototype.endsWith.apply(v, [v]), e.msg);
+  }
+}
+testNonStringValues();
+
+var CustomType = function(value) {
+  this.endsWith = String.prototype.endsWith;
+  this.toString = function() {
+    return String(value);
+  }
+};
+
+function testCutomType() {
+  var i = 0;
+  var l = TEST_INPUT.length;
+
+  for (; i < l; i++) {
+    var e = TEST_INPUT[i];
+    var v = e.val;
+    var o = new CustomType(v);
+    assertTrue(o.endsWith(v), e.msg);
+  }
+}
+testCutomType();
+
+
+// Test cases found in FF
+assertTrue("abc".endsWith("abc"));
+assertTrue("abcd".endsWith("bcd"));
+assertTrue("abc".endsWith("c"));
+assertFalse("abc".endsWith("abcd"));
+assertFalse("abc".endsWith("bbc"));
+assertFalse("abc".endsWith("b"));
+assertTrue("abc".endsWith("abc", 3));
+assertTrue("abc".endsWith("bc", 3));
+assertFalse("abc".endsWith("a", 3));
+assertTrue("abc".endsWith("bc", 3));
+assertTrue("abc".endsWith("a", 1));
+assertFalse("abc".endsWith("abc", 1));
+assertTrue("abc".endsWith("b", 2));
+assertFalse("abc".endsWith("d", 2));
+assertFalse("abc".endsWith("dcd", 2));
+assertFalse("abc".endsWith("a", 42));
+assertTrue("abc".endsWith("bc", Infinity));
+assertFalse("abc".endsWith("a", Infinity));
+assertTrue("abc".endsWith("bc", undefined));
+assertFalse("abc".endsWith("bc", -43));
+assertFalse("abc".endsWith("bc", -Infinity));
+assertFalse("abc".endsWith("bc", NaN));
diff --git a/test/mjsunit/harmony/string-repeat.js b/test/mjsunit/harmony/string-repeat.js
new file mode 100644
index 0000000..182e5c0
--- /dev/null
+++ b/test/mjsunit/harmony/string-repeat.js
@@ -0,0 +1,74 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --harmony-strings
+
+assertEquals("000", String.prototype.repeat.call(0, 3));
+assertEquals("-1-1-1", String.prototype.repeat.call(-1, 3));
+assertEquals("2.12.12.1", String.prototype.repeat.call(2.1, 3));
+assertEquals("", String.prototype.repeat.call([], 3));
+assertEquals("1,2,3", String.prototype.repeat.call([1, 2, 3], 1));
+assertEquals("true", String.prototype.repeat.call(true, 1));
+assertEquals("false", String.prototype.repeat.call(false, 1));
+assertEquals("[object Object]", String.prototype.repeat.call({}, 1));
+
+assertEquals("000", String.prototype.repeat.apply(0, [3]));
+assertEquals("-1-1-1", String.prototype.repeat.apply(-1, [3]));
+assertEquals("2.12.12.1", String.prototype.repeat.apply(2.1, [3]));
+assertEquals("", String.prototype.repeat.apply([], [3]));
+assertEquals("1,2,3", String.prototype.repeat.apply([1, 2, 3], [1]));
+assertEquals("true", String.prototype.repeat.apply(true, [1]));
+assertEquals("false", String.prototype.repeat.apply(false, [1]));
+assertEquals("[object Object]", String.prototype.repeat.apply({}, [1]));
+
+assertEquals("\u10D8\u10D8\u10D8", "\u10D8".repeat(3));
+
+assertThrows('String.prototype.repeat.call(null, 1)', TypeError);
+assertThrows('String.prototype.repeat.call(undefined, 1)', TypeError);
+assertThrows('String.prototype.repeat.apply(null, [1])', TypeError);
+assertThrows('String.prototype.repeat.apply(undefined, [1])', TypeError);
+
+// Test cases found in FF
+assertEquals("abc", "abc".repeat(1));
+assertEquals("abcabc", "abc".repeat(2));
+assertEquals("abcabcabc", "abc".repeat(3));
+assertEquals("aaaaaaaaaa", "a".repeat(10));
+assertEquals("", "".repeat(5));
+assertEquals("", "abc".repeat(0));
+assertEquals("abcabc", "abc".repeat(2.0));
+
+assertThrows('"a".repeat(-1)', RangeError);
+assertThrows('"a".repeat(Number.POSITIVE_INFINITY)', RangeError);
+
+var myobj = {
+  toString: function() {
+    return "abc";
+  },
+  repeat : String.prototype.repeat
+};
+assertEquals("abc", myobj.repeat(1));
+assertEquals("abcabc", myobj.repeat(2));
\ No newline at end of file
diff --git a/test/mjsunit/harmony/string-startswith.js b/test/mjsunit/harmony/string-startswith.js
new file mode 100644
index 0000000..60c85d3
--- /dev/null
+++ b/test/mjsunit/harmony/string-startswith.js
@@ -0,0 +1,135 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --harmony-strings
+
+assertEquals(1, String.prototype.startsWith.length);
+
+var testString = "Hello World";
+assertTrue(testString.startsWith(""));
+assertTrue(testString.startsWith("Hello"));
+assertFalse(testString.startsWith("hello"));
+assertFalse(testString.startsWith("Hello World!"));
+assertFalse(testString.startsWith(null));
+assertFalse(testString.startsWith(undefined));
+
+assertTrue("null".startsWith(null));
+assertTrue("undefined".startsWith(undefined));
+
+var georgianUnicodeString = "\u10D0\u10D1\u10D2\u10D3\u10D4\u10D5\u10D6\u10D7";
+assertTrue(georgianUnicodeString.startsWith(georgianUnicodeString));
+assertTrue(georgianUnicodeString.startsWith("\u10D0\u10D1\u10D2"));
+assertFalse(georgianUnicodeString.startsWith("\u10D8"));
+
+assertThrows("String.prototype.startsWith.call(null, 'test')", TypeError);
+assertThrows("String.prototype.startsWith.call(null, null)", TypeError);
+assertThrows("String.prototype.startsWith.call(undefined, undefined)", TypeError);
+
+assertThrows("String.prototype.startsWith.apply(null, ['test'])", TypeError);
+assertThrows("String.prototype.startsWith.apply(null, [null])", TypeError);
+assertThrows("String.prototype.startsWith.apply(undefined, [undefined])", TypeError);
+
+var TEST_INPUT = [{
+  msg: "Empty string", val: ""
+}, {
+  msg: "Number 1234.34", val: 1234.34
+}, {
+  msg: "Integer number 0", val: 0
+}, {
+  msg: "Negative number -1", val: -1
+}, {
+  msg: "Boolean true", val: true
+}, {
+  msg: "Boolean false", val: false
+}, {
+  msg: "Regular expression /\d+/", val: /\d+/
+}, {
+  msg: "Empty array []", val: []
+}, {
+  msg: "Empty object {}", val: {}
+}, {
+  msg: "Array of size 3", val: new Array(3)
+}];
+
+function testNonStringValues() {
+  var i = 0;
+  var l = TEST_INPUT.length;
+
+  for (; i < l; i++) {
+    var e = TEST_INPUT[i];
+    var v = e.val;
+    var s = String(v);
+    assertTrue(s.startsWith(v), e.msg);
+    assertTrue(String.prototype.startsWith.call(v, v), e.msg);
+    assertTrue(String.prototype.startsWith.apply(v, [v]), e.msg);
+  }
+}
+testNonStringValues();
+
+var CustomType = function(value) {
+  this.startsWith = String.prototype.startsWith;
+  this.toString = function() {
+    return String(value);
+  }
+};
+
+function testCutomType() {
+  var i = 0;
+  var l = TEST_INPUT.length;
+
+  for (; i < l; i++) {
+    var e = TEST_INPUT[i];
+    var v = e.val;
+    var o = new CustomType(v);
+    assertTrue(o.startsWith(v), e.msg);
+  }
+}
+testCutomType();
+
+// Test cases found in FF
+assertTrue("abc".startsWith("abc"));
+assertTrue("abcd".startsWith("abc"));
+assertTrue("abc".startsWith("a"));
+assertFalse("abc".startsWith("abcd"));
+assertFalse("abc".startsWith("bcde"));
+assertFalse("abc".startsWith("b"));
+assertTrue("abc".startsWith("abc", 0));
+assertFalse("abc".startsWith("bc", 0));
+assertTrue("abc".startsWith("bc", 1));
+assertFalse("abc".startsWith("c", 1));
+assertFalse("abc".startsWith("abc", 1));
+assertTrue("abc".startsWith("c", 2));
+assertFalse("abc".startsWith("d", 2));
+assertFalse("abc".startsWith("dcd", 2));
+assertFalse("abc".startsWith("a", 42));
+assertFalse("abc".startsWith("a", Infinity));
+assertTrue("abc".startsWith("a", NaN));
+assertFalse("abc".startsWith("b", NaN));
+assertTrue("abc".startsWith("ab", -43));
+assertTrue("abc".startsWith("ab", -Infinity));
+assertFalse("abc".startsWith("bc", -42));
+assertFalse("abc".startsWith("bc", -Infinity));
diff --git a/test/mjsunit/math-min-max.js b/test/mjsunit/math-min-max.js
index e4fd313..a4d1b27 100644
--- a/test/mjsunit/math-min-max.js
+++ b/test/mjsunit/math-min-max.js
@@ -177,6 +177,21 @@
 
 run(crankshaft_test_2);
 
+var o = { a: 1, b: 2 };
+
+// Test smi-based Math.min.
+function f(o) {
+  return Math.min(o.a, o.b);
+}
+
+assertEquals(1, f(o));
+assertEquals(1, f(o));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(o));
+o.a = 5;
+o.b = 4;
+assertEquals(4, f(o));
+
 // Test overriding Math.min and Math.max
 Math.min = function(a, b) { return a + b; }
 Math.max = function(a, b) { return a - b; }
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 37e6e0f..ee35af5 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -253,8 +253,3 @@
 
 # Deopt every n garbage collections collides with the deopt every n times flag.
 regress/regress-2653: SKIP
-
-# Issue 2795:
-array-store-and-grow: SKIP if $mode == debug
-
-
diff --git a/test/mjsunit/regress/regress-1118.js b/test/mjsunit/regress/regress-1118.js
index 4d27963..4fd2345 100644
--- a/test/mjsunit/regress/regress-1118.js
+++ b/test/mjsunit/regress/regress-1118.js
@@ -52,8 +52,10 @@
     g();
   } else {
     // Run for a bit as long as h is unoptimized.
-    while (%GetOptimizationStatus(h, "no sync") == 2) {
-      for (var j = 0; j < 100; j++) g();
+    if (%GetOptimizationStatus(h) != 4) {
+      while (%GetOptimizationCount(h) == 0) {
+        for (var j = 0; j < 100; j++) g();
+      }
     }
     g();
   }
diff --git a/test/mjsunit/regress/regress-2618.js b/test/mjsunit/regress/regress-2618.js
index 3509db2..d1afa36 100644
--- a/test/mjsunit/regress/regress-2618.js
+++ b/test/mjsunit/regress/regress-2618.js
@@ -38,8 +38,7 @@
 }
 
 f();
-assertOptimized(f);
-
+assertTrue(%GetOptimizationCount(f) > 0 || %GetOptimizationStatus(f) == 4);
 
 function g() {
   for (var i = 0; i < 1; i++) { }
@@ -70,4 +69,4 @@
 }
 
 g();
-assertOptimized(g);
+assertTrue(%GetOptimizationCount(g) > 0 || %GetOptimizationStatus(g) == 4);
diff --git a/test/mjsunit/regress/regress-crbug-150545.js b/test/mjsunit/regress/regress-crbug-150545.js
index 19f7e68..8238d2f 100644
--- a/test/mjsunit/regress/regress-crbug-150545.js
+++ b/test/mjsunit/regress/regress-crbug-150545.js
@@ -45,8 +45,10 @@
 
   function outer() {
     inner(1,2,3);
-    // Trigger OSR.
-    while (%GetOptimizationStatus(outer, "no sync") == 2) {}
+    // Trigger OSR, if optimization is not disabled.
+    if (%GetOptimizationStatus(outer) != 4) {
+      while (%GetOptimizationCount(outer) == 0) {}
+    }
   }
 
   outer();
diff --git a/test/mjsunit/regress/regress-crbug-258519.js b/test/mjsunit/regress/regress-crbug-258519.js
new file mode 100644
index 0000000..b2015a8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-258519.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {
+  compare_null: function(x) { return null != x; },
+  kaboom: function() {}
+}
+
+function crash(x) {
+  var b = a;
+  b.compare_null(x) && b.kaboom();
+  return "ok";
+}
+
+assertEquals("ok", crash(null));
+assertEquals("ok", crash(null));
+%OptimizeFunctionOnNextCall(crash);
+// Used to throw: "TypeError: Cannot call method 'kaboom' of undefined".
+assertEquals("ok", crash(1));
diff --git a/test/mjsunit/regress/regress-omit-checks.js b/test/mjsunit/regress/regress-omit-checks.js
new file mode 100644
index 0000000..e5d5074
--- /dev/null
+++ b/test/mjsunit/regress/regress-omit-checks.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {x:1};
+var a_deprecate = {x:1};
+a_deprecate.x = 1.5;
+function create() {
+  return {__proto__:a, y:1};
+}
+var b1 = create();
+var b2 = create();
+var b3 = create();
+var b4 = create();
+
+function set(b) {
+  b.x = 5;
+  b.z = 10;
+}
+
+set(b1);
+set(b2);
+%OptimizeFunctionOnNextCall(set);
+set(b3);
+var called = false;
+a.x = 1.5;
+Object.defineProperty(a, "z", {set:function(v) { called = true; }});
+set(b4);
+assertTrue(called);
+assertEquals(undefined, b4.z);
diff --git a/test/mjsunit/stack-traces-custom-lazy.js b/test/mjsunit/stack-traces-custom-lazy.js
new file mode 100644
index 0000000..91d97f3
--- /dev/null
+++ b/test/mjsunit/stack-traces-custom-lazy.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function testPrepareStackTrace(closure) {
+  var error = undefined;
+  try {
+    closure();
+    assertUnreachable();
+  } catch (e) {
+    error = e;
+  }
+
+  // We expect custom formatting to be lazy. Setting the custom
+  // function right before calling error.stack should be fine.
+  Error.prepareStackTrace = function(e, frames) {
+    return "bar";
+  }
+
+  assertEquals("bar", error.stack);
+  Error.prepareStackTrace = undefined;
+}
+
+testPrepareStackTrace(function() { throw new Error("foo"); });
+testPrepareStackTrace(function f() { f(); });
+
diff --git a/test/mjsunit/stack-traces.js b/test/mjsunit/stack-traces.js
index 4a37ee6..46a16eb 100644
--- a/test/mjsunit/stack-traces.js
+++ b/test/mjsunit/stack-traces.js
@@ -315,7 +315,11 @@
 Error.prepareStackTrace = function() { throw new Error("abc"); };
 var message;
 try {
-  throw new Error();
+  try {
+    throw new Error();
+  } catch (e) {
+    e.stack;
+  }
 } catch (e) {
   message = e.message;
 }
@@ -324,6 +328,6 @@
 
 // Test that modifying Error.prepareStackTrace by itself works.
 Error.prepareStackTrace = function() { Error.prepareStackTrace = "custom"; };
-new Error();
+new Error().stack;
 
 assertEquals("custom", Error.prepareStackTrace);
diff --git a/test/mjsunit/transition-elements-kind.js b/test/mjsunit/transition-elements-kind.js
index ba05c95..9fac780 100644
--- a/test/mjsunit/transition-elements-kind.js
+++ b/test/mjsunit/transition-elements-kind.js
@@ -25,8 +25,7 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// Flags: --allow-natives-syntax --compiled-transitions
-// Flags: --track-allocation-sites
+// Flags: --allow-natives-syntax --track-allocation-sites
 
 // Allocation site for empty double arrays.
 function foo() {