Merge WebKit at r59636: Update v8 to r4660.

Will build and run with current webkit.

Change-Id: I57bae621fd894da363ba84e1757ad09eb7c502b9
diff --git a/test/mjsunit/arguments-load-across-eval.js b/test/mjsunit/arguments-load-across-eval.js
new file mode 100644
index 0000000..e97c113
--- /dev/null
+++ b/test/mjsunit/arguments-load-across-eval.js
@@ -0,0 +1,86 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests loading of aguments across eval calls.
+
+// Test loading across an eval call that does not shadow variables.
+function testNoShadowing(x, h) {
+  function f() {
+    eval('1');
+    assertEquals(1, x);
+    assertEquals(2, h());
+    function g() {
+      assertEquals(1, x);
+      assertEquals(2, h());
+    }
+    g();
+  }
+  f();
+}
+
+testNoShadowing(1, function() { return 2; });
+
+// Test loading across eval calls that do not shadow variables.
+function testNoShadowing2(x, h) {
+  eval('1');
+  function f() {
+    eval('1');
+    assertEquals(1, x);
+    assertEquals(2, h());
+    function g() {
+      assertEquals(1, x);
+      assertEquals(2, h());
+    }
+    g();
+  }
+  f();
+}
+
+testNoShadowing2(1, function() { return 2; });
+
+// Test loading across an eval call that shadows variables.
+function testShadowing(x, h) {
+  function f() {
+    assertEquals(1, x);
+    assertEquals(2, h());
+    eval('var x = 3; var h = function() { return 4; };');
+    assertEquals(3, x);
+    assertEquals(4, h());
+    function g() {
+      assertEquals(3, x);
+      assertEquals(4, h());
+    }
+    g();
+  }
+  f();
+  assertEquals(1, x);
+  assertEquals(2, h());
+}
+
+testShadowing(1, function() { return 2; });
+
+
diff --git a/test/mjsunit/array-concat.js b/test/mjsunit/array-concat.js
index 2346c8d..db89f4d 100644
--- a/test/mjsunit/array-concat.js
+++ b/test/mjsunit/array-concat.js
@@ -29,7 +29,82 @@
  * @fileoverview Test concat on small and large arrays
  */
 
-var poses = [140, 4000000000];
+var poses;
+
+poses = [140, 4000000000];
+while (pos = poses.shift()) {
+  var a = new Array(pos);
+  var array_proto = [];
+  a.__proto__ = array_proto;
+  assertEquals(pos, a.length);
+  a.push('foo');
+  assertEquals(pos + 1, a.length);
+  var b = ['bar'];
+  var c = a.concat(b);
+  assertEquals(pos + 2, c.length);
+  assertEquals("undefined", typeof(c[pos - 1]));
+  assertEquals("foo", c[pos]);
+  assertEquals("bar", c[pos + 1]);
+
+  // Can we fool the system by putting a number in a string?
+  var onetwofour = "124";
+  a[onetwofour] = 'doo';
+  assertEquals(a[124], 'doo');
+  c = a.concat(b);
+  assertEquals(c[124], 'doo');
+
+  // If we put a number in the prototype, then the spec says it should be
+  // copied on concat.
+  array_proto["123"] = 'baz';
+  assertEquals(a[123], 'baz');
+
+  c = a.concat(b);
+  assertEquals(pos + 2, c.length);
+  assertEquals("baz", c[123]);
+  assertEquals("undefined", typeof(c[pos - 1]));
+  assertEquals("foo", c[pos]);
+  assertEquals("bar", c[pos + 1]);
+
+  // When we take the number off the prototype it disappears from a, but
+  // the concat put it in c itself.
+  array_proto["123"] = undefined;
+  assertEquals("undefined", typeof(a[123]));
+  assertEquals("baz", c[123]);
+
+  // If the element of prototype is shadowed, the element on the instance
+  // should be copied, but not the one on the prototype.
+  array_proto[123] = 'baz';
+  a[123] = 'xyz';
+  assertEquals('xyz', a[123]);
+  c = a.concat(b);
+  assertEquals('xyz', c[123]);
+
+  // Non-numeric properties on the prototype or the array shouldn't get
+  // copied.
+  array_proto.moe = 'joe';
+  a.ben = 'jerry';
+  assertEquals(a["moe"], 'joe');
+  assertEquals(a["ben"], 'jerry');
+  c = a.concat(b);
+  // ben was not copied
+  assertEquals("undefined", typeof(c.ben));
+
+  // When we take moe off the prototype it disappears from all arrays.
+  array_proto.moe = undefined;
+  assertEquals("undefined", typeof(c.moe));
+
+  // Negative indices don't get concated.
+  a[-1] = 'minus1';
+  assertEquals("minus1", a[-1]);
+  assertEquals("undefined", typeof(a[0xffffffff]));
+  c = a.concat(b);
+  assertEquals("undefined", typeof(c[-1]));
+  assertEquals("undefined", typeof(c[0xffffffff]));
+  assertEquals(c.length, a.length + 1);
+
+}
+
+poses = [140, 4000000000];
 while (pos = poses.shift()) {
   var a = new Array(pos);
   assertEquals(pos, a.length);
@@ -91,7 +166,7 @@
   Array.prototype.moe = undefined;
   assertEquals("undefined", typeof(c.moe));
 
-  // Negative indeces don't get concated.
+  // Negative indices don't get concated.
   a[-1] = 'minus1';
   assertEquals("minus1", a[-1]);
   assertEquals("undefined", typeof(a[0xffffffff]));
diff --git a/test/mjsunit/array-pop.js b/test/mjsunit/array-pop.js
index a8d131e..f193f09 100644
--- a/test/mjsunit/array-pop.js
+++ b/test/mjsunit/array-pop.js
@@ -81,6 +81,34 @@
     }
     Array.prototype.length = 0;  // Clean-up.
   }
+
+  // Check that pop works on inherited properties for
+  // arrays with array prototype.
+  for (var i = 0; i < 10 ;i++) {  // Ensure ICs are stabilized.
+    var array_proto = [];
+    array_proto[1] = 1;
+    array_proto[3] = 3;
+    array_proto[5] = 5;
+    array_proto[7] = 7;
+    array_proto[9] = 9;
+    a = [0,1,2,,4,,6,7,8,,];
+    a.__proto__ = array_proto;
+    assertEquals(10, a.length, "array_proto-inherit-initial-length");
+    for (var j = 9; j >= 0; j--) {
+      assertEquals(j + 1, a.length, "array_proto-inherit-pre-length-" + j);
+      assertTrue(j in a, "array_proto-has property " + j);
+      var own = a.hasOwnProperty(j);
+      var inherited = array_proto.hasOwnProperty(j);
+      assertEquals(j, a.pop(), "array_proto-inherit-pop");
+      assertEquals(j, a.length, "array_proto-inherit-post-length");
+      assertFalse(a.hasOwnProperty(j), "array_proto-inherit-deleted-own-" + j);
+      assertEquals(inherited, array_proto.hasOwnProperty(j),
+                   "array_proto-inherit-not-deleted-inherited" + j);
+    }
+  }
+
+  // Check that pop works on inherited properties for
+  // arrays with array prototype.
 })();
 
 // Test the case of not JSArray receiver.
diff --git a/test/mjsunit/array-shift.js b/test/mjsunit/array-shift.js
index d985b31..3601cbb 100644
--- a/test/mjsunit/array-shift.js
+++ b/test/mjsunit/array-shift.js
@@ -69,3 +69,40 @@
   assertTrue(delete Array.prototype[5]);
   assertTrue(delete Array.prototype[7]);
 })();
+
+// Now check the case with array of holes and some elements on prototype
+// which is an array itself.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+  var array_proto = new Array();
+  array_proto[3] = "@3";
+  array_proto[7] = "@7";
+  array.__proto__ = array_proto;
+
+  assertEquals(len, array.length);
+  for (var i = 0; i < array.length; i++) {
+    assertEquals(array[i], array_proto[i]);
+  }
+
+  array.shift();
+
+  assertEquals(len - 1, array.length);
+  // Note that shift copies values from prototype into the array.
+  assertEquals(array[2], array_proto[3]);
+  assertTrue(array.hasOwnProperty(2));
+
+  assertEquals(array[6], array_proto[7]);
+  assertTrue(array.hasOwnProperty(6));
+
+  // ... but keeps the rest as holes:
+  array_proto[5] = "@5";
+  assertEquals(array[5], array_proto[5]);
+  assertFalse(array.hasOwnProperty(5));
+
+  assertEquals(array[3], array_proto[3]);
+  assertFalse(array.hasOwnProperty(3));
+
+  assertEquals(array[7], array_proto[7]);
+  assertFalse(array.hasOwnProperty(7));
+})();
diff --git a/test/mjsunit/array-slice.js b/test/mjsunit/array-slice.js
index 30e9f3e..8f9ce53 100644
--- a/test/mjsunit/array-slice.js
+++ b/test/mjsunit/array-slice.js
@@ -127,6 +127,53 @@
 
 
 // Now check the case with array of holes and some elements on prototype.
+// Note: that is important that this test runs before the next one
+// as the next one tampers Array.prototype.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+
+  var at3 = "@3";
+  var at7 = "@7";
+
+  for (var i = 0; i < 7; i++) {
+    var array_proto = [];
+    array_proto[3] = at3;
+    array_proto[7] = at7;
+    array.__proto__ = array_proto;
+
+    assertEquals(len, array.length);
+    for (var i = 0; i < array.length; i++) {
+      assertEquals(array[i], array_proto[i]);
+    }
+
+    var sliced = array.slice();
+
+    assertEquals(len, sliced.length);
+
+    assertTrue(delete array_proto[3]);
+    assertTrue(delete array_proto[7]);
+
+    // Note that slice copies values from prototype into the array.
+    assertEquals(array[3], undefined);
+    assertFalse(array.hasOwnProperty(3));
+    assertEquals(sliced[3], at3);
+    assertTrue(sliced.hasOwnProperty(3));
+
+    assertEquals(array[7], undefined);
+    assertFalse(array.hasOwnProperty(7));
+    assertEquals(sliced[7], at7);
+    assertTrue(sliced.hasOwnProperty(7));
+
+    // ... but keeps the rest as holes:
+    array_proto[5] = "@5";
+    assertEquals(array[5], array_proto[5]);
+    assertFalse(array.hasOwnProperty(5));
+  }
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
 (function() {
   var len = 9;
   var array = new Array(len);
diff --git a/test/mjsunit/array-splice.js b/test/mjsunit/array-splice.js
index 887097d..88c4876 100644
--- a/test/mjsunit/array-splice.js
+++ b/test/mjsunit/array-splice.js
@@ -255,6 +255,56 @@
 
   for (var i = 0; i < 7; i++) {
     var array = new Array(len);
+    var array_proto = [];
+    array_proto[3] = at3;
+    array_proto[7] = at7;
+    array.__proto__ = array_proto;
+
+    var spliced = array.splice(2, 2, 'one', undefined, 'two');
+
+    // Second hole (at index 3) of array turns into
+    // value of Array.prototype[3] while copying.
+    assertEquals([, at3], spliced);
+    assertEquals([, , 'one', undefined, 'two', , , at7, at7, ,], array);
+
+    // ... but array[3] and array[7] is actually a hole:
+    assertTrue(delete array_proto[3]);
+    assertEquals(undefined, array[3]);
+    assertTrue(delete array_proto[7]);
+    assertEquals(undefined, array[7]);
+
+    // and now check hasOwnProperty
+    assertFalse(array.hasOwnProperty(0), "array.hasOwnProperty(0)");
+    assertFalse(array.hasOwnProperty(1), "array.hasOwnProperty(1)");
+    assertTrue(array.hasOwnProperty(2));
+    assertTrue(array.hasOwnProperty(3));
+    assertTrue(array.hasOwnProperty(4));
+    assertFalse(array.hasOwnProperty(5), "array.hasOwnProperty(5)");
+    assertFalse(array.hasOwnProperty(6), "array.hasOwnProperty(6)");
+    assertFalse(array.hasOwnProperty(7), "array.hasOwnProperty(7)");
+    assertTrue(array.hasOwnProperty(8));
+    assertFalse(array.hasOwnProperty(9), "array.hasOwnProperty(9)");
+
+    // and now check couple of indices above length.
+    assertFalse(array.hasOwnProperty(10), "array.hasOwnProperty(10)");
+    assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
+    assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
+    assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
+    assertFalse(array.hasOwnProperty(2 << 32 - 1),
+                "array.hasOwnProperty(2 << 31 - 1)");
+  }
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
+(function() {
+  var len = 9;
+
+  var at3 = "@3";
+  var at7 = "@7";
+
+  for (var i = 0; i < 7; i++) {
+    var array = new Array(len);
     Array.prototype[3] = at3;
     Array.prototype[7] = at7;
 
@@ -265,7 +315,9 @@
     assertEquals([, at3], spliced);
     assertEquals([, , 'one', undefined, 'two', , , at7, at7, ,], array);
 
-    // ... but array[7] is actually a hole:
+    // ... but array[3] and array[7] is actually a hole:
+    assertTrue(delete Array.prototype[3]);
+    assertEquals(undefined, array[3]);
     assertTrue(delete Array.prototype[7]);
     assertEquals(undefined, array[7]);
 
@@ -286,7 +338,8 @@
     assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
     assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
     assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
-    assertFalse(array.hasOwnProperty(2 << 32 - 1), "array.hasOwnProperty(2 << 31 - 1)");
+    assertFalse(array.hasOwnProperty(2 << 32 - 1),
+                "array.hasOwnProperty(2 << 31 - 1)");
   }
 })();
 
diff --git a/test/mjsunit/array-unshift.js b/test/mjsunit/array-unshift.js
index dbe245b..c4cc95c 100644
--- a/test/mjsunit/array-unshift.js
+++ b/test/mjsunit/array-unshift.js
@@ -37,8 +37,8 @@
 })();
 
 
-// Check that unshif with no args has a side-effect of
-// feeling the holes with elements from the prototype
+// Check that unshift with no args has a side-effect of
+// filling the holes with elements from the prototype
 // (if present, of course)
 (function() {
   var len = 3;
@@ -115,6 +115,81 @@
   assertTrue(delete Array.prototype[7]);
 })();
 
+// Check that unshift with no args has a side-effect of
+// filling the holes with elements from the prototype
+// (if present, of course)
+(function() {
+  var len = 3;
+  var array = new Array(len);
+
+  var at0 = '@0';
+  var at2 = '@2';
+
+  var array_proto = [];
+  array_proto[0] = at0;
+  array_proto[2] = at2;
+  array.__proto__ = array_proto;
+
+  // array owns nothing...
+  assertFalse(array.hasOwnProperty(0));
+  assertFalse(array.hasOwnProperty(1));
+  assertFalse(array.hasOwnProperty(2));
+
+  // ... but sees values from array_proto.
+  assertEquals(array[0], at0);
+  assertEquals(array[1], undefined);
+  assertEquals(array[2], at2);
+
+  assertEquals(len, array.unshift());
+
+  // unshift makes array own 0 and 2...
+  assertTrue(array.hasOwnProperty(0));
+  assertFalse(array.hasOwnProperty(1));
+  assertTrue(array.hasOwnProperty(2));
+
+  // ... so they are not affected be delete.
+  assertEquals(array[0], at0);
+  assertEquals(array[1], undefined);
+  assertEquals(array[2], at2);
+})();
+
+
+// Now check the case with array of holes and some elements on prototype.
+(function() {
+  var len = 9;
+  var array = new Array(len);
+  var array_proto = []
+  array_proto[3] = "@3";
+  array_proto[7] = "@7";
+  array.__proto__ = array_proto;
+
+  assertEquals(len, array.length);
+  for (var i = 0; i < array.length; i++) {
+    assertEquals(array[i], array_proto[i]);
+  }
+
+  assertEquals(len + 1, array.unshift('head'));
+
+  assertEquals(len + 1, array.length);
+  // Note that unshift copies values from prototype into the array.
+  assertEquals(array[4], array_proto[3]);
+  assertTrue(array.hasOwnProperty(4));
+
+  assertEquals(array[8], array_proto[7]);
+  assertTrue(array.hasOwnProperty(8));
+
+  // ... but keeps the rest as holes:
+  array_proto[5] = "@5";
+  assertEquals(array[5], array_proto[5]);
+  assertFalse(array.hasOwnProperty(5));
+
+  assertEquals(array[3], array_proto[3]);
+  assertFalse(array.hasOwnProperty(3));
+
+  assertEquals(array[7], array_proto[7]);
+  assertFalse(array.hasOwnProperty(7));
+})();
+
 // Check the behaviour when approaching maximal values for length.
 (function() {
   for (var i = 0; i < 7; i++) {
diff --git a/test/mjsunit/instanceof-2.js b/test/mjsunit/instanceof-2.js
new file mode 100644
index 0000000..fd6874d
--- /dev/null
+++ b/test/mjsunit/instanceof-2.js
@@ -0,0 +1,329 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var except = "exception";
+
+var correct_answer_index = 0;
+var correct_answers = [
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,   true,  false,  false,   true,
+ false,   true,   true,  false,  false,   true,   true,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,  false,   true,
+except, except,   true,  false, except, except,   true,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,   true,  false, except, except,
+ false,   true, except, except,  false,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,  false,   true,   true,  false,
+  true,   true,  false,  false,  false,   true,   true,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,   true,  false,
+except, except,  false,  false, except, except,   true,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,   true,  false, except, except,
+ false,   true, except, except,  false,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,   true,   true,  false,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,  false,   true,   true,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,  false,   true,
+except, except,   true,  false, except, except,   true,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,   true, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,  false,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,   true,   true,  false,
+  true,  false,  false,   true,  false,   true,   true,  false,
+ false,   true,   true,  false,  false,   true,   true,  false,
+  true,   true,  false,  false,  false,   true,   true,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,   true,  false,
+except, except,  false,  false, except, except,   true,  false,
+ false,  false, except, except,  false,   true, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,  false,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,  false,  false, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,  false,  false, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,   true,   true,  false,  false,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,   true,   true, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,   true,   true,  false,  false,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,   true,   true, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,  false,  false,   true,   true,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,  false,  false,
+except, except,   true,  false, except, except,   true,   true,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,  false,  false, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,  false,  false,   true,   true,
+  true,   true,  false,  false,  false,  false,   true,   true,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,   true,   true,
+except, except,  false,  false, except, except,   true,   true,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,  false,  false, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,  false,  false,   true,   true,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,  false,  false,
+except, except,   true,  false, except, except,   true,   true,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,  false,  false, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,  false,  false,   true,   true,
+  true,   true,  false,  false,  false,  false,   true,   true,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,   true,   true,
+except, except,  false,  false, except, except,   true,   true,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,  false,  false, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,  false,  false, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,  false,  false,   true,   true,
+  true,  false,  false,   true,  false,  false,   true,   true,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,  false,  false, except, except,
+  true,  false, except, except,  false,  false, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,   true,   true,  false,  false,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,   true,   true, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+ false,  false,   true,   true,   true,   true,  false,  false,
+  true,  false,  false,   true,   true,   true,  false,  false,
+ false,   true,   true,  false,   true,   true,  false,  false,
+  true,   true,  false,  false,   true,   true,  false,  false,
+except, except,   true,   true, except, except,   true,   true,
+except, except,  false,   true, except, except,   true,   true,
+except, except,   true,  false, except, except,  false,  false,
+except, except,  false,  false, except, except,  false,  false,
+ false,  false, except, except,   true,   true, except, except,
+  true,  false, except, except,   true,   true, except, except,
+ false,   true, except, except,   true,   true, except, except,
+  true,   true, except, except,   true,   true, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except,
+except, except, except, except, except, except, except, except];
+
+for (var i = 0; i < 256; i++) {
+  Test(i & 1, i & 2, i & 4, i & 8, i & 0x10, i & 0x20, i & 0x40, i & 0x80);
+}
+
+
+function InstanceTest(x, func) {
+  try {
+    var answer = (x instanceof func);
+    assertEquals(correct_answers[correct_answer_index], answer);
+  } catch (e) {
+    assertTrue(/prototype/.test(e));
+    assertEquals(correct_answers[correct_answer_index], except);
+  }
+  correct_answer_index++;
+}
+
+
+function Test(a, b, c, d, e, f, g, h) {
+  var Foo = function() { }
+  var Bar = function() { }
+
+  if (c) Foo.prototype = 12;
+  if (d) Bar.prototype = 13;
+  var x = a ? new Foo() : new Bar();
+  var y = b ? new Foo() : new Bar();
+  InstanceTest(x, Foo);
+  InstanceTest(y, Foo);
+  InstanceTest(x, Bar);
+  InstanceTest(y, Bar);
+  if (e) x.__proto__ = Bar.prototype;
+  if (f) y.__proto__ = Foo.prototype;
+  if (g) {
+    x.__proto__ = y;
+  } else {
+    if (h) y.__proto__ = x
+  }
+  InstanceTest(x, Foo);
+  InstanceTest(y, Foo);
+  InstanceTest(x, Bar);
+  InstanceTest(y, Bar);
+}
diff --git a/test/mjsunit/mjsunit.js b/test/mjsunit/mjsunit.js
index 07c4e7e..558282f 100644
--- a/test/mjsunit/mjsunit.js
+++ b/test/mjsunit/mjsunit.js
@@ -27,6 +27,8 @@
 
 function MjsUnitAssertionError(message) {
   this.message = message;
+  // This allows fetching the stack trace using TryCatch::StackTrace.
+  this.stack = new Error("").stack;
 }
 
 MjsUnitAssertionError.prototype.toString = function () {
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 47963fe..514d345 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -48,10 +48,6 @@
 # Skip long running test in debug and allow it to timeout in release mode.
 regress/regress-524: (PASS || TIMEOUT), SKIP if $mode == debug
 
-# Skip experimental liveedit drop frame on non-ia32 architectures.
-# debug-liveedit-check-stack: SKIP if $arch != ia32
-debug-liveedit-check-stack: SKIP
-
 [ $arch == arm ]
 
 # Slow tests which times out in debug mode.
@@ -68,7 +64,19 @@
 # Skip long running test in debug mode on ARM.
 string-indexof-2: PASS, SKIP if $mode == debug
 
+# Stack manipulations in LiveEdit is implemented for ia32 only.
+debug-liveedit-check-stack: SKIP
+
 [ $arch == mips ]
 
+# Stack manipulations in LiveEdit is implemented for ia32 only.
+debug-liveedit-check-stack: SKIP
+
 # Skip all tests on MIPS.
 *: SKIP
+
+[ $arch == x64 ]
+# Stack manipulations in LiveEdit is implemented for ia32 only.
+debug-liveedit-check-stack: SKIP
+
+
diff --git a/test/mjsunit/property-load-across-eval.js b/test/mjsunit/property-load-across-eval.js
index 8271f4c..5419cc7 100644
--- a/test/mjsunit/property-load-across-eval.js
+++ b/test/mjsunit/property-load-across-eval.js
@@ -28,17 +28,57 @@
 // Tests loading of properties across eval calls.
 
 var x = 1;
+function global_function() { return 'global'; }
+const const_uninitialized;
+const const_initialized = function() { return "const_global"; }
 
 // Test loading across an eval call that does not shadow variables.
 function testNoShadowing() {
   var y = 2;
+  function local_function() { return 'local'; }
+  const local_const_uninitialized;
+  const local_const_initialized = function() { return "const_local"; }
   function f() {
     eval('1');
     assertEquals(1, x);
+    try { typeof(asdf); } catch(e) { assertUnreachable(); }
     assertEquals(2, y);
+    assertEquals('global', global_function());
+    assertEquals('local', local_function());
+    try {
+      const_uninitialized();
+      assertUnreachable();
+    } catch(e) {
+      // Ignore.
+    }
+    assertEquals('const_global', const_initialized());
+    try {
+      local_const_uninitialized();
+      assertUnreachable();
+    } catch(e) {
+      // Ignore.
+    }
+    assertEquals('const_local', local_const_initialized());
     function g() {
       assertEquals(1, x);
+      try { typeof(asdf); } catch(e) { assertUnreachable(); }
       assertEquals(2, y);
+      assertEquals('global', global_function());
+      assertEquals('local', local_function());
+      try {
+        const_uninitialized();
+        assertUnreachable();
+      } catch(e) {
+        // Ignore.
+      }
+      assertEquals('const_global', const_initialized());
+      try {
+        local_const_uninitialized();
+        assertUnreachable();
+      } catch(e) {
+        // Ignore.
+      }
+      assertEquals('const_local', local_const_initialized());
     }
     g();
   }
@@ -50,14 +90,19 @@
 // Test loading across eval calls that do not shadow variables.
 function testNoShadowing2() {
   var y = 2;
+  function local_function() { return 'local'; }
   eval('1');
   function f() {
     eval('1');
     assertEquals(1, x);
     assertEquals(2, y);
+    assertEquals('global', global_function());
+    assertEquals('local', local_function());
     function g() {
       assertEquals(1, x);
       assertEquals(2, y);
+      assertEquals('global', global_function());
+      assertEquals('local', local_function());
     }
     g();
   }
@@ -69,13 +114,20 @@
 // Test loading across an eval call that shadows variables.
 function testShadowing() {
   var y = 2;
+  function local_function() { return 'local'; }
   function f() {
     eval('var x = 3; var y = 4;');
     assertEquals(3, x);
     assertEquals(4, y);
+    eval('function local_function() { return "new_local"; }');
+    eval('function global_function() { return "new_nonglobal"; }');
+    assertEquals('new_nonglobal', global_function());
+    assertEquals('new_local', local_function());
     function g() {
       assertEquals(3, x);
       assertEquals(4, y);
+      assertEquals('new_nonglobal', global_function());
+      assertEquals('new_local', local_function());
     }
     g();
   }
diff --git a/test/mjsunit/regress/regress-696.js b/test/mjsunit/regress/regress-696.js
new file mode 100644
index 0000000..21977e1
--- /dev/null
+++ b/test/mjsunit/regress/regress-696.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=696
+// Because of the change in dateparser in revision 4557 to support time
+// only strings in Date.parse we also misleadingly supported strings with non
+// leading numbers. 
+
+assertTrue(isNaN(Date.parse('x')));
+assertTrue(isNaN(Date.parse('1x')));
+assertTrue(isNaN(Date.parse('xT10:00:00')));
+assertTrue(isNaN(Date.parse('This is a relatively long string')));
diff --git a/test/mjsunit/regress/regress-697.js b/test/mjsunit/regress/regress-697.js
new file mode 100644
index 0000000..a59e2b2
--- /dev/null
+++ b/test/mjsunit/regress/regress-697.js
@@ -0,0 +1,34 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=697
+
+try {
+  Object.create(function(){});
+} catch (e) {
+  assertTrue(false);
+}
diff --git a/test/mjsunit/smi-ops.js b/test/mjsunit/smi-ops.js
index 9f18790..d5bd214 100644
--- a/test/mjsunit/smi-ops.js
+++ b/test/mjsunit/smi-ops.js
@@ -678,3 +678,10 @@
 
 assertEquals(4589934592, LogicalShiftRightByMultipleOf32(-2000000000));
 assertEquals(4589934592, LogicalShiftRightByMultipleOf32(-2000000000));
+
+// Verify that the shift amount is reduced modulo 32, not modulo 64.
+function LeftShiftThreeBy(x) {return 3 << x;}
+assertEquals(24, LeftShiftThreeBy(3));
+assertEquals(24, LeftShiftThreeBy(35));
+assertEquals(24, LeftShiftThreeBy(67));
+assertEquals(24, LeftShiftThreeBy(-29));