Upgrade V8 to version 4.9.385.28
https://chromium.googlesource.com/v8/v8/+/4.9.385.28
FPIIM-449
Change-Id: I4b2e74289d4bf3667f2f3dc8aa2e541f63e26eb4
diff --git a/test/mjsunit/regress/regress-454725.js b/test/mjsunit/regress/regress-454725.js
new file mode 100644
index 0000000..a2469d1
--- /dev/null
+++ b/test/mjsunit/regress/regress-454725.js
@@ -0,0 +1,42 @@
+// Copyright 2015 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --expose-gc
+
+var __v_9 = {};
+var depth = 15;
+var current = 0;
+
+function __f_15(__v_3) {
+ if ((__v_3 % 50) != 0) {
+ return __v_3;
+ } else {
+ return __v_9 + 0.5;
+ }
+}
+function __f_13(a) {
+ a[100000 - 2] = 1;
+ for (var __v_3= 0; __v_3 < 70000; ++__v_3 ) {
+ a[__v_3] = __f_15(__v_3);
+ }
+}
+function __f_2(size) {
+
+}
+var tmp;
+function __f_18(allocator) {
+ current++;
+ if (current == depth) return;
+ var __v_7 = new allocator(100000);
+ __f_13(__v_7);
+ var __v_4 = 6;
+ for (var __v_3= 0; __v_3 < 70000; __v_3 += 501 ) {
+ tmp += __v_3;
+ }
+ __f_18(Array);
+ current--;
+}
+
+gc();
+__f_18(__f_2);