Merge V8 3.9 at 3.9.24.9

http://v8.googlecode.com/svn/branches/3.9@11260

Bug: 5688872
Change-Id: Iddd944e82189d92df3fc427dc5f0d3f1b2f0c6c8
diff --git a/test/mjsunit/string-replace-one-char.js b/test/mjsunit/string-replace-one-char.js
index f153acc..cb4167b 100644
--- a/test/mjsunit/string-replace-one-char.js
+++ b/test/mjsunit/string-replace-one-char.js
@@ -71,13 +71,13 @@
 
 // Deep cons tree.
 var nested_1 = "";
-for (var i = 0; i < 1000000; i++) nested_1 += "y";
+for (var i = 0; i < 100000; i++) nested_1 += "y";
 var nested_1_result = prefix1024 + nested_1 + "aa";
 nested_1 = prefix1024 + nested_1 + "z";
 test_replace(nested_1, nested_1_result, "z", "aa");
 
 var nested_2 = "\u2244";
-for (var i = 0; i < 1000000; i++) nested_2 += "y";
+for (var i = 0; i < 100000; i++) nested_2 += "y";
 var nested_2_result = prefix1024 + nested_2 + "aa";
 nested_2 = prefix1024 + nested_2 + "\u2012";
 test_replace(nested_2, nested_2_result, "\u2012", "aa");