diff --git a/test/mjsunit/abs.js b/test/mjsunit/abs.js
new file mode 100644
index 0000000..d1c453c
--- /dev/null
+++ b/test/mjsunit/abs.js
@@ -0,0 +1,48 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test Math.sin and Math.abs.
+
+assertEquals(1, Math.abs(1));  // Positive SMI.
+assertEquals(1, Math.abs(-1));  // Negative SMI.
+assertEquals(0.5, Math.abs(0.5));  // Positive double.
+assertEquals(0.5, Math.abs(-0.5));  // Negative double.
+assertEquals('Infinity', Math.abs(Number('+Infinity').toString()));
+assertEquals('Infinity', Math.abs(Number('-Infinity').toString()));
+assertEquals('NaN', Math.abs(NaN).toString());
+assertEquals('NaN', Math.abs(-NaN).toString());
+
+var minusZero = 1 / (-1 / 0);
+function isMinusZero(x) {
+  return x === 0 && 1 / x < 0;
+}
+
+assertTrue(!isMinusZero(0));
+assertTrue(isMinusZero(minusZero));
+assertEquals(0, Math.abs(minusZero));
+assertTrue(!isMinusZero(Math.abs(minusZero)));
+assertTrue(!isMinusZero(Math.abs(0.0)));
diff --git a/test/mjsunit/array-elements-from-array-prototype-chain.js b/test/mjsunit/array-elements-from-array-prototype-chain.js
new file mode 100644
index 0000000..edbeb2a
--- /dev/null
+++ b/test/mjsunit/array-elements-from-array-prototype-chain.js
@@ -0,0 +1,191 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+////////////////////////////////////////////////////////////////////////
+// Tests below verify that elements set on Array.prototype's proto propagate
+// for various Array.prototype functions (like unshift, shift, etc.)
+// If add any new tests here, consider adding them to all other files:
+//   array-elements-from-array-prototype.js
+//   array-elements-from-array-prototype-chain.js
+//   array-elements-from-object-prototype.js
+// those ideally should be identical modulo host of elements and
+// the way elements introduced.
+//
+// Note: they are put into a separate file as we need maximally clean
+// VM setup---some optimizations might be already turned off in
+// 'dirty' VM.
+////////////////////////////////////////////////////////////////////////
+
+var at3 = '@3'
+var at7 = '@7'
+
+Array.prototype.__proto__ = {3: at3};
+Array.prototype.__proto__.__proto__ = {7: at7};
+
+var a = new Array(13)
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+
+assertEquals(undefined, a.shift(), 'hole should be returned as undefined')
+// Side-effects: Array.prototype[3] percolates into a[2] and Array.prototype[7[
+// into a[6], still visible at the corresponding indices.
+
+assertEquals(at3, a[2])
+assertTrue(a.hasOwnProperty(2))
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+
+assertEquals(at7, a[6])
+assertTrue(a.hasOwnProperty(6))
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+
+a.unshift('foo', 'bar')
+// Side-effects: Array.prototype[3] now percolates into a[5] and Array.prototype[7]
+// into a[9].
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+assertEquals(at3, a[4])
+assertTrue(a.hasOwnProperty(4))
+assertEquals(at3, a[5])
+assertTrue(a.hasOwnProperty(5))
+
+assertEquals(undefined, a[6])
+assertFalse(a.hasOwnProperty(6))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+assertEquals(at7, a[8])
+assertTrue(a.hasOwnProperty(8))
+assertEquals(at7, a[9])
+assertTrue(a.hasOwnProperty(9))
+
+var sliced = a.slice(3, 10)
+// Slice must keep intact a and reify holes at indices 0--2 and 4--6.
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+assertEquals(at3, a[4])
+assertTrue(a.hasOwnProperty(4))
+assertEquals(at3, a[5])
+assertTrue(a.hasOwnProperty(5))
+
+assertEquals(undefined, a[6])
+assertFalse(a.hasOwnProperty(6))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+assertEquals(at7, a[8])
+assertTrue(a.hasOwnProperty(8))
+assertEquals(at7, a[9])
+assertTrue(a.hasOwnProperty(9))
+
+assertEquals(at3, sliced[0])
+assertTrue(sliced.hasOwnProperty(0))
+assertEquals(at3, sliced[1])
+assertTrue(sliced.hasOwnProperty(1))
+assertEquals(at3, sliced[2])
+assertTrue(sliced.hasOwnProperty(2))
+
+// Note: sliced[3] comes directly from Array.prototype[3]
+assertEquals(at3, sliced[3]);
+assertFalse(sliced.hasOwnProperty(3))
+
+assertEquals(at7, sliced[4])
+assertTrue(sliced.hasOwnProperty(4))
+assertEquals(at7, sliced[5])
+assertTrue(sliced.hasOwnProperty(5))
+assertEquals(at7, sliced[6])
+assertTrue(sliced.hasOwnProperty(6))
+
+
+// Splice is too complicated the operation, start afresh.
+
+// Shrking array.
+var a0 = [0, 1, , , 4, 5, , , , 9]
+var result = a0.splice(4, 1)
+// Side-effects: everything before 4 is kept intact:
+
+assertEquals(0, a0[0])
+assertTrue(a0.hasOwnProperty(0))
+assertEquals(1, a0[1])
+assertTrue(a0.hasOwnProperty(1))
+assertEquals(undefined, a0[2])
+assertFalse(a0.hasOwnProperty(2))
+assertEquals(at3, a0[3])
+assertFalse(a0.hasOwnProperty(3))
+
+// 4 and above shifted left by one reifying at7 into a0[6] and keeping
+// a hole at a0[7]
+
+assertEquals(5, a0[4])
+assertTrue(a0.hasOwnProperty(4))
+assertEquals(undefined, a0[5])
+assertFalse(a0.hasOwnProperty(5))
+assertEquals(at7, a0[6])
+assertTrue(a0.hasOwnProperty(6))
+assertEquals(at7, a0[7])
+assertFalse(a0.hasOwnProperty(7))
+assertEquals(9, a0[8])
+assertTrue(a0.hasOwnProperty(8))
+
+// Growing array.
+var a1 = [0, 1, , , 4, 5, , , , 9]
+var result = a1.splice(4, 0, undefined)
+// Side-effects: everything before 4 is kept intact:
+
+assertEquals(0, a1[0])
+assertTrue(a1.hasOwnProperty(0))
+assertEquals(1, a1[1])
+assertTrue(a1.hasOwnProperty(1))
+assertEquals(undefined, a1[2])
+assertFalse(a1.hasOwnProperty(2))
+assertEquals(at3, a1[3])
+assertFalse(a1.hasOwnProperty(3))
+
+// Now owned undefined resides at 4 and rest is shifted right by one
+// reifying at7 into a0[8] and keeping a hole at a0[7].
+
+assertEquals(undefined, a1[4])
+assertTrue(a1.hasOwnProperty(4))
+assertEquals(4, a1[5])
+assertTrue(a1.hasOwnProperty(5))
+assertEquals(5, a1[6])
+assertTrue(a1.hasOwnProperty(6))
+assertEquals(at7, a1[7])
+assertFalse(a1.hasOwnProperty(7))
+assertEquals(at7, a1[8])
+assertTrue(a1.hasOwnProperty(8))
+assertEquals(undefined, a1[9])
+assertFalse(a1.hasOwnProperty(9))
+assertEquals(9, a1[10])
+assertTrue(a1.hasOwnProperty(10))
diff --git a/test/mjsunit/array-elements-from-array-prototype.js b/test/mjsunit/array-elements-from-array-prototype.js
new file mode 100644
index 0000000..b89cdfa
--- /dev/null
+++ b/test/mjsunit/array-elements-from-array-prototype.js
@@ -0,0 +1,191 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+////////////////////////////////////////////////////////////////////////
+// Tests below verify that elements set on Array.prototype propagate
+// for various Array.prototype functions (like unshift, shift, etc.)
+// If add any new tests here, consider adding them to all other files:
+//   array-elements-from-array-prototype.js
+//   array-elements-from-array-prototype-chain.js
+//   array-elements-from-object-prototype.js
+// those ideally should be identical modulo host of elements and
+// the way elements introduced.
+//
+// Note: they are put into a separate file as we need maximally clean
+// VM setup---some optimizations might be already turned off in
+// 'dirty' VM.
+////////////////////////////////////////////////////////////////////////
+
+var at3 = '@3'
+var at7 = '@7'
+
+Array.prototype[3] = at3
+Array.prototype[7] = at7
+
+var a = new Array(13)
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+
+assertEquals(undefined, a.shift(), 'hole should be returned as undefined')
+// Side-effects: Array.prototype[3] percolates into a[2] and Array.prototype[7[
+// into a[6], still visible at the corresponding indices.
+
+assertEquals(at3, a[2])
+assertTrue(a.hasOwnProperty(2))
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+
+assertEquals(at7, a[6])
+assertTrue(a.hasOwnProperty(6))
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+
+a.unshift('foo', 'bar')
+// Side-effects: Array.prototype[3] now percolates into a[5] and Array.prototype[7]
+// into a[9].
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+assertEquals(at3, a[4])
+assertTrue(a.hasOwnProperty(4))
+assertEquals(at3, a[5])
+assertTrue(a.hasOwnProperty(5))
+
+assertEquals(undefined, a[6])
+assertFalse(a.hasOwnProperty(6))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+assertEquals(at7, a[8])
+assertTrue(a.hasOwnProperty(8))
+assertEquals(at7, a[9])
+assertTrue(a.hasOwnProperty(9))
+
+var sliced = a.slice(3, 10)
+// Slice must keep intact a and reify holes at indices 0--2 and 4--6.
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+assertEquals(at3, a[4])
+assertTrue(a.hasOwnProperty(4))
+assertEquals(at3, a[5])
+assertTrue(a.hasOwnProperty(5))
+
+assertEquals(undefined, a[6])
+assertFalse(a.hasOwnProperty(6))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+assertEquals(at7, a[8])
+assertTrue(a.hasOwnProperty(8))
+assertEquals(at7, a[9])
+assertTrue(a.hasOwnProperty(9))
+
+assertEquals(at3, sliced[0])
+assertTrue(sliced.hasOwnProperty(0))
+assertEquals(at3, sliced[1])
+assertTrue(sliced.hasOwnProperty(1))
+assertEquals(at3, sliced[2])
+assertTrue(sliced.hasOwnProperty(2))
+
+// Note: sliced[3] comes directly from Array.prototype[3]
+assertEquals(at3, sliced[3]);
+assertFalse(sliced.hasOwnProperty(3))
+
+assertEquals(at7, sliced[4])
+assertTrue(sliced.hasOwnProperty(4))
+assertEquals(at7, sliced[5])
+assertTrue(sliced.hasOwnProperty(5))
+assertEquals(at7, sliced[6])
+assertTrue(sliced.hasOwnProperty(6))
+
+
+// Splice is too complicated the operation, start afresh.
+
+// Shrking array.
+var a0 = [0, 1, , , 4, 5, , , , 9]
+var result = a0.splice(4, 1)
+// Side-effects: everything before 4 is kept intact:
+
+assertEquals(0, a0[0])
+assertTrue(a0.hasOwnProperty(0))
+assertEquals(1, a0[1])
+assertTrue(a0.hasOwnProperty(1))
+assertEquals(undefined, a0[2])
+assertFalse(a0.hasOwnProperty(2))
+assertEquals(at3, a0[3])
+assertFalse(a0.hasOwnProperty(3))
+
+// 4 and above shifted left by one reifying at7 into a0[6] and keeping
+// a hole at a0[7]
+
+assertEquals(5, a0[4])
+assertTrue(a0.hasOwnProperty(4))
+assertEquals(undefined, a0[5])
+assertFalse(a0.hasOwnProperty(5))
+assertEquals(at7, a0[6])
+assertTrue(a0.hasOwnProperty(6))
+assertEquals(at7, a0[7])
+assertFalse(a0.hasOwnProperty(7))
+assertEquals(9, a0[8])
+assertTrue(a0.hasOwnProperty(8))
+
+// Growing array.
+var a1 = [0, 1, , , 4, 5, , , , 9]
+var result = a1.splice(4, 0, undefined)
+// Side-effects: everything before 4 is kept intact:
+
+assertEquals(0, a1[0])
+assertTrue(a1.hasOwnProperty(0))
+assertEquals(1, a1[1])
+assertTrue(a1.hasOwnProperty(1))
+assertEquals(undefined, a1[2])
+assertFalse(a1.hasOwnProperty(2))
+assertEquals(at3, a1[3])
+assertFalse(a1.hasOwnProperty(3))
+
+// Now owned undefined resides at 4 and rest is shifted right by one
+// reifying at7 into a0[8] and keeping a hole at a0[7].
+
+assertEquals(undefined, a1[4])
+assertTrue(a1.hasOwnProperty(4))
+assertEquals(4, a1[5])
+assertTrue(a1.hasOwnProperty(5))
+assertEquals(5, a1[6])
+assertTrue(a1.hasOwnProperty(6))
+assertEquals(at7, a1[7])
+assertFalse(a1.hasOwnProperty(7))
+assertEquals(at7, a1[8])
+assertTrue(a1.hasOwnProperty(8))
+assertEquals(undefined, a1[9])
+assertFalse(a1.hasOwnProperty(9))
+assertEquals(9, a1[10])
+assertTrue(a1.hasOwnProperty(10))
diff --git a/test/mjsunit/array-elements-from-object-prototype.js b/test/mjsunit/array-elements-from-object-prototype.js
new file mode 100644
index 0000000..a6ad0ee
--- /dev/null
+++ b/test/mjsunit/array-elements-from-object-prototype.js
@@ -0,0 +1,191 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+////////////////////////////////////////////////////////////////////////
+// Tests below verify that elements set on Object.prototype propagate
+// for various Array.prototype functions (like unshift, shift, etc.)
+// If add any new tests here, consider adding them to all other files:
+//   array-elements-from-array-prototype.js
+//   array-elements-from-array-prototype-chain.js
+//   array-elements-from-object-prototype.js
+// those ideally should be identical modulo host of elements and
+// the way elements introduced.
+//
+// Note: they are put into a separate file as we need maximally clean
+// VM setup---some optimizations might be already turned off in
+// 'dirty' VM.
+////////////////////////////////////////////////////////////////////////
+
+var at3 = '@3'
+var at7 = '@7'
+
+Object.prototype[3] = at3
+Object.prototype[7] = at7
+
+var a = new Array(13)
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+
+assertEquals(undefined, a.shift(), 'hole should be returned as undefined')
+// Side-effects: Array.prototype[3] percolates into a[2] and Array.prototype[7[
+// into a[6], still visible at the corresponding indices.
+
+assertEquals(at3, a[2])
+assertTrue(a.hasOwnProperty(2))
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+
+assertEquals(at7, a[6])
+assertTrue(a.hasOwnProperty(6))
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+
+a.unshift('foo', 'bar')
+// Side-effects: Array.prototype[3] now percolates into a[5] and Array.prototype[7]
+// into a[9].
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+assertEquals(at3, a[4])
+assertTrue(a.hasOwnProperty(4))
+assertEquals(at3, a[5])
+assertTrue(a.hasOwnProperty(5))
+
+assertEquals(undefined, a[6])
+assertFalse(a.hasOwnProperty(6))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+assertEquals(at7, a[8])
+assertTrue(a.hasOwnProperty(8))
+assertEquals(at7, a[9])
+assertTrue(a.hasOwnProperty(9))
+
+var sliced = a.slice(3, 10)
+// Slice must keep intact a and reify holes at indices 0--2 and 4--6.
+
+assertEquals(at3, a[3])
+assertFalse(a.hasOwnProperty(3))
+assertEquals(at3, a[4])
+assertTrue(a.hasOwnProperty(4))
+assertEquals(at3, a[5])
+assertTrue(a.hasOwnProperty(5))
+
+assertEquals(undefined, a[6])
+assertFalse(a.hasOwnProperty(6))
+
+assertEquals(at7, a[7])
+assertFalse(a.hasOwnProperty(7))
+assertEquals(at7, a[8])
+assertTrue(a.hasOwnProperty(8))
+assertEquals(at7, a[9])
+assertTrue(a.hasOwnProperty(9))
+
+assertEquals(at3, sliced[0])
+assertTrue(sliced.hasOwnProperty(0))
+assertEquals(at3, sliced[1])
+assertTrue(sliced.hasOwnProperty(1))
+assertEquals(at3, sliced[2])
+assertTrue(sliced.hasOwnProperty(2))
+
+// Note: sliced[3] comes directly from Array.prototype[3]
+assertEquals(at3, sliced[3]);
+assertFalse(sliced.hasOwnProperty(3))
+
+assertEquals(at7, sliced[4])
+assertTrue(sliced.hasOwnProperty(4))
+assertEquals(at7, sliced[5])
+assertTrue(sliced.hasOwnProperty(5))
+assertEquals(at7, sliced[6])
+assertTrue(sliced.hasOwnProperty(6))
+
+
+// Splice is too complicated the operation, start afresh.
+
+// Shrking array.
+var a0 = [0, 1, , , 4, 5, , , , 9]
+var result = a0.splice(4, 1)
+// Side-effects: everything before 4 is kept intact:
+
+assertEquals(0, a0[0])
+assertTrue(a0.hasOwnProperty(0))
+assertEquals(1, a0[1])
+assertTrue(a0.hasOwnProperty(1))
+assertEquals(undefined, a0[2])
+assertFalse(a0.hasOwnProperty(2))
+assertEquals(at3, a0[3])
+assertFalse(a0.hasOwnProperty(3))
+
+// 4 and above shifted left by one reifying at7 into a0[6] and keeping
+// a hole at a0[7]
+
+assertEquals(5, a0[4])
+assertTrue(a0.hasOwnProperty(4))
+assertEquals(undefined, a0[5])
+assertFalse(a0.hasOwnProperty(5))
+assertEquals(at7, a0[6])
+assertTrue(a0.hasOwnProperty(6))
+assertEquals(at7, a0[7])
+assertFalse(a0.hasOwnProperty(7))
+assertEquals(9, a0[8])
+assertTrue(a0.hasOwnProperty(8))
+
+// Growing array.
+var a1 = [0, 1, , , 4, 5, , , , 9]
+var result = a1.splice(4, 0, undefined)
+// Side-effects: everything before 4 is kept intact:
+
+assertEquals(0, a1[0])
+assertTrue(a1.hasOwnProperty(0))
+assertEquals(1, a1[1])
+assertTrue(a1.hasOwnProperty(1))
+assertEquals(undefined, a1[2])
+assertFalse(a1.hasOwnProperty(2))
+assertEquals(at3, a1[3])
+assertFalse(a1.hasOwnProperty(3))
+
+// Now owned undefined resides at 4 and rest is shifted right by one
+// reifying at7 into a0[8] and keeping a hole at a0[7].
+
+assertEquals(undefined, a1[4])
+assertTrue(a1.hasOwnProperty(4))
+assertEquals(4, a1[5])
+assertTrue(a1.hasOwnProperty(5))
+assertEquals(5, a1[6])
+assertTrue(a1.hasOwnProperty(6))
+assertEquals(at7, a1[7])
+assertFalse(a1.hasOwnProperty(7))
+assertEquals(at7, a1[8])
+assertTrue(a1.hasOwnProperty(8))
+assertEquals(undefined, a1[9])
+assertFalse(a1.hasOwnProperty(9))
+assertEquals(9, a1[10])
+assertTrue(a1.hasOwnProperty(10))
diff --git a/test/mjsunit/array-length.js b/test/mjsunit/array-length.js
index 9731e7a..967d720 100644
--- a/test/mjsunit/array-length.js
+++ b/test/mjsunit/array-length.js
@@ -26,7 +26,7 @@
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
 var a = [0,1,2,3];
-a.length = 0;
+assertEquals(0, a.length = 0);
 
 assertEquals('undefined', typeof a[0]);
 assertEquals('undefined', typeof a[1]);
@@ -35,7 +35,7 @@
 
 
 var a = [0,1,2,3];
-a.length = 2;
+assertEquals(2, a.length = 2);
 
 assertEquals(0, a[0]);
 assertEquals(1, a[1]);
@@ -50,7 +50,7 @@
 a[2000000] = 2000000;
 
 assertEquals(2000001, a.length);
-a.length = 0;
+assertEquals(0, a.length = 0);
 assertEquals(0, a.length);
 assertEquals('undefined', typeof a[0]);
 assertEquals('undefined', typeof a[1000]);
@@ -65,7 +65,7 @@
 a[2000000] = 2000000;
 
 assertEquals(2000001, a.length);
-a.length = 2000;
+assertEquals(2000, a.length = 2000);
 assertEquals(2000, a.length);
 assertEquals(0, a[0]);
 assertEquals(1000, a[1000]);
@@ -91,7 +91,7 @@
 assertEquals(Math.pow(2,32)-2, a[Math.pow(2,32)-2]);
 
 assertEquals(Math.pow(2,32)-1, a.length);
-a.length = Math.pow(2,30)+1;  // not a smi!
+assertEquals(Math.pow(2,30) + 1, a.length = Math.pow(2,30)+1);  // not a smi!
 assertEquals(Math.pow(2,30)+1, a.length);
 
 assertEquals(0, a[0]);
@@ -102,10 +102,20 @@
 
 
 var a = new Array();
-a.length = new Number(12);
+assertEquals(12, a.length = new Number(12));
 assertEquals(12, a.length);
 
 
 var o = { length: -23 };
 Array.prototype.pop.apply(o);
 assertEquals(4294967272, o.length);
+
+// Check case of compiled stubs.
+var a = [];
+for (var i = 0; i < 7; i++) {
+  assertEquals(3, a.length = 3);
+
+  var t = 239;
+  t = a.length = 7;
+  assertEquals(7, t);
+}
diff --git a/test/mjsunit/array-pop.js b/test/mjsunit/array-pop.js
new file mode 100644
index 0000000..a8d131e
--- /dev/null
+++ b/test/mjsunit/array-pop.js
@@ -0,0 +1,95 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check pops with various number of arguments.
+(function() {
+  var a = [];
+  for (var i = 0; i < 7; i++) {
+    a = [7, 6, 5, 4, 3, 2, 1];
+
+    assertEquals(1, a.pop(), "1st pop");
+    assertEquals(6, a.length, "length 1st pop");
+
+    assertEquals(2, a.pop(1), "2nd pop");
+    assertEquals(5, a.length, "length 2nd pop");
+
+    assertEquals(3, a.pop(1, 2), "3rd pop");
+    assertEquals(4, a.length, "length 3rd pop");
+
+    assertEquals(4, a.pop(1, 2, 3), "4th pop");
+    assertEquals(3, a.length, "length 4th pop");
+
+    assertEquals(5, a.pop(), "5th pop");
+    assertEquals(2, a.length, "length 5th pop");
+
+    assertEquals(6, a.pop(), "6th pop");
+    assertEquals(1, a.length, "length 6th pop");
+
+    assertEquals(7, a.pop(), "7th pop");
+    assertEquals(0, a.length, "length 7th pop");
+
+    assertEquals(undefined, a.pop(), "8th pop");
+    assertEquals(0, a.length, "length 8th pop");
+
+    assertEquals(undefined, a.pop(1, 2, 3), "9th pop");
+    assertEquals(0, a.length, "length 9th pop");
+  }
+
+  // Check that pop works on inherited properties.
+  for (var i = 0; i < 10 ;i++) {  // Ensure ICs are stabilized.
+    Array.prototype[1] = 1;
+    Array.prototype[3] = 3;
+    Array.prototype[5] = 5;
+    Array.prototype[7] = 7;
+    Array.prototype[9] = 9;
+    a = [0,1,2,,4,,6,7,8,,];
+    assertEquals(10, a.length, "inherit-initial-length");
+    for (var j = 9; j >= 0; j--) {
+      assertEquals(j + 1, a.length, "inherit-pre-length-" + j);
+      assertTrue(j in a, "has property " + j);
+      var own = a.hasOwnProperty(j);
+      var inherited = Array.prototype.hasOwnProperty(j);
+      assertEquals(j, a.pop(), "inherit-pop");
+      assertEquals(j, a.length, "inherit-post-length");
+      assertFalse(a.hasOwnProperty(j), "inherit-deleted-own-" + j);
+      assertEquals(inherited, Array.prototype.hasOwnProperty(j),
+                   "inherit-not-deleted-inherited" + j);
+    }
+    Array.prototype.length = 0;  // Clean-up.
+  }
+})();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+  var a = [];
+  for (var i = 0; i < 100; i++) a.push(i);
+  var x = {__proto__: a};
+  for (var i = 0; i < 100; i++) {
+    assertEquals(99 - i, x.pop(), i + 'th iteration');
+  }
+})();
diff --git a/test/mjsunit/array-push.js b/test/mjsunit/array-push.js
new file mode 100644
index 0000000..2a25a9c
--- /dev/null
+++ b/test/mjsunit/array-push.js
@@ -0,0 +1,115 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check pushes with various number of arguments.
+(function() {
+  var a = [];
+  for (var i = 0; i < 7; i++) {
+    a = [];
+
+    assertEquals(0, a.push());
+    assertEquals([], a, "after .push()");
+
+    assertEquals(1, a.push(1), "length after .push(1)");
+    assertEquals([1], a, "after .push(1)");
+
+    assertEquals(3, a.push(2, 3), "length after .push(2, 3)");
+    assertEquals([1, 2, 3], a, "after .push(2, 3)");
+
+    assertEquals(6, a.push(4, 5, 6),
+      "length after .push(4, 5, 6)");
+    assertEquals([1, 2, 3, 4, 5, 6], a,
+      "after .push(4, 5, 5)");
+
+    assertEquals(10, a.push(7, 8, 9, 10),
+      "length after .push(7, 8, 9, 10)");
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10], a,
+      "after .push(7, 8, 9, 10)");
+
+    assertEquals(15, a.push(11, 12, 13, 14, 15),
+      "length after .push(11, 12, 13, 14, 15)");
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15], a,
+      "after .push(11, 12, 13, 14, 15)");
+
+    assertEquals(21, a.push(16, 17, 18, 19, 20, 21),
+      "length after .push(16, 17, 18, 19, 20, 21)");
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21], a,
+      "after .push(16, 17, 18, 19, 20, 21)");
+
+    assertEquals(28, a.push(22, 23, 24, 25, 26, 27, 28),
+      "length hafter .push(22, 23, 24, 25, 26, 27, 28)");
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12, 13, 14, 15, 16, 17, 18, 19, 20, 21, 22, 23, 24, 25, 26, 27, 28], a,
+      "after .push(22, 23, 24, 25, 26, 27, 28)");
+  }
+})();
+
+// Excerises various pushes to the array at the end of new space.
+(function() {
+  var a = undefined;
+  for (var i = 0; i < 7; i++) {
+    a = [];
+    assertEquals(1, a.push(1));
+    assertEquals(2, a.push(2));
+    assertEquals(3, a.push(3));
+    assertEquals(4, a.push(4));
+    assertEquals(5, a.push(5));
+    assertEquals(6, a.push(6));
+    assertEquals(7, a.push(7));
+    assertEquals(8, a.push(8));
+    assertEquals(9, a.push(9));
+    assertEquals(10, a.push(10));
+    assertEquals(11, a.push(11));
+    assertEquals(12, a.push(12));
+    assertEquals(13, a.push(13));
+    assertEquals(14, a.push(14));
+    assertEquals(15, a.push(15));
+    assertEquals(16, a.push(16));
+    assertEquals(17, a.push(17));
+    assertEquals(18, a.push(18));
+    assertEquals(19, a.push(19));
+    assertEquals(20, a.push(20));
+    assertEquals(21, a.push(21));
+    assertEquals(22, a.push(22));
+    assertEquals(23, a.push(23));
+    assertEquals(24, a.push(24));
+    assertEquals(25, a.push(25));
+    assertEquals(26, a.push(26));
+    assertEquals(27, a.push(27));
+    assertEquals(28, a.push(28));
+    assertEquals(29, a.push(29));
+  }
+})();
+
+// Test the case of not JSArray receiver.
+// Regression test for custom call generators, see issue 684.
+(function() {
+  var x = {__proto__: []};
+  for (var i = 0; i < 100; i++) {
+    x.push("a");
+    assertEquals(i + 1, x.length, i + 'th iteration');
+  }
+})();
diff --git a/test/mjsunit/array-slice.js b/test/mjsunit/array-slice.js
index c993a07..30e9f3e 100644
--- a/test/mjsunit/array-slice.js
+++ b/test/mjsunit/array-slice.js
@@ -36,6 +36,17 @@
 })();
 
 
+// Check various variants of empty array's slicing.
+(function() {
+  for (var i = 0; i < 7; i++) {
+    assertEquals([], [].slice(0, 0));
+    assertEquals([], [].slice(1, 0));
+    assertEquals([], [].slice(0, 1));
+    assertEquals([], [].slice(-1, 0));
+  }
+})();
+
+
 // Check various forms of arguments omission.
 (function() {
   var array = new Array(7);
diff --git a/test/mjsunit/array-splice.js b/test/mjsunit/array-splice.js
index 18f81fe..887097d 100644
--- a/test/mjsunit/array-splice.js
+++ b/test/mjsunit/array-splice.js
@@ -31,13 +31,34 @@
     var array = new Array(10);
     var spliced = array.splice(1, 1, 'one', 'two');
     assertEquals(1, spliced.length);
-    assertFalse(0 in spliced);
+    assertFalse(0 in spliced, "0 in spliced");
 
     assertEquals(11, array.length);
-    assertFalse(0 in array);
+    assertFalse(0 in array, "0 in array");
     assertTrue(1 in array);
     assertTrue(2 in array);
-    assertFalse(3 in array);
+    assertFalse(3 in array, "3 in array");
+  }
+})();
+
+
+// Check various variants of empty array's splicing.
+(function() {
+  for (var i = 0; i < 7; i++) {
+    assertEquals([], [].splice(0, 0));
+    assertEquals([], [].splice(1, 0));
+    assertEquals([], [].splice(0, 1));
+    assertEquals([], [].splice(-1, 0));
+  }
+})();
+
+
+// Check that even if result array is empty, receiver gets sliced.
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var a = [1, 2, 3];
+    assertEquals([], a.splice(1, 0, 'a', 'b', 'c'));
+    assertEquals([1, 'a', 'b', 'c', 2, 3], a);
   }
 })();
 
@@ -249,23 +270,23 @@
     assertEquals(undefined, array[7]);
 
     // and now check hasOwnProperty
-    assertFalse(array.hasOwnProperty(0));
-    assertFalse(array.hasOwnProperty(1));
+    assertFalse(array.hasOwnProperty(0), "array.hasOwnProperty(0)");
+    assertFalse(array.hasOwnProperty(1), "array.hasOwnProperty(1)");
     assertTrue(array.hasOwnProperty(2));
     assertTrue(array.hasOwnProperty(3));
     assertTrue(array.hasOwnProperty(4));
-    assertFalse(array.hasOwnProperty(5));
-    assertFalse(array.hasOwnProperty(6));
-    assertFalse(array.hasOwnProperty(7));
+    assertFalse(array.hasOwnProperty(5), "array.hasOwnProperty(5)");
+    assertFalse(array.hasOwnProperty(6), "array.hasOwnProperty(6)");
+    assertFalse(array.hasOwnProperty(7), "array.hasOwnProperty(7)");
     assertTrue(array.hasOwnProperty(8));
-    assertFalse(array.hasOwnProperty(9));
+    assertFalse(array.hasOwnProperty(9), "array.hasOwnProperty(9)");
 
     // and now check couple of indices above length.
-    assertFalse(array.hasOwnProperty(10));
-    assertFalse(array.hasOwnProperty(15));
-    assertFalse(array.hasOwnProperty(31));
-    assertFalse(array.hasOwnProperty(63));
-    assertFalse(array.hasOwnProperty(2 << 32 - 1));
+    assertFalse(array.hasOwnProperty(10), "array.hasOwnProperty(10)");
+    assertFalse(array.hasOwnProperty(15), "array.hasOwnProperty(15)");
+    assertFalse(array.hasOwnProperty(31), "array.hasOwnProperty(31)");
+    assertFalse(array.hasOwnProperty(63), "array.hasOwnProperty(63)");
+    assertFalse(array.hasOwnProperty(2 << 32 - 1), "array.hasOwnProperty(2 << 31 - 1)");
   }
 })();
 
@@ -287,3 +308,13 @@
     assertEquals(bigNum + 7, array.length);
   }
 })();
+
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var a = [7, 8, 9];
+    a.splice(0, 0, 1, 2, 3, 4, 5, 6);
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
+    assertFalse(a.hasOwnProperty(10), "a.hasOwnProperty(10)");
+    assertEquals(undefined, a[10]);
+  }
+})();
diff --git a/test/mjsunit/array-unshift.js b/test/mjsunit/array-unshift.js
index 06a78a7..dbe245b 100644
--- a/test/mjsunit/array-unshift.js
+++ b/test/mjsunit/array-unshift.js
@@ -130,3 +130,11 @@
     assertEquals(bigNum + 7, new Array(bigNum).unshift(1, 2, 3, 4, 5, 6, 7));
   }
 })();
+
+(function() {
+  for (var i = 0; i < 7; i++) {
+    var a = [6, 7, 8, 9];
+    a.unshift(1, 2, 3, 4, 5);
+    assertEquals([1, 2, 3, 4, 5, 6, 7, 8, 9], a);
+  }
+})();
diff --git a/test/mjsunit/binary-op-newspace.js b/test/mjsunit/binary-op-newspace.js
new file mode 100644
index 0000000..8034209
--- /dev/null
+++ b/test/mjsunit/binary-op-newspace.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+/**
+ * @fileoverview Check that a mod where the stub code hits a failure
+ * in heap number allocation still works.
+ */
+
+// Flags: --max-new-space-size=262144
+
+function f(x) {
+  return x % 3;
+}
+
+function test() {
+  for (var i = 0; i < 40000; i++) {
+    assertEquals(-1 / 0, 1 / f(-3));
+  }
+}
+
+test();
diff --git a/test/mjsunit/bugs/bug-618.js b/test/mjsunit/bugs/bug-618.js
new file mode 100644
index 0000000..8f47440
--- /dev/null
+++ b/test/mjsunit/bugs/bug-618.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// When this bug is corrected move to object-define-property and add
+// additional tests for configurable in the same manner as existing tests
+// there.
+
+function C() {
+  this.x = 23;
+}
+
+// If a setter is added to the prototype chain of a simple constructor setting 
+// one of the properties assigned in the constructor then this setter is 
+// ignored when constructing new objects from the constructor.
+
+// This only happens if the setter is added _after_ an instance has been 
+// created.
+
+assertEquals(23, new C().x);
+C.prototype.__defineSetter__('x', function(value) { this.y = 23; });
+assertEquals(void 0, new C().x));
diff --git a/test/mjsunit/codegen-coverage.js b/test/mjsunit/codegen-coverage.js
index 42c371b..8e7f189 100644
--- a/test/mjsunit/codegen-coverage.js
+++ b/test/mjsunit/codegen-coverage.js
@@ -33,6 +33,13 @@
   return x;
 }
 
+function lookup(w, a) {
+  // This function tests a code path in the generation of a keyed load IC
+  // where the key and the value are both in the same register.
+  a = a;
+  w[a] = a;
+}
+
 function cover_codegen_paths() {
   var x = 1;
 
@@ -131,6 +138,12 @@
     assertEquals(1073741824, 1 - di);
 
     x = 3;
+    var w = { };
+    lookup(w, x);
+    lookup(w, x);
+    lookup(w, x);
+
+    x = 3;  // Terminate while loop.
   }
 }
 
diff --git a/test/mjsunit/compiler/loopcount.js b/test/mjsunit/compiler/loopcount.js
new file mode 100644
index 0000000..6d6918f
--- /dev/null
+++ b/test/mjsunit/compiler/loopcount.js
@@ -0,0 +1,92 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test postfix count operations with smis.
+
+function f1() { var x = 0x3fffffff; x++; return x; }
+assertEquals(0x40000000, f1());
+
+
+function f2() { var x = -0x40000000; x--; return x; }
+assertEquals(-0x40000001, f2());
+
+
+function f3(x) { x = x & 0x3fffffff; x++; return x; }
+assertEquals(0x40000000, f3(0x3fffffff));
+
+
+function f4() {
+  var i;
+  for (i = 0x3ffffffe; i <= 0x3fffffff; i++) {}
+  return i;
+}
+assertEquals(0x40000000, f4());
+
+
+function f5() {
+  var i;
+  for (i = -0x3fffffff; i >= -0x40000000; i--) {}
+  return i;
+}
+assertEquals(-0x40000001, f5());
+
+
+function f6() { var x = 0x3fffffff; x++; return x+1; }
+assertEquals(0x40000001, f6());
+
+
+function f7() {
+  var i;
+  for (i = 0x3ffffffd; i <= 0x3ffffffe; i++) {}
+  i++; i = i + 1;
+  return i;
+}
+assertEquals(0x40000001, f7());
+
+
+function f8() {
+  var i;
+  for (i = 0x3ffffffd; i <= 0x3fffffff; i++) {}
+  i++; i++;
+  return i;
+}
+assertEquals(0x40000002, f8());
+
+
+function f9() {
+  var i;
+  for (i = 0; i < 42; i++) {
+    return 42;
+  }
+}
+assertEquals(42, f9());
+
+
+function f10(x) {
+  for (x = 0; x < 4; x++) {}
+}
+f10(42);
diff --git a/test/mjsunit/date-parse.js b/test/mjsunit/date-parse.js
index 4bbb2c6..23a6993 100644
--- a/test/mjsunit/date-parse.js
+++ b/test/mjsunit/date-parse.js
@@ -205,7 +205,6 @@
     'Saturday, 01-Jan-00 01:00:00 PDT',
     '01 Jan 00 01:00 -0700'];
 
-
 // Local time cases.
 var testCasesLocalTime = [
     // Allow timezone ommision.
@@ -233,6 +232,27 @@
     ['Saturday, 01-Jan-00 08:00 PM UT', 946756800000],
     ['01 Jan 00 08:00 PM +0000', 946756800000]];
 
+// Test different version of the ES5 date time string format.
+var testCasesES5Misc = [
+    ['2000-01-01T08:00:00.000Z', 946713600000],
+    ['2000-01-01T08:00:00Z', 946713600000],
+    ['2000-01-01T08:00Z', 946713600000],
+    ['2000-01T08:00:00.000Z', 946713600000],
+    ['2000T08:00:00.000Z', 946713600000],
+    ['2000T08:00Z', 946713600000],
+    ['2000-01T00:00:00.000-08:00', 946713600000],
+    ['2000-01T08:00:00.001Z', 946713600001],
+    ['2000-01T08:00:00.099Z', 946713600099],
+    ['2000-01T08:00:00.999Z', 946713600999],
+    ['2000-01T00:00:00.001-08:00', 946713600001]];
+
+var testCasesES5MiscNegative = [
+    '2000-01-01TZ',
+    '2000-01-01T60Z',
+    '2000-01-01T60:60Z',
+    '2000-01-0108:00Z',
+    '2000-01-01T08Z'];
+
 
 // Run all the tests.
 testCasesUT.forEach(testDateParse);
@@ -248,6 +268,12 @@
 testCasesLocalTime.forEach(testDateParseLocalTime);
 testCasesMisc.forEach(testDateParseMisc);
 
+// ES5 date time string format compliance.
+testCasesES5Misc.forEach(testDateParseMisc);
+testCasesES5MiscNegative.forEach(function (s) {
+    assertTrue(isNaN(Date.parse(s)), s + " is not NaN.");
+});
+
 
 // Test that we can parse our own date format.
 // (Dates from 1970 to ~2070 with 150h steps.)
diff --git a/test/mjsunit/date.js b/test/mjsunit/date.js
index 8c53910..b264a19 100644
--- a/test/mjsunit/date.js
+++ b/test/mjsunit/date.js
@@ -46,12 +46,18 @@
 
 var dMax = new Date(8.64e15);
 assertEquals(8.64e15, dMax.getTime());
+assertEquals(275760, dMax.getFullYear());
+assertEquals(8, dMax.getMonth());
+assertEquals(13, dMax.getUTCDate());
 
 var dOverflow = new Date(8.64e15+1);
 assertTrue(isNaN(dOverflow.getTime()));
 
 var dMin = new Date(-8.64e15);
 assertEquals(-8.64e15, dMin.getTime());
+assertEquals(-271821, dMin.getFullYear());
+assertEquals(3, dMin.getMonth());
+assertEquals(20, dMin.getUTCDate());
 
 var dUnderflow = new Date(-8.64e15-1);
 assertTrue(isNaN(dUnderflow.getTime()));
@@ -147,3 +153,17 @@
 }
 
 testToLocaleTimeString();
+
+
+// Modified test from WebKit
+// LayoutTests/fast/js/script-tests/date-utc-timeclip.js:
+
+assertEquals(Date.UTC(275760, 8, 12, 23, 59, 59, 999), 8639999999999999);
+assertEquals(Date.UTC(275760, 8, 13), 8640000000000000);
+assertTrue(isNaN(Date.UTC(275760, 8, 13, 0, 0, 0, 1)));
+assertTrue(isNaN(Date.UTC(275760, 8, 14)));
+
+assertEquals(Date.UTC(-271821, 3, 20, 0, 0, 0, 1), -8639999999999999);
+assertEquals(Date.UTC(-271821, 3, 20), -8640000000000000);
+assertTrue(isNaN(Date.UTC(-271821, 3, 19, 23, 59, 59, 999)));
+assertTrue(isNaN(Date.UTC(-271821, 3, 19)));
diff --git a/test/mjsunit/debug-liveedit-1.js b/test/mjsunit/debug-liveedit-1.js
new file mode 100644
index 0000000..1ee7ce2
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-1.js
@@ -0,0 +1,48 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+Debug = debug.Debug
+
+eval("var something1 = 25; "
+     + " function ChooseAnimal() { return          'Cat';          } "
+     + " ChooseAnimal.Helper = function() { return 'Help!'; }");
+
+assertEquals("Cat", ChooseAnimal());
+
+var script = Debug.findScript(ChooseAnimal);
+
+var orig_animal = "Cat";
+var patch_pos = script.source.indexOf(orig_animal);
+var new_animal_patch = "Cap' + 'y' + 'bara";
+
+var change_log = new Array();
+Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
+
+assertEquals("Capybara", ChooseAnimal());
diff --git a/test/mjsunit/debug-liveedit-2.js b/test/mjsunit/debug-liveedit-2.js
new file mode 100644
index 0000000..94e2780
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-2.js
@@ -0,0 +1,70 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+
+Debug = debug.Debug
+
+
+eval(
+    "function ChooseAnimal(p) {\n " +
+    "  if (p == 7) {\n" + // Use p
+    "    return;\n" +
+    "  }\n" +
+    "  return function Chooser() {\n" +
+    "    return 'Cat';\n" +
+    "  };\n" +
+    "}\n"
+);
+
+var old_closure = ChooseAnimal(19);
+
+assertEquals("Cat", old_closure());
+
+var script = Debug.findScript(ChooseAnimal);
+
+var orig_animal = "'Cat'";
+var patch_pos = script.source.indexOf(orig_animal);
+var new_animal_patch = "'Capybara' + p";
+
+// We patch innermost function "Chooser".
+// However, this does not actually patch existing "Chooser" instances,
+// because old value of parameter "p" was not saved.
+// Instead it patches ChooseAnimal.
+var change_log = new Array();
+Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
+print("Change log: " + JSON.stringify(change_log) + "\n");
+
+var new_closure = ChooseAnimal(19);
+// New instance of closure is patched.
+assertEquals("Capybara19", new_closure());
+
+// Old instance of closure is not patched.
+assertEquals("Cat", old_closure());
+
diff --git a/test/mjsunit/debug-liveedit-3.js b/test/mjsunit/debug-liveedit-3.js
new file mode 100644
index 0000000..b68e38d
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-3.js
@@ -0,0 +1,69 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+// In this test case we edit a script so that techincally function text
+// hasen't been changed. However actually function became one level more nested
+// and must be recompiled because it uses variable from outer scope.
+
+
+Debug = debug.Debug
+
+var function_z_text =
+"  function Z() {\n"
++ "    return 2 + p;\n"
++ "  }\n";
+
+eval(
+"function Factory(p) {\n"
++ "return (\n"
++ function_z_text
++ ");\n"
++ "}\n"
+);
+
+var z6 = Factory(6);
+assertEquals(8, z6());
+
+var script = Debug.findScript(Factory);
+
+var new_source = script.source.replace(function_z_text, "function Intermediate() {\nreturn (\n" + function_z_text + ")\n;\n}\n");
+print("new source: " + new_source);
+
+var change_log = new Array();
+Debug.LiveEdit.SetScriptSource(script, new_source, change_log);
+print("Change log: " + JSON.stringify(change_log) + "\n");
+
+assertEquals(8, z6());
+
+var z100 = Factory(100)();
+
+assertEquals(102, z100());
+
+
diff --git a/test/mjsunit/debug-liveedit-breakpoints.js b/test/mjsunit/debug-liveedit-breakpoints.js
new file mode 100644
index 0000000..5c61cf4
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-breakpoints.js
@@ -0,0 +1,97 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+Debug = debug.Debug
+
+var function_z_text =
+"  function Z() {\n"
++ "    return 'Z';\n" // Breakpoint line ( #6 )
++ "  }\n";
+
+eval(
+"function F25() {\n"
++ "  return 25;\n" // Breakpoint line ( #1 )
++ "}\n"
++ "function F26 () {\n"
++ "  var x = 20;\n"
++ function_z_text // function takes exactly 3 lines
+//                 // Breakpoint line ( #6 )
+//
++ "  var y = 6;\n"
++ "  return x + y;\n"
++ "}\n"
++ "function Nested() {\n"
++ "  var a = 30;\n"
++ "  return function F27() {\n"
++ "    var b = 3;\n" // Breakpoint line ( #14 )
++ "    return a - b;\n"
++ "  }\n"
++ "}\n"
+);
+
+
+assertEquals(25, F25());
+assertEquals(26, F26());
+
+var script = Debug.findScript(F25);
+
+Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId, script.id, 1, 1, "true || false || false");
+Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId, script.id, 6, 1, "true || false || false");
+Debug.setScriptBreakPoint(Debug.ScriptBreakPointType.ScriptId, script.id, 14, 1, "true || false || false");
+
+assertEquals(3, Debug.scriptBreakPoints().length);
+
+var new_source = script.source.replace(function_z_text, "");
+print("new source: " + new_source);
+
+var change_log = new Array();
+Debug.LiveEdit.SetScriptSource(script, new_source, change_log);
+print("Change log: " + JSON.stringify(change_log) + "\n");
+
+var breaks = Debug.scriptBreakPoints();
+
+// One breakpoint gets duplicated in a old version of script.
+assertTrue(breaks.length > 3 + 1);
+
+var breakpoints_in_script = 0;
+var break_position_map = {};
+for (var i = 0; i < breaks.length; i++) {
+  if (breaks[i].script_id() == script.id) {
+    break_position_map[breaks[i].line()] = true;
+    breakpoints_in_script++;
+  }
+}
+
+assertEquals(3, breakpoints_in_script);
+
+// Check 2 breakpoints. The one in deleted function should have been moved somewhere.
+assertTrue(break_position_map[1]);
+assertTrue(break_position_map[11]);
+
diff --git a/test/mjsunit/debug-liveedit-check-stack.js b/test/mjsunit/debug-liveedit-check-stack.js
new file mode 100644
index 0000000..df9e1cf
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-check-stack.js
@@ -0,0 +1,141 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+Debug = debug.Debug
+
+unique_id = 1;
+
+function TestBase(name) {
+  print("TestBase constructor: " + name);
+
+  this.ChooseAnimal = eval(
+      "/* " + unique_id + "*/\n" +
+      "(function ChooseAnimal(callback) {\n " +
+      "  callback();\n" +
+      "  return 'Cat';\n" +
+      "})\n"
+  );
+  // Prevents eval script caching.
+  unique_id++;
+
+  var script = Debug.findScript(this.ChooseAnimal);
+
+  var orig_animal = "'Cat'";
+  var patch_pos = script.source.indexOf(orig_animal);
+  var new_animal_patch = "'Capybara'";
+
+  var got_exception = false;
+  var successfully_changed = false;
+
+  // Should be called from Debug context.
+  this.ScriptChanger = function() {
+    assertEquals(false, successfully_changed, "applying patch second time");
+    // Runs in debugger context.
+    var change_log = new Array();
+    try {
+      Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
+    } finally {
+      print("Change log: " + JSON.stringify(change_log) + "\n");
+    }
+    successfully_changed = true;
+  };
+}
+
+function Noop() {}
+
+function WrapInCatcher(f, holder) {
+  return function() {
+    delete holder[0];
+    try {
+      f();
+    } catch (e) {
+      if (e instanceof Debug.LiveEdit.Failure) {
+        holder[0] = e;
+      } else {
+        throw e;
+      }
+    }
+  };
+}
+
+function WrapInNativeCall(f) {
+  return function() {
+    return Debug.ExecuteInDebugContext(f, true);
+  };
+}
+
+function WrapInDebuggerCall(f) {
+  return function() {
+    return Debug.ExecuteInDebugContext(f, false);
+  };
+}
+
+function WrapInRestartProof(f) {
+  var already_called = false;
+  return function() {
+    if (already_called) {
+      return;
+    }
+    already_called = true;
+    f();
+  }
+}
+
+function WrapInConstructor(f) {
+  return function() {
+    return new function() {
+      f();
+    };
+  }
+}
+
+
+// A series of tests. In each test we call ChooseAnimal function that calls
+// a callback that attempts to modify the function on the fly.
+
+test = new TestBase("First test ChooseAnimal without edit");
+assertEquals("Cat", test.ChooseAnimal(Noop));
+
+test = new TestBase("Test without function on stack");
+test.ScriptChanger();
+assertEquals("Capybara", test.ChooseAnimal(Noop));
+
+test = new TestBase("Test with function on stack");
+assertEquals("Capybara", test.ChooseAnimal(WrapInDebuggerCall(WrapInRestartProof(test.ScriptChanger))));
+
+
+test = new TestBase("Test with function on stack and with constructor frame");
+assertEquals("Capybara", test.ChooseAnimal(WrapInConstructor(WrapInDebuggerCall(WrapInRestartProof(test.ScriptChanger)))));
+
+test = new TestBase("Test with C++ frame above ChooseAnimal frame");
+exception_holder = {};
+assertEquals("Cat", test.ChooseAnimal(WrapInNativeCall(WrapInDebuggerCall(WrapInCatcher(test.ScriptChanger, exception_holder)))));
+assertTrue(!!exception_holder[0]);
+
diff --git a/test/mjsunit/debug-liveedit-diff.js b/test/mjsunit/debug-liveedit-diff.js
new file mode 100644
index 0000000..7edf704
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-diff.js
@@ -0,0 +1,100 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+Debug = debug.Debug
+
+function CheckCompareOneWay(s1, s2) {
+  var diff_array = Debug.LiveEdit.TestApi.CompareStringsLinewise(s1, s2);
+
+  var pos1 = 0;
+  var pos2 = 0;
+  print("Compare:");
+  for (var i = 0; i < diff_array.length; i += 3) {
+    var similar_length = diff_array[i] - pos1;
+    assertEquals(s1.substring(pos1, pos1 + similar_length),
+                 s2.substring(pos2, pos2 + similar_length));
+
+    print(s1.substring(pos1, pos1 + similar_length));
+    pos1 += similar_length;
+    pos2 += similar_length;
+    print("<<< " + pos1 + " " + diff_array[i + 1]);
+    print(s1.substring(pos1, pos1 + diff_array[i + 1]));
+    print("===");
+    print(s2.substring(pos2, pos2 + diff_array[i + 2]));
+    print(">>> " + pos2 + " " + diff_array[i + 2]);
+    pos1 += diff_array[i + 1];
+    pos2 += diff_array[i + 2];
+  }
+  {
+    // After last change
+    var similar_length = s1.length - pos1;
+    assertEquals(similar_length, s2.length - pos2);
+    assertEquals(s1.substring(pos1, pos1 + similar_length),
+                 s2.substring(pos2, pos2 + similar_length));
+
+    print(s1.substring(pos1, pos1 + similar_length));
+  }
+  print("");
+}
+
+function CheckCompare(s1, s2) {
+  CheckCompareOneWay(s1, s2);
+  CheckCompareOneWay(s2, s1);
+}
+
+CheckCompare("", "");
+
+CheckCompare("a", "b");
+
+CheckCompare(
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+    "yesterday\nall\nmy\ntroubles\nseem\nso\nfar\naway"
+);
+
+CheckCompare(
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+    "\nall\nmy\ntroubles\nseemed\nso\nfar\naway"
+);
+
+CheckCompare(
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+    "all\nmy\ntroubles\nseemed\nso\nfar\naway"
+);
+
+CheckCompare(
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway\n"
+);
+
+CheckCompare(
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\nfar\naway",
+    "yesterday\nall\nmy\ntroubles\nseemed\nso\n"
+);
+
diff --git a/test/mjsunit/debug-liveedit-newsource.js b/test/mjsunit/debug-liveedit-newsource.js
new file mode 100644
index 0000000..db256a4
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-newsource.js
@@ -0,0 +1,68 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+Debug = debug.Debug
+
+eval("var something1 = 25; \n"
+     + "var something2 = 2010; \n"
+     + "function ChooseAnimal() {\n"
+     + "  return 'Cat';\n"
+     + "} \n"
+     + "function ChooseFurniture() {\n"
+     + "  return 'Table';\n"
+     + "} \n"
+     + "function ChooseNumber() { return 17; } \n"
+     + "ChooseAnimal.Factory = function Factory() {\n"
+     + "  return function FactoryImpl(name) {\n"
+     + "    return 'Help ' + name;\n"
+     + "  }\n"
+     + "}\n");
+
+assertEquals("Cat", ChooseAnimal());
+assertEquals(25, something1);
+
+var script = Debug.findScript(ChooseAnimal);
+
+var new_source = script.source.replace("Cat", "Cap' + 'yb' + 'ara");
+var new_source = new_source.replace("25", "26");
+var new_source = new_source.replace("Help", "Hello");
+var new_source = new_source.replace("17", "18");
+print("new source: " + new_source);
+
+var change_log = new Array();
+Debug.LiveEdit.SetScriptSource(script, new_source, change_log);
+print("Change log: " + JSON.stringify(change_log) + "\n");
+
+assertEquals("Capybara", ChooseAnimal());
+// Global variable do not get changed (without restarting script).
+assertEquals(25, something1);
+// Function is oneliner, so currently it is treated as damaged and not patched.
+assertEquals(17, ChooseNumber());
+assertEquals("Hello Peter", ChooseAnimal.Factory()("Peter"));
diff --git a/test/mjsunit/debug-liveedit-patch-positions-replace.js b/test/mjsunit/debug-liveedit-patch-positions-replace.js
new file mode 100644
index 0000000..09b1b48
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-patch-positions-replace.js
@@ -0,0 +1,83 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+// Scenario: a function is being changed, which causes enclosing function to
+// have its positions patched; position changing requires new instance of Code
+// object to be introduced; the function happens to be on stack at this moment;
+// later it will resume over new instance of Code.
+// Before the change 2 rinfo are 22 characters away from each other. After the
+// change they are 114 characters away from each other. New instance of Code is
+// required when those numbers cross the border value of 64 (in any direction).
+
+Debug = debug.Debug
+
+eval(
+    "function BeingReplaced(changer, opt_x, opt_y) {\n" +
+    "  changer();\n" +
+    "  var res = new Object();\n" +
+    "  if (opt_x) { res.y = opt_y; }\n" +
+    "  res.a = (function() {})();\n" +
+    "  return res.a;\n" +
+    "}"
+);
+
+var script = Debug.findScript(BeingReplaced);
+
+var orig_body = "{}";
+var patch_pos = script.source.indexOf(orig_body);
+// Line long enough to change rinfo encoding.
+var new_body_patch = "{return 'Capybara';" +
+    "                                                                          " +
+    "}";
+
+var change_log = new Array();
+function Changer() {
+  Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_body.length, new_body_patch, change_log);
+  print("Change log: " + JSON.stringify(change_log) + "\n");
+}
+
+function NoOp() {
+}
+
+function CallM(changer) {
+  // We expect call IC here after several function runs.
+  return BeingReplaced(changer);
+}
+
+// This several iterations should cause call IC for BeingReplaced call. This IC
+// will keep reference to code object of BeingRepalced function. This reference
+// should also be patched. Unfortunately, this is a manually checked fact (from
+// debugger or debug print) and doesn't work as an automatic test.
+CallM(NoOp);
+CallM(NoOp);
+CallM(NoOp);
+
+var res = CallM(Changer);
+assertEquals("Capybara", res);
diff --git a/test/mjsunit/debug-liveedit-patch-positions.js b/test/mjsunit/debug-liveedit-patch-positions.js
new file mode 100644
index 0000000..027987f
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-patch-positions.js
@@ -0,0 +1,93 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+// Scenario: some function is being edited; the outer function has to have its
+// positions patched. Accoring to a special markup of function text
+// corresponding byte-code PCs should conicide before change and after it.
+
+Debug = debug.Debug
+
+eval(
+    "function F1() {  return 5; }\n" +
+    "function ChooseAnimal(/*$*/ ) {\n" +
+    "/*$*/ var x = F1(/*$*/ );\n" +
+    "/*$*/ var res/*$*/  =/*$*/ (function() { return 'Cat'; } )();\n" +
+    "/*$*/ var y/*$*/  = F2(/*$*/ F1()/*$*/ , F1(/*$*/ )/*$*/ );\n" +
+    "/*$*/ if (/*$*/ x.toString(/*$*/ )) { /*$*/ y = 3;/*$*/  } else {/*$*/  y = 8;/*$*/  }\n" +
+    "/*$*/ var z = /*$*/ x * y;\n" +
+    "/*$*/ return/*$*/  res/*$*/  + z;/*$*/  }\n" +
+    "function F2(x, y) { return x + y; }"
+);
+
+// Find all *$* markers in text of the function and read corresponding statement
+// PCs.
+function ReadMarkerPositions(func) {
+  var text = func.toString();
+  var positions = new Array();
+  var match;
+  var pattern = /\/\*\$\*\//g;
+  while ((match = pattern.exec(text)) != null) {
+    positions.push(match.index);
+  }
+  return positions;
+}
+
+function ReadPCMap(func, positions) {
+  var res = new Array();
+  for (var i = 0; i < positions.length; i++) {
+    res.push(Debug.LiveEdit.GetPcFromSourcePos(func, positions[i]));
+  }
+  return res;
+}
+
+var res = ChooseAnimal();
+assertEquals("Cat15", res);
+
+var markerPositionsBefore = ReadMarkerPositions(ChooseAnimal);
+var pcArrayBefore = ReadPCMap(ChooseAnimal, markerPositionsBefore);
+
+var script = Debug.findScript(ChooseAnimal);
+
+var orig_animal = "'Cat'";
+var patch_pos = script.source.indexOf(orig_animal);
+var new_animal_patch = "'Capybara'";
+
+var change_log = new Array();
+Debug.LiveEdit.TestApi.ApplySingleChunkPatch(script, patch_pos, orig_animal.length, new_animal_patch, change_log);
+print("Change log: " + JSON.stringify(change_log) + "\n");
+
+var res = ChooseAnimal();
+assertEquals("Capybara15", res);
+
+var markerPositionsAfter = ReadMarkerPositions(ChooseAnimal);
+var pcArrayAfter = ReadPCMap(ChooseAnimal, markerPositionsAfter);
+
+assertArrayEquals(pcArrayBefore, pcArrayAfter);
+
diff --git a/test/mjsunit/debug-liveedit-utils.js b/test/mjsunit/debug-liveedit-utils.js
new file mode 100644
index 0000000..c892ec9
--- /dev/null
+++ b/test/mjsunit/debug-liveedit-utils.js
@@ -0,0 +1,97 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Get the Debug object exposed from the debug context global object.
+
+Debug = debug.Debug
+
+function Return2010() {
+  return 2010;
+}
+
+
+// Diff it trivial: zero chunks
+var NoChunkTranslator = new Debug.LiveEdit.TestApi.PosTranslator([]);
+
+assertEquals(0, NoChunkTranslator.Translate(0));
+assertEquals(10, NoChunkTranslator.Translate(10));
+
+
+// Diff has one chunk
+var SingleChunkTranslator = new Debug.LiveEdit.TestApi.PosTranslator([20, 30, 25]);
+
+assertEquals(0, SingleChunkTranslator.Translate(0));
+assertEquals(5, SingleChunkTranslator.Translate(5));
+assertEquals(10, SingleChunkTranslator.Translate(10));
+assertEquals(19, SingleChunkTranslator.Translate(19));
+assertEquals(2010, SingleChunkTranslator.Translate(20, Return2010));
+assertEquals(25, SingleChunkTranslator.Translate(30));
+assertEquals(26, SingleChunkTranslator.Translate(31));
+assertEquals(2010, SingleChunkTranslator.Translate(26, Return2010));
+
+try {
+  SingleChunkTranslator.Translate(21);
+  assertTrue(false);
+} catch (ignore) {
+}
+try {
+  SingleChunkTranslator.Translate(24);
+  assertTrue(false);
+} catch (ignore) {
+}
+
+
+// Diff has several chunk (3). See the table below.
+
+/*
+chunks: (new <- old)
+ 10   10
+ 15   20
+
+ 35   40
+ 50   40
+
+ 70   60
+ 70   70
+*/
+
+var MultiChunkTranslator = new Debug.LiveEdit.TestApi.PosTranslator([10, 20, 15, 40, 40, 50, 60, 70, 70 ]);
+assertEquals(5, MultiChunkTranslator.Translate(5));
+assertEquals(9, MultiChunkTranslator.Translate(9));
+assertEquals(2010, MultiChunkTranslator.Translate(10, Return2010));
+assertEquals(15, MultiChunkTranslator.Translate(20));
+assertEquals(20, MultiChunkTranslator.Translate(25));
+assertEquals(34, MultiChunkTranslator.Translate(39));
+assertEquals(50, MultiChunkTranslator.Translate(40, Return2010));
+assertEquals(55, MultiChunkTranslator.Translate(45));
+assertEquals(69, MultiChunkTranslator.Translate(59));
+assertEquals(2010, MultiChunkTranslator.Translate(60, Return2010));
+assertEquals(70, MultiChunkTranslator.Translate(70));
+assertEquals(75, MultiChunkTranslator.Translate(75));
+
+
diff --git a/test/mjsunit/debug-scopes.js b/test/mjsunit/debug-scopes.js
index af29df9..37cefd1 100644
--- a/test/mjsunit/debug-scopes.js
+++ b/test/mjsunit/debug-scopes.js
@@ -84,16 +84,16 @@
     var scope = exec_state.frame().scope(i);
     assertTrue(scope.isScope());
     assertEquals(scopes[i], scope.scopeType());
-    
+
     // Check the global object when hitting the global scope.
     if (scopes[i] == debug.ScopeType.Global) {
       assertEquals(this, scope.scopeObject().value());
     }
   }
-  
+
   // Get the debug command processor.
   var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
-  
+
   // Send a scopes request and check the result.
   var json;
   request_json = '{"seq":0,"type":"request","command":"scopes"}'
@@ -133,7 +133,7 @@
     }
     count++;
   }
-  
+
   // 'arguments' and might be exposed in the local and closure scope. Just
   // ignore this.
   var scope_size = scope.scopeObject().properties().length;
@@ -156,7 +156,7 @@
 
   // Get the debug command processor.
   var dcp = exec_state.debugCommandProcessor("unspecified_running_state");
-  
+
   // Send a scope request for information on a single scope and check the
   // result.
   request_json = '{"seq":0,"type":"request","command":"scope","arguments":{"number":'
@@ -622,7 +622,7 @@
     with ({j:13}){
       return function() {
         var x = 14;
-        with ({a:15}) {      
+        with ({a:15}) {
           with ({b:16}) {
             debugger;
             some_global = a;
@@ -707,7 +707,7 @@
 
 
 BeginTest("Catch block 3");
-function catch_block_1() {
+function catch_block_3() {
   // Do eval to dynamically declare a local variable so that the context's
   // extension slot is initialized with JSContextExtensionObject.
   eval("var y = 78;");
@@ -726,12 +726,12 @@
   CheckScopeContent({e:'Exception'}, 0, exec_state);
   CheckScopeContent({y:78}, 1, exec_state);
 }
-catch_block_1()
+catch_block_3()
 EndTest();
 
 
 BeginTest("Catch block 4");
-function catch_block_2() {
+function catch_block_4() {
   // Do eval to dynamically declare a local variable so that the context's
   // extension slot is initialized with JSContextExtensionObject.
   eval("var y = 98;");
@@ -753,7 +753,7 @@
   CheckScopeContent({e:'Exception'}, 1, exec_state);
   CheckScopeContent({y:98}, 2, exec_state);
 }
-catch_block_2()
+catch_block_4()
 EndTest();
 
 
diff --git a/test/mjsunit/debug-script.js b/test/mjsunit/debug-script.js
index 402f90c..643dd8c 100644
--- a/test/mjsunit/debug-script.js
+++ b/test/mjsunit/debug-script.js
@@ -52,7 +52,7 @@
 }
 
 // This has to be updated if the number of native scripts change.
-assertEquals(13, named_native_count);
+assertEquals(14, named_native_count);
 // If no snapshot is used, only the 'gc' extension is loaded.
 // If snapshot is used, all extensions are cached in the snapshot.
 assertTrue(extension_count == 1 || extension_count == 5);
diff --git a/test/mjsunit/debug-setbreakpoint.js b/test/mjsunit/debug-setbreakpoint.js
index 08492b4..3981dc4 100644
--- a/test/mjsunit/debug-setbreakpoint.js
+++ b/test/mjsunit/debug-setbreakpoint.js
@@ -116,6 +116,8 @@
     mirror = debug.MakeMirror(o.a);
     testArguments(dcp, '{"type":"handle","target":' + mirror.handle() + '}', true, false);
 
+    testArguments(dcp, '{"type":"script","target":"sourceUrlScript","line":1}', true, true);
+
     // Indicate that all was processed.
     listenerComplete = true;
   }
@@ -136,6 +138,7 @@
 };
 
 eval('function h(){}');
+eval('function sourceUrlFunc() { a = 2; }\n//@ sourceURL=sourceUrlScript');
 
 o = {a:function(){},b:function(){}}
 
@@ -143,9 +146,12 @@
 f_script_id = Debug.findScript(f).id;
 g_script_id = Debug.findScript(g).id;
 h_script_id = Debug.findScript(h).id;
+sourceURL_script_id = Debug.findScript(sourceUrlFunc).id;
+
 assertTrue(f_script_id > 0, "invalid script id for f");
 assertTrue(g_script_id > 0, "invalid script id for g");
 assertTrue(h_script_id > 0, "invalid script id for h");
+assertTrue(sourceURL_script_id > 0, "invalid script id for sourceUrlFunc");
 assertEquals(f_script_id, g_script_id);
 
 // Get the source line for the test functions.
@@ -161,5 +167,20 @@
 Debug.setBreakPoint(g, 0, 0);
 g();
 
-// Make sure that the debug event listener vas invoked.
+// Make sure that the debug event listener was invoked.
 assertTrue(listenerComplete, "listener did not run to completion: " + exception);
+
+// Try setting breakpoint by url specified in sourceURL
+
+var breakListenerCalled = false;
+
+function breakListener(event) {
+  if (event == Debug.DebugEvent.Break)
+    breakListenerCalled = true;
+}
+
+Debug.setListener(breakListener);
+
+sourceUrlFunc();
+
+assertTrue(breakListenerCalled, "Break listener not called on breakpoint set by sourceURL");
diff --git a/test/mjsunit/debug-stepin-accessor.js b/test/mjsunit/debug-stepin-accessor.js
index 8b24c3c..2e593b2 100644
--- a/test/mjsunit/debug-stepin-accessor.js
+++ b/test/mjsunit/debug-stepin-accessor.js
@@ -36,7 +36,7 @@
 var expected_function_name = null;
 
 // Simple debug event handler which first time will cause 'step in' action
-// to get into g.call and than check that execution is pauesed inside
+// to get into g.call and than check that execution is stopped inside
 // function 'g'.
 function listener(event, exec_state, event_data, data) {
   try {
diff --git a/test/mjsunit/div-mod.js b/test/mjsunit/div-mod.js
index 1d352b5..3e343de 100644
--- a/test/mjsunit/div-mod.js
+++ b/test/mjsunit/div-mod.js
@@ -169,3 +169,24 @@
   assertEquals(somenum, somenum % -0x40000000, "%minsmi-32");
   assertEquals(somenum, somenum % -0x80000000, "%minsmi-64");
 })();
+
+
+// Side-effect-free expressions containing bit operations use
+// an optimized compiler with int32 values.   Ensure that modulus
+// produces negative zeros correctly.
+function negative_zero_modulus_test() {
+  var x = 4;
+  var y = -4;
+  x = x + x - x;
+  y = y + y - y;
+  var z = (y | y | y | y) % x;
+  assertEquals(-1 / 0, 1 / z);
+  z = (x | x | x | x) % x;
+  assertEquals(1 / 0, 1 / z);
+  z = (y | y | y | y) % y;
+  assertEquals(-1 / 0, 1 / z);
+  z = (x | x | x | x) % y;
+  assertEquals(1 / 0, 1 / z);
+}
+
+negative_zero_modulus_test();
diff --git a/test/mjsunit/function-without-prototype.js b/test/mjsunit/function-without-prototype.js
new file mode 100644
index 0000000..9018086
--- /dev/null
+++ b/test/mjsunit/function-without-prototype.js
@@ -0,0 +1,54 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests that function does not have prototype.
+function testPrototype(f) {
+  assertFalse('prototype' in f);
+  assertEquals(undefined, f.prototype);
+  f.prototype = 42;
+  assertEquals(42, f.prototype);
+  assertTrue('prototype' in f);
+}
+
+// Tests that construction from function throws.
+function testConstruction(name) {
+  assertThrows("new " + name + "()");
+  eval(name + ".prototype = 42;");
+  assertThrows("new " + name + "()");
+}
+
+testPrototype(eval);
+testPrototype(Array.prototype.push);
+testPrototype(Function.prototype.call);
+testPrototype(String.fromCharCode);
+var date = new Date();
+testPrototype(date.toString);
+
+testConstruction("parseInt");
+testConstruction("Function.prototype.apply");
+var regexp = /abc/g;
+testConstruction("regexp.test");
diff --git a/test/mjsunit/fuzz-natives.js b/test/mjsunit/fuzz-natives.js
index e2f601e..78245c3 100644
--- a/test/mjsunit/fuzz-natives.js
+++ b/test/mjsunit/fuzz-natives.js
@@ -57,9 +57,17 @@
   return new Function(args.join(", "), "return %" + name + "(" + argsStr + ");");
 }
 
-function testArgumentCount(name) {
+function testArgumentCount(name, argc) {
   for (var i = 0; i < 10; i++) {
-    var func = makeFunction(name, i);
+    var func = null;
+    try {
+      func = makeFunction(name, i);
+    } catch (e) {
+      if (e != "SyntaxError: illegal access") throw e;
+    }
+    if (func === null && i == argc) {
+      throw "unexpected exception";
+    }
     var args = [ ];
     for (var j = 0; j < i; j++)
       args.push(0);
@@ -147,7 +155,25 @@
   "DeclareGlobals": true,
 
   "PromoteScheduledException": true,
-  "DeleteHandleScopeExtensions": true
+  "DeleteHandleScopeExtensions": true,
+
+  // That can only be invoked on Array.prototype.
+  "FinishArrayPrototypeSetup": true,
+
+  "_SwapElements": true,
+
+  // Performance critical function which cannot afford type checks.
+  "_CallFunction": true,
+
+  // Tries to allocate based on argument, and (correctly) throws
+  // out-of-memory if the request is too large. In practice, the
+  // size will be the number of captures of a RegExp.
+  "RegExpConstructResult": true,
+  "_RegExpConstructResult": true,
+
+  // This function performs some checks compile time (it requires its first
+  // argument to be a compile time smi).
+  "_GetFromCache": true,
 };
 
 var currentlyUncallable = {
@@ -164,7 +190,7 @@
       continue;
     print(name);
     var argc = nativeInfo[1];
-    testArgumentCount(name);
+    testArgumentCount(name, argc);
     testArgumentTypes(name, argc);
   }
 }
diff --git a/test/mjsunit/math-round.js b/test/mjsunit/math-round.js
index d80a103..3b06088 100644
--- a/test/mjsunit/math-round.js
+++ b/test/mjsunit/math-round.js
@@ -50,3 +50,52 @@
 assertEquals(-9007199254740991, Math.round(-9007199254740991));
 assertEquals(Number.MAX_VALUE, Math.round(Number.MAX_VALUE));
 assertEquals(-Number.MAX_VALUE, Math.round(-Number.MAX_VALUE));
+
+assertEquals(536870911, Math.round(536870910.5));
+assertEquals(536870911, Math.round(536870911));
+assertEquals(536870911, Math.round(536870911.4));
+assertEquals(536870912, Math.round(536870911.5));
+assertEquals(536870912, Math.round(536870912));
+assertEquals(536870912, Math.round(536870912.4));
+assertEquals(536870913, Math.round(536870912.5));
+assertEquals(536870913, Math.round(536870913));
+assertEquals(536870913, Math.round(536870913.4));
+assertEquals(1073741823, Math.round(1073741822.5));
+assertEquals(1073741823, Math.round(1073741823));
+assertEquals(1073741823, Math.round(1073741823.4));
+assertEquals(1073741824, Math.round(1073741823.5));
+assertEquals(1073741824, Math.round(1073741824));
+assertEquals(1073741824, Math.round(1073741824.4));
+assertEquals(1073741825, Math.round(1073741824.5));
+assertEquals(2147483647, Math.round(2147483646.5));
+assertEquals(2147483647, Math.round(2147483647));
+assertEquals(2147483647, Math.round(2147483647.4));
+assertEquals(2147483648, Math.round(2147483647.5));
+assertEquals(2147483648, Math.round(2147483648));
+assertEquals(2147483648, Math.round(2147483648.4));
+assertEquals(2147483649, Math.round(2147483648.5));
+
+// Tests based on WebKit LayoutTests
+
+assertEquals(0, Math.round(0.4));
+assertEquals(-0, Math.round(-0.4));
+assertEquals(-0, Math.round(-0.5));
+assertEquals(1, Math.round(0.6));
+assertEquals(-1, Math.round(-0.6));
+assertEquals(2, Math.round(1.5));
+assertEquals(2, Math.round(1.6));
+assertEquals(-2, Math.round(-1.6));
+assertEquals(8640000000000000, Math.round(8640000000000000));
+assertEquals(8640000000000001, Math.round(8640000000000001));
+assertEquals(8640000000000002, Math.round(8640000000000002));
+assertEquals(9007199254740990, Math.round(9007199254740990));
+assertEquals(9007199254740991, Math.round(9007199254740991));
+assertEquals(1.7976931348623157e+308, Math.round(1.7976931348623157e+308));
+assertEquals(-8640000000000000, Math.round(-8640000000000000));
+assertEquals(-8640000000000001, Math.round(-8640000000000001));
+assertEquals(-8640000000000002, Math.round(-8640000000000002));
+assertEquals(-9007199254740990, Math.round(-9007199254740990));
+assertEquals(-9007199254740991, Math.round(-9007199254740991));
+assertEquals(-1.7976931348623157e+308, Math.round(-1.7976931348623157e+308));
+assertEquals(Infinity, Math.round(Infinity));
+assertEquals(-Infinity, Math.round(-Infinity));
diff --git a/test/mjsunit/math-sqrt.js b/test/mjsunit/math-sqrt.js
new file mode 100644
index 0000000..ae29b74
--- /dev/null
+++ b/test/mjsunit/math-sqrt.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests the special cases specified by ES 15.8.2.17
+
+// Simple sanity check
+assertEquals(2, Math.sqrt(4));
+assertEquals(0.1, Math.sqrt(0.01));
+
+// Spec tests
+assertEquals(NaN, Math.sqrt(NaN));
+assertEquals(NaN, Math.sqrt(-1));
+assertEquals(+0, Math.sqrt(+0));
+assertEquals(-0, Math.sqrt(-0));
+assertEquals(Infinity, Math.sqrt(Infinity));
+// -Infinity is smaller than 0 so it should return NaN
+assertEquals(NaN, Math.sqrt(-Infinity));
+
+
+
diff --git a/test/mjsunit/mirror-regexp.js b/test/mjsunit/mirror-regexp.js
index 8c834bf..d6a9d71 100644
--- a/test/mjsunit/mirror-regexp.js
+++ b/test/mjsunit/mirror-regexp.js
@@ -70,8 +70,8 @@
   assertEquals('regexp', mirror.type());
   assertFalse(mirror.isPrimitive());
   for (var p in expected_attributes) {
-    assertEquals(mirror.property(p).attributes(),
-                 expected_attributes[p],
+    assertEquals(expected_attributes[p],
+                 mirror.property(p).attributes(),
                  p + ' attributes');
   }
 
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 7cb2416..47963fe 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -48,6 +48,10 @@
 # Skip long running test in debug and allow it to timeout in release mode.
 regress/regress-524: (PASS || TIMEOUT), SKIP if $mode == debug
 
+# Skip experimental liveedit drop frame on non-ia32 architectures.
+# debug-liveedit-check-stack: SKIP if $arch != ia32
+debug-liveedit-check-stack: SKIP
+
 [ $arch == arm ]
 
 # Slow tests which times out in debug mode.
diff --git a/test/mjsunit/number-tostring.js b/test/mjsunit/number-tostring.js
index 04d027f..8312080 100644
--- a/test/mjsunit/number-tostring.js
+++ b/test/mjsunit/number-tostring.js
@@ -122,6 +122,8 @@
 assertEquals("100000000000000000000000000000001", (Math.pow(2,32) + 1).toString(2));
 assertEquals("100000000000080", (0x100000000000081).toString(16));
 assertEquals("1000000000000100", (-(-'0x1000000000000081')).toString(16));
+assertEquals("1000000000000000", (-(-'0x1000000000000080')).toString(16));
+assertEquals("1000000000000000", (-(-'0x100000000000007F')).toString(16));
 assertEquals("100000000000000000000000000000000000000000000000010000000", (0x100000000000081).toString(2));
 assertEquals("-11111111111111111111111111111111", (-(Math.pow(2,32)-1)).toString(2));
 assertEquals("-5yc1z", (-10000007).toString(36));
diff --git a/test/mjsunit/parse-int-float.js b/test/mjsunit/parse-int-float.js
index b9620ff..a4f09df 100644
--- a/test/mjsunit/parse-int-float.js
+++ b/test/mjsunit/parse-int-float.js
@@ -42,14 +42,32 @@
 assertEquals(0x12, parseInt('0x12', 16));
 assertEquals(0x12, parseInt('0x12', 16.1));
 assertEquals(0x12, parseInt('0x12', NaN));
-
+assertTrue(isNaN(parseInt('0x  ')));
+assertTrue(isNaN(parseInt('0x')));
+assertTrue(isNaN(parseInt('0x  ', 16)));
+assertTrue(isNaN(parseInt('0x', 16)));
 assertEquals(12, parseInt('12aaa'));
 
 assertEquals(0.1, parseFloat('0.1'));
 assertEquals(0.1, parseFloat('0.1aaa'));
+assertEquals(0, parseFloat('0aaa'));
 assertEquals(0, parseFloat('0x12'));
 assertEquals(77, parseFloat('077'));
 
+assertEquals(Infinity, parseInt('1000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '0000000000000'));
+
+assertEquals(Infinity, parseInt('0x10000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '000000000000000000000000000000000000000000000000000000000000000000000000'
+    + '0000000000000'));
+
 
 var i;
 var y = 10;
diff --git a/test/mjsunit/regexp-cache-replace.js b/test/mjsunit/regexp-cache-replace.js
new file mode 100644
index 0000000..ad33acb
--- /dev/null
+++ b/test/mjsunit/regexp-cache-replace.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Tests that regexp caching isn't messing things up.
+
+var re1 = /(o)/g;
+assertEquals("FxxBar", "FooBar".replace(re1, "x"));
+assertEquals("o", RegExp.$1);
+assertTrue(/(x)/.test("abcxdef"));
+assertEquals("x", RegExp.$1);
+assertEquals("FxxBar", "FooBar".replace(re1, "x"));
+assertEquals("o", RegExp.$1);
diff --git a/test/mjsunit/regexp-compile.js b/test/mjsunit/regexp-compile.js
new file mode 100644
index 0000000..6f8e751
--- /dev/null
+++ b/test/mjsunit/regexp-compile.js
@@ -0,0 +1,42 @@
+// Copyright 2008 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we don't cache the result of a regexp match across a
+// compile event.
+var re = /x/; 
+assertEquals("a.yb", "axyb".replace(re, "."));
+
+re.compile("y")
+assertEquals("ax.b", "axyb".replace(re, "."));
+
+re.compile("(x)");
+
+assertEquals("x,x", re.exec("axyb"));
+
+re.compile("(y)");
+
+assertEquals("y,y", re.exec("axyb"));
diff --git a/test/mjsunit/regress/regress-634.js b/test/mjsunit/regress/regress-634.js
new file mode 100644
index 0000000..b68e843
--- /dev/null
+++ b/test/mjsunit/regress/regress-634.js
@@ -0,0 +1,32 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+for (var i = 0; i < 1000000; i++) {
+  a = new Array(0);
+  assertEquals(0, a.length);
+  assertEquals(0, a.length);
+}
diff --git a/test/mjsunit/regress/regress-636.js b/test/mjsunit/regress/regress-636.js
new file mode 100644
index 0000000..8e0196d
--- /dev/null
+++ b/test/mjsunit/regress/regress-636.js
@@ -0,0 +1,36 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function test() {
+  var i, result = "";
+  var value = parseFloat(5.5);
+  value = Math.abs(1025);
+  for(i = 12; --i; result = ( value % 2 ) + result, value >>= 1);
+  return result;
+};
+
+assertEquals("10000000001", test());
diff --git a/test/mjsunit/regress/regress-641.js b/test/mjsunit/regress/regress-641.js
new file mode 100644
index 0000000..957caa8
--- /dev/null
+++ b/test/mjsunit/regress/regress-641.js
@@ -0,0 +1,35 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=641.
+
+ function f(){
+ while (window + 1) {
+   const window=[,];
+ }
+}
+f()
diff --git a/test/mjsunit/regress/regress-643.js b/test/mjsunit/regress/regress-643.js
new file mode 100644
index 0000000..39c467b
--- /dev/null
+++ b/test/mjsunit/regress/regress-643.js
@@ -0,0 +1,37 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=643.
+
+function f() {
+  var test = {x:1};
+  var a = test;
+  a.x = a = 42;
+  return test.x;
+}
+
+assertEquals(42, f());
diff --git a/test/mjsunit/regress/regress-646.js b/test/mjsunit/regress/regress-646.js
new file mode 100644
index 0000000..b862350
--- /dev/null
+++ b/test/mjsunit/regress/regress-646.js
@@ -0,0 +1,33 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=646.
+
+function f() { this.__proto__ = 42 }
+var count = 0;
+for (var x in new f()) count++;
+assertEquals(0, count);
diff --git a/test/mjsunit/regress/regress-675.js b/test/mjsunit/regress/regress-675.js
new file mode 100644
index 0000000..19ca646
--- /dev/null
+++ b/test/mjsunit/regress/regress-675.js
@@ -0,0 +1,61 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=675.
+//
+// Test that load ICs for nonexistent properties check global
+// property cells.
+
+function f() { return this.x; }
+
+// Initialize IC for nonexistent x property on global object.
+f();
+f();
+
+// Assign to global property cell for x.
+this.x = 23;
+
+// Check that we bail out from the IC.
+assertEquals(23, f());
+
+
+// Same test, but test that the global property cell is also checked
+// if the global object is the last object in the prototype chain for
+// the load.
+this.__proto__ = null;
+function g() { return this.y; }
+
+// Initialize IC.
+g();
+g();
+
+// Update global property cell.
+this.y = 42;
+
+// Check that IC bails out.
+assertEquals(42, g());
+
diff --git a/test/mjsunit/regress/regress-681.js b/test/mjsunit/regress/regress-681.js
new file mode 100644
index 0000000..6708d05
--- /dev/null
+++ b/test/mjsunit/regress/regress-681.js
@@ -0,0 +1,44 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=681.
+//
+// Test that load ICs for nonexistent properties bail out on smi receiver.
+
+
+var x = {};
+function f() { return x.y; }
+
+// Initialize IC for nonexistent y property on x.
+f();
+f();
+
+// Make x a smi.
+x = 23;
+
+// Check that we bail out from the IC.
+assertEquals(undefined, f());
diff --git a/test/mjsunit/regress/regress-685.js b/test/mjsunit/regress/regress-685.js
new file mode 100644
index 0000000..d77d61b
--- /dev/null
+++ b/test/mjsunit/regress/regress-685.js
@@ -0,0 +1,43 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test for http://code.google.com/p/v8/issues/detail?id=685.
+//
+// Test that keyed load IC generic stub uses unsigned comparison for
+// for the length field of arrays.
+//
+// The test passes if it does not crash.
+
+function test() {
+  var N = 0xFFFFFFFF;
+  var a = [];
+  a[N - 1] = 0;
+  a[N - 2] = 1;
+  a.reverse();
+}
+
+test();
diff --git a/test/mjsunit/regress/regress-crbug-37853.js b/test/mjsunit/regress/regress-crbug-37853.js
new file mode 100644
index 0000000..047fbcb
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-37853.js
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/37853
+
+function f(o, k) { return o[k]; }
+a = {'a':1, 1:'a'}
+f(a, 'a')
+f(a, 'a')
+f(a, 1);
diff --git a/test/mjsunit/regress/regress-crbug-39160.js b/test/mjsunit/regress/regress-crbug-39160.js
new file mode 100644
index 0000000..a8a8567
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-39160.js
@@ -0,0 +1,41 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/39160
+
+// To reproduce the bug we need an inlined comparison (i.e. in a loop) where
+// the left hand side is known to be a smi (max smi value is  1073741823). This
+// test crashes with the bug.
+function f(a) {
+  for (var i = 1073741820; i < 1073741822; i++) {
+    if (a < i) {
+      a += i;
+    }
+  }
+}
+
+f(5)
diff --git a/test/mjsunit/regress/regress-crbug-40931.js b/test/mjsunit/regress/regress-crbug-40931.js
new file mode 100644
index 0000000..2dbff6e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-40931.js
@@ -0,0 +1,45 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See http://crbug.com/40931
+
+// To reproduce this we need to split a comma separated string and check the
+// indices which should only contain the numeric indices corresponding to the
+// number of values of the split.
+
+var names = "a,b,c,d";
+
+for(var i = 0; i < 10; i++) {
+  var splitNames = names.split(/,/);
+  var forInNames = [];
+  var count = 0;
+  for (name in splitNames) {
+    forInNames[count++] = name;
+  }
+  forInNames.sort();
+  assertEquals("0,1,2,3", forInNames.join());
+}
diff --git a/test/mjsunit/search-string-multiple.js b/test/mjsunit/search-string-multiple.js
new file mode 100644
index 0000000..b28fded
--- /dev/null
+++ b/test/mjsunit/search-string-multiple.js
@@ -0,0 +1,62 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test search and replace where we search for a string, not a regexp.
+
+function TestCase(id, expected_output, regexp_source, flags, input) {
+  print(id);
+  var re = new RegExp(regexp_source, flags);
+  var output = input.replace(re, MakeReplaceString);
+  assertEquals(expected_output, output, id);
+}
+
+
+function MakeReplaceString() {
+  // Arg 0 is the match, n captures follow, n + 1 is offset of match, n + 2 is
+  // the subject.
+  var l = arguments.length;
+  var a = new Array(l - 3);
+  a.push(arguments[0]);
+  for (var i = 2; i < l - 2; i++) {
+    a.push(arguments[i]);
+  }
+  return "[@" + arguments[l - 2] + ":" + a.join(",") + "]";
+}
+
+
+(function () {
+  TestCase(1,
+           "ajaxNiceForm.villesHome([@24:#OBJ#])",
+           "#OBJ#",
+           "g",
+           "ajaxNiceForm.villesHome(#OBJ#)");
+  TestCase(2,
+           "A long string with no non-ASCII characters",
+           "Unicode string \u1234",
+           "g",
+           "A long string with no non-ASCII characters");
+})();
diff --git a/test/mjsunit/smi-ops.js b/test/mjsunit/smi-ops.js
index 39b4894..9f18790 100644
--- a/test/mjsunit/smi-ops.js
+++ b/test/mjsunit/smi-ops.js
@@ -669,3 +669,12 @@
 function shiftByZero(n) { return n << 0; }
 
 assertEquals(3, shiftByZero(3.1415));
+
+// Verify that the static type information of x >>> 32 is computed correctly.
+function LogicalShiftRightByMultipleOf32(x) {
+  x = x >>> 32;
+  return x + x;
+}
+
+assertEquals(4589934592, LogicalShiftRightByMultipleOf32(-2000000000));
+assertEquals(4589934592, LogicalShiftRightByMultipleOf32(-2000000000));
diff --git a/test/mjsunit/str-to-num.js b/test/mjsunit/str-to-num.js
index 12a3716..20e2986 100644
--- a/test/mjsunit/str-to-num.js
+++ b/test/mjsunit/str-to-num.js
@@ -29,8 +29,20 @@
   return Number(val);
 }
 
-// assertEquals(, toNumber());
+function repeat(s, num) {
+  var result = '';
+  while (num > 0) {
+    if ((num & 1) != 0) result += s;
+    s += s;
+    num >>= 1;
+  }
 
+  return result;
+}
+
+assertEquals('0000000000', repeat('0', 10));
+
+// assertEquals(, toNumber());
 
 assertEquals(123, toNumber(" 123"));
 assertEquals(123, toNumber("\n123"));
@@ -50,6 +62,10 @@
 assertEquals(123, toNumber("\t123\t"));
 assertEquals(123, toNumber("\f123\f"));
 
+assertEquals(16, toNumber(" 0x10 "));
+assertEquals(NaN, toNumber("0x"));
+assertEquals(NaN, toNumber("0x "));
+
 assertTrue(isNaN(toNumber(" NaN ")));
 assertEquals(Infinity,  toNumber(" Infinity ") ," Infinity");
 assertEquals(-Infinity, toNumber(" -Infinity "));
@@ -61,6 +77,7 @@
 assertEquals(0,  toNumber("0"));
 assertEquals(0,  toNumber("+0"));
 assertEquals(-0, toNumber("-0"));
+assertEquals(-Infinity, 1 / toNumber("-0"));
 
 assertEquals(1,  toNumber("1"));
 assertEquals(1,  toNumber("+1"));
@@ -130,11 +147,38 @@
 assertEquals(15, toNumber("0XF"));
 
 assertEquals(0,  toNumber("0x000"));
+assertEquals(-Infinity,  1 / toNumber("-0x000"));
+assertEquals(0,  toNumber("0x000" + repeat('0', 1000)));
 assertEquals(9,  toNumber("0x009"));
 assertEquals(10, toNumber("0x00a"));
 assertEquals(10, toNumber("0x00A"));
 assertEquals(15, toNumber("0x00f"));
 assertEquals(15, toNumber("0x00F"));
+assertEquals(15, toNumber("0x00F "));
+assertEquals(Infinity,  toNumber("0x" + repeat('0', 1000) + '1'
+                        + repeat('0', 1000)));
+assertEquals(-Infinity,  toNumber("-0x1" + repeat('0', 1000)));
+
+assertEquals(0x1000000 * 0x10000000, toNumber("0x10000000000000"));
+assertEquals(0x1000000 * 0x10000000 + 1, toNumber("0x10000000000001"));
+assertEquals(0x10 * 0x1000000 * 0x10000000, toNumber("0x100000000000000"));
+assertEquals(0x10 * 0x1000000 * 0x10000000, toNumber("0x100000000000001"));
+assertEquals(0x10 * 0x1000000 * 0x10000000, toNumber("0x100000000000007"));
+assertEquals(0x10 * 0x1000000 * 0x10000000, toNumber("0x100000000000008"));
+assertEquals(0x10 * (0x1000000 * 0x10000000 + 1),
+             toNumber("0x100000000000009"));
+assertEquals(0x10 * (0x1000000 * 0x10000000 + 1),
+             toNumber("0x10000000000000F"));
+assertEquals(0x10 * (0x1000000 * 0x10000000 + 1),
+             toNumber("0x100000000000010"));
+assertEquals(0x100000000000 * 0x1000000 * 0x10000000,
+             toNumber("0x1000000000000000000000000"));
+assertEquals(0x100000000000 * 0x1000000 * 0x10000000,
+             toNumber("0x1000000000000080000000000"));
+assertEquals(0x100000000000 * (0x1000000 * 0x10000000 + 1),
+             toNumber("0x1000000000000080000000001"));
+assertEquals(0x100000000000 * 0x1000000 * 0x10000000,
+             toNumber("  0x1000000000000000000000000  "));
 
 assertEquals(0, toNumber("00"));
 assertEquals(1, toNumber("01"));
@@ -156,3 +200,6 @@
 assertTrue(isNaN(toNumber("100.0 junk")), "100.0 junk");
 assertTrue(isNaN(toNumber(".1e4 junk")), ".1e4 junk");
 assertTrue(isNaN(toNumber("Infinity junk")), "Infinity junk");
+assertTrue(isNaN(toNumber("1e")), "1e");
+assertTrue(isNaN(toNumber("1e ")), "1e_");
+assertTrue(isNaN(toNumber("1" + repeat('0', 1000) + 'junk')), "1e1000 junk");
diff --git a/test/mjsunit/string-charat.js b/test/mjsunit/string-charat.js
index 8ec8f1e..d1989df 100644
--- a/test/mjsunit/string-charat.js
+++ b/test/mjsunit/string-charat.js
@@ -51,3 +51,16 @@
 assertTrue(isNaN(s.charCodeAt(-1)));
 assertTrue(isNaN(s.charCodeAt(4)));
 
+// Make sure enough of the one-char string cache is filled.
+var alpha = ['@'];
+for (var i = 1; i < 128; i++) {
+  var c = String.fromCharCode(i);
+  alpha[i] = c.charAt(0);
+}
+var alphaStr = alpha.join("");
+
+// Now test chars.
+for (var i = 1; i < 128; i++) {
+  assertEquals(alpha[i], alphaStr.charAt(i));
+  assertEquals(String.fromCharCode(i), alphaStr.charAt(i));
+}
diff --git a/test/mjsunit/string-index.js b/test/mjsunit/string-index.js
index 2256286..866faa8 100644
--- a/test/mjsunit/string-index.js
+++ b/test/mjsunit/string-index.js
@@ -35,6 +35,14 @@
 assertEquals("o", foo[1]);
 assertEquals("o", foo[2]);
 
+// Test string keyed load IC.
+for (var i = 0; i < 10; i++) {
+  assertEquals("F", foo[0]);
+  assertEquals("o", foo[1]);
+  assertEquals("o", foo[2]);
+  assertEquals("F", (foo[0] + "BarBazQuuxFooBarQuux")[0]);
+}
+
 assertEquals("F", foo["0" + ""], "string index");
 assertEquals("o", foo["1"], "string index");
 assertEquals("o", foo["2"], "string index");
@@ -152,3 +160,78 @@
 var s2 = (s[-2] = 't');
 assertEquals('undefined', typeof(s[-2]));
 assertEquals('t', s2);
+
+// Make sure enough of the one-char string cache is filled.
+var alpha = ['@'];
+for (var i = 1; i < 128; i++) {
+  var c = String.fromCharCode(i);
+  alpha[i] = c[0];
+}
+var alphaStr = alpha.join("");
+
+// Now test chars.
+for (var i = 1; i < 128; i++) {
+  assertEquals(alpha[i], alphaStr[i]);
+  assertEquals(String.fromCharCode(i), alphaStr[i]);
+}
+
+// Test for keyed ic.
+var foo = ['a12', ['a', 2, 'c'], 'a31', 42];
+var results = [1, 2, 3, NaN];
+for (var i = 0; i < 200; ++i) {
+  var index = Math.floor(i / 50);
+  var receiver = foo[index];
+  var expected = results[index];
+  var actual = +(receiver[1]);
+  assertEquals(expected, actual);
+}
+
+var keys = [0, '1', 2, 3.0, -1, 10];
+var str = 'abcd', arr = ['a', 'b', 'c', 'd', undefined, undefined];
+for (var i = 0; i < 300; ++i) {
+  var index = Math.floor(i / 50);
+  var key = keys[index];
+  var expected = arr[index];
+  var actual = str[key];
+  assertEquals(expected, actual);
+}
+
+// Test heap number case.
+var keys = [0, Math.floor(2) * 0.5];
+var str = 'ab', arr = ['a', 'b'];
+for (var i = 0; i < 100; ++i) {
+  var index = Math.floor(i / 50);
+  var key = keys[index];
+  var expected = arr[index];
+  var actual = str[key];
+  assertEquals(expected, actual);
+}
+
+// Test out of range case.
+var keys = [0, -1];
+var str = 'ab', arr = ['a', undefined];
+for (var i = 0; i < 100; ++i) {
+  var index = Math.floor(i / 50);
+  var key = keys[index];
+  var expected = arr[index];
+  var actual = str[key];
+  assertEquals(expected, actual);
+}
+
+var keys = [0, 10];
+var str = 'ab', arr = ['a', undefined];
+for (var i = 0; i < 100; ++i) {
+  var index = Math.floor(i / 50);
+  var key = keys[index];
+  var expected = arr[index];
+  var actual = str[key];
+  assertEquals(expected, actual);
+}
+
+// Test two byte string.
+var str = '\u0427', arr = ['\u0427'];
+for (var i = 0; i < 50; ++i) {
+  var expected = arr[0];
+  var actual = str[0];
+  assertEquals(expected, actual);
+}
\ No newline at end of file
diff --git a/test/mjsunit/string-replace.js b/test/mjsunit/string-replace.js
index d72f73b..9e4f559 100644
--- a/test/mjsunit/string-replace.js
+++ b/test/mjsunit/string-replace.js
@@ -30,7 +30,7 @@
  */
 
 function replaceTest(result, subject, pattern, replacement) {
-  var name = 
+  var name =
     "\"" + subject + "\".replace(" + pattern + ", " + replacement + ")";
   assertEquals(result, subject.replace(pattern, replacement), name);
 }
@@ -114,8 +114,8 @@
 replaceTest("xaxe$xcx", short, /b/g, "e$");
 
 
-replaceTest("[$$$1$$a1abb1bb0$002$3$03][$$$1$$b1bcc1cc0$002$3$03]c", 
-            "abc", /(.)(?=(.))/g, "[$$$$$$1$$$$$11$01$2$21$02$020$002$3$03]"); 
+replaceTest("[$$$1$$a1abb1bb0$002$3$03][$$$1$$b1bcc1cc0$002$3$03]c",
+            "abc", /(.)(?=(.))/g, "[$$$$$$1$$$$$11$01$2$21$02$020$002$3$03]");
 
 // Replace with functions.
 
@@ -178,5 +178,32 @@
 longstring = longstring + longstring;
 // longstring.length == 5 << 11
 
-replaceTest(longstring + longstring, 
+replaceTest(longstring + longstring,
             "<" + longstring + ">", /<(.*)>/g, "$1$1");
+
+replaceTest("string 42", "string x", /x/g, function() { return 42; });
+replaceTest("string 42", "string x", /x/, function() { return 42; });
+replaceTest("string 42", "string x", /[xy]/g, function() { return 42; });
+replaceTest("string 42", "string x", /[xy]/, function() { return 42; });
+replaceTest("string true", "string x", /x/g, function() { return true; });
+replaceTest("string null", "string x", /x/g, function() { return null; });
+replaceTest("string undefined", "string x", /x/g, function() { return undefined; });
+
+replaceTest("aundefinedbundefinedcundefined",
+            "abc", /(.)|(.)/g, function(m, m1, m2, i, s) { return m1+m2; });
+
+// Test nested calls to replace, including that it sets RegExp.$& correctly.
+
+function replacer(m,i,s) {
+  assertEquals(m,RegExp['$&']);
+  return "[" + RegExp['$&'] + "-"
+             + m.replace(/./g,"$&$&") + "-"
+             + m.replace(/./g,function() { return RegExp['$&']; })
+             + "-" + RegExp['$&'] + "]";
+}
+
+replaceTest("[ab-aabb-ab-b][az-aazz-az-z]",
+            "abaz", /a./g, replacer);
+
+replaceTest("[ab-aabb-ab-b][az-aazz-az-z]",
+            "abaz", /a(.)/g, replacer);
diff --git a/test/mjsunit/string-search.js b/test/mjsunit/string-search.js
index 36891c2..4de17bc 100644
--- a/test/mjsunit/string-search.js
+++ b/test/mjsunit/string-search.js
@@ -28,3 +28,13 @@
 var str="ABC abc";
 var r = str.search('a');
 assertEquals(r, 4);
+
+// Test for a lot of different string.
+
+var s = "";
+for (var i = 0; i < 100; i++) {
+  s += i;
+  var r = s.search(s);
+  assertEquals(0, r);
+}
+
diff --git a/test/mjsunit/string-split-cache.js b/test/mjsunit/string-split-cache.js
new file mode 100644
index 0000000..37c550f
--- /dev/null
+++ b/test/mjsunit/string-split-cache.js
@@ -0,0 +1,40 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+var str = "abcdef";
+
+// Get a prefix of the string into the one-char string cache.
+assertEquals("a", str[0]);
+assertEquals("b", str[1]);
+assertEquals("c", str[2]);
+
+// Splitting by "" calls runtime StringToArray function that uses the
+// cache. So this test hits a case where only a prefix is cached.
+var array = str.split("");
+var expected = ["a", "b", "c", "d", "e", "f"];
+assertArrayEquals(expected, array);
diff --git a/test/mjsunit/undeletable-functions.js b/test/mjsunit/undeletable-functions.js
index 86a7426..04fd060 100644
--- a/test/mjsunit/undeletable-functions.js
+++ b/test/mjsunit/undeletable-functions.js
@@ -39,6 +39,13 @@
   "every", "map", "indexOf", "lastIndexOf", "reduce", "reduceRight"];
 CheckJSCSemantics(Array.prototype, array, "Array prototype");
 
+var old_Array_prototype = Array.prototype;
+var new_Array_prototype = {};
+for (var i = 0; i < 7; i++) {
+  Array.prototype = new_Array_prototype;
+  assertEquals(old_Array_prototype, Array.prototype);
+}
+
 array = [
   "toString", "toDateString", "toTimeString", "toLocaleString",
   "toLocaleDateString", "toLocaleTimeString", "valueOf", "getTime",
@@ -79,6 +86,13 @@
   "__lookupGetter__", "__defineSetter__", "__lookupSetter__"];
 CheckEcmaSemantics(Object.prototype, array, "Object prototype");
 
+var old_Object_prototype = Object.prototype;
+var new_Object_prototype = {};
+for (var i = 0; i < 7; i++) {
+  Object.prototype = new_Object_prototype;
+  assertEquals(old_Object_prototype, Object.prototype);
+}
+
 array = [
   "toString", "valueOf", "toJSON"];
 CheckEcmaSemantics(Boolean.prototype, array, "Boolean prototype");
diff --git a/test/mjsunit/unusual-constructor.js b/test/mjsunit/unusual-constructor.js
index 4e1ec2e..82b9bd6 100644
--- a/test/mjsunit/unusual-constructor.js
+++ b/test/mjsunit/unusual-constructor.js
@@ -25,12 +25,9 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-var obj = new (Function.__proto__)();
-
-
 var threw = false;
 try {
-  obj.toString();
+  var obj = new (Function.__proto__)();
 } catch (e) {
   assertInstanceof(e, TypeError);
   threw = true;