Merge V8 at r7668: Initial merge by Git.

Change-Id: I1703c8b4f5c63052451a22cf3fb878abc9a0ec75
diff --git a/test/mjsunit/compiler/property-refs.js b/test/mjsunit/compiler/property-refs.js
index 3f6f793..6f1f19f 100644
--- a/test/mjsunit/compiler/property-refs.js
+++ b/test/mjsunit/compiler/property-refs.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 function Load(o) {
   return o.outer.x | o.outer.inner.y;
 }
@@ -45,7 +47,9 @@
   return Load(object);
 }
 
-for (var i = 0; i < 10000; i++) LoadXY(i, i);
+for (var i = 0; i < 5; i++) LoadXY(i, i);
+%OptimizeFunctionOnNextCall(LoadXY);
+LoadXY(6, 6);
 assertEquals(42 | 87, LoadXY(42, 87));
 assertEquals(42 | 87, LoadXY(42, 87));
 assertEquals(42 | 99, LoadXY(42, "99"));