Merge V8 at r7668: Initial merge by Git.

Change-Id: I1703c8b4f5c63052451a22cf3fb878abc9a0ec75
diff --git a/test/mjsunit/regress/regress-1079.js b/test/mjsunit/regress/regress-1079.js
index f3f3ce5..208dc5b 100644
--- a/test/mjsunit/regress/regress-1079.js
+++ b/test/mjsunit/regress/regress-1079.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 // Getting the arguments property of an optimized function should not crash,
 // even if called through our optimized version of Function.prototype.apply.
 
@@ -39,7 +41,8 @@
   }
 }
 
-for (var i = 0; i < 100000; ++i) {
+for (var i = 0; i < 5; ++i) {
   assertEquals(3, optimized(1, 2, 3).length);
 }
-
+%OptimizeFunctionOnNextCall(optimized);
+assertEquals(3, optimized(1, 2, 3).length);