Merge V8 at r7668: Initial merge by Git.

Change-Id: I1703c8b4f5c63052451a22cf3fb878abc9a0ec75
diff --git a/test/mjsunit/regress/regress-1166.js b/test/mjsunit/regress/regress-1166.js
index d75d397..8278aba 100644
--- a/test/mjsunit/regress/regress-1166.js
+++ b/test/mjsunit/regress/regress-1166.js
@@ -25,11 +25,16 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 // Deoptimization after a short-circuit logical operation in an effect
 // context should not see the value of the expression.
 function observe(x, y) { return x; }
 
 function test(x) { return observe(1, ((false || false), x + 1)); }
 
-for (var i = 0; i < 10000000; ++i) test(0);
+for (var i = 0; i < 5; ++i) test(0);
+%OptimizeFunctionOnNextCall(test);
+test(0);
+
 test("a");