Merge V8 at r7668: Initial merge by Git.

Change-Id: I1703c8b4f5c63052451a22cf3fb878abc9a0ec75
diff --git a/test/mjsunit/regress/regress-962.js b/test/mjsunit/regress/regress-962.js
index f9f46e1..85ada0c 100644
--- a/test/mjsunit/regress/regress-962.js
+++ b/test/mjsunit/regress/regress-962.js
@@ -25,6 +25,8 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
+// Flags: --allow-natives-syntax
+
 function L(scope) { this.s = new Object(); }
 
 L.prototype.c = function() { return true; }
@@ -50,4 +52,6 @@
 
 var ctx = new F;
 
-for (var i = 0; i < 10000; i++) ctx.foo();
+for (var i = 0; i < 5; i++) ctx.foo();
+%OptimizeFunctionOnNextCall(F.prototype.foo);
+ctx.foo();