Upgrade to 3.29
Update V8 to 3.29.88.17 and update makefiles to support building on
all the relevant platforms.
Bug: 17370214
Change-Id: Ia3407c157fd8d72a93e23d8318ccaf6ecf77fa4e
diff --git a/test/mjsunit/regress/binop-in-effect-context-deopt.js b/test/mjsunit/regress/binop-in-effect-context-deopt.js
new file mode 100644
index 0000000..fb7280a
--- /dev/null
+++ b/test/mjsunit/regress/binop-in-effect-context-deopt.js
@@ -0,0 +1,65 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function BinopInEffectContextDeoptAndOsr() {
+ function f(a, deopt, osr) {
+ var result = (a + 10, "result");
+ var dummy = deopt + 0;
+ if (osr) while (%GetOptimizationStatus(f) == 2) {}
+ return result;
+ }
+
+ assertEquals("result", f(true, 3, false));
+ assertEquals("result", f(true, 3, false));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("result", f(true, "foo", true));
+})();
+
+
+(function BinopInEffectContextLazyDeopt() {
+ function deopt_f() {
+ %DeoptimizeFunction(f);
+ return "dummy";
+ }
+
+ function h() {
+ return { toString : deopt_f };
+ }
+
+ function g(x) {
+ }
+
+ function f() {
+ return g(void(h() + ""));
+ };
+
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
diff --git a/test/mjsunit/regress/call-function-in-effect-context-deopt.js b/test/mjsunit/regress/call-function-in-effect-context-deopt.js
new file mode 100644
index 0000000..9a36c14
--- /dev/null
+++ b/test/mjsunit/regress/call-function-in-effect-context-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(deopt, osr) {
+ var result = "result";
+ %_CallFunction(0, 0, function() {});
+ var dummy = deopt + 0;
+ if (osr) while (%GetOptimizationStatus(f) == 2) {}
+ return result;
+}
+
+assertEquals("result", f(3, false));
+assertEquals("result", f(3, false));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result", f("foo", true));
diff --git a/test/mjsunit/regress/clear-keyed-call.js b/test/mjsunit/regress/clear-keyed-call.js
new file mode 100644
index 0000000..6870f60
--- /dev/null
+++ b/test/mjsunit/regress/clear-keyed-call.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function f(a) {
+ a[0](1);
+}
+
+f([function(a) { return a; }]);
+f([function(a) { return a; }]);
+f([function(a) { return a; }]);
+%NotifyContextDisposed();
+gc();
+gc();
+gc();
diff --git a/test/mjsunit/regress/compare-map-elim1.js b/test/mjsunit/regress/compare-map-elim1.js
new file mode 100644
index 0000000..c7ea05d
--- /dev/null
+++ b/test/mjsunit/regress/compare-map-elim1.js
@@ -0,0 +1,57 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --check-elimination
+
+
+function foo(o) {
+ return o.foo1;
+}
+
+function getter() {
+ return this.x + this.z + foo2(this);
+}
+
+function foo2(o) {
+ return o.a;
+}
+
+var o1 = {z:0, x:1};
+var o2 = {z:0, a:1.5, x:1};
+var o3 = {z:0, a:1.5};
+Object.defineProperty(o1, "foo1", {get:getter});
+Object.defineProperty(o2, "foo1", {get:getter});
+
+foo(o1);
+foo(o1);
+foo(o2);
+%ClearFunctionTypeFeedback(foo2);
+foo2(o2);
+foo2(o2);
+foo2(o3);
+%OptimizeFunctionOnNextCall(foo);
+foo(o1);
diff --git a/test/mjsunit/regress/comparison-in-effect-context-deopt.js b/test/mjsunit/regress/comparison-in-effect-context-deopt.js
new file mode 100644
index 0000000..b28dff7
--- /dev/null
+++ b/test/mjsunit/regress/comparison-in-effect-context-deopt.js
@@ -0,0 +1,47 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function lazyDeopt() {
+ %DeoptimizeFunction(test);
+ return "deopt";
+}
+
+var x = { toString : lazyDeopt };
+
+function g(x) {
+ return "result";
+}
+
+function test(x) {
+ return g(void(x == ""));
+}
+
+test(x);
+%OptimizeFunctionOnNextCall(test);
+assertEquals("result", test(x));
diff --git a/test/mjsunit/regress/consolidated-holey-load.js b/test/mjsunit/regress/consolidated-holey-load.js
new file mode 100644
index 0000000..ef8f1ef
--- /dev/null
+++ b/test/mjsunit/regress/consolidated-holey-load.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(array) {
+ return array[0];
+}
+
+var a = [1, 2, , 4]; // Holey Smi elements.
+var b = ["abcd", 0]; // Fast elements.
+foo(b); // Observe fast elements first, or the IC will transition without
+foo(a); // going polymorphic.
+%OptimizeFunctionOnNextCall(foo);
+var c = [, 0];
+assertEquals(undefined, foo(c)); // Elided hole check will leak the hole.
diff --git a/test/mjsunit/regress/d8-readbuffer.js b/test/mjsunit/regress/d8-readbuffer.js
new file mode 100644
index 0000000..8aec02d
--- /dev/null
+++ b/test/mjsunit/regress/d8-readbuffer.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that reading a file actually returns the file's contents.
+
+// Env: TEST_FILE_NAME
+assertEquals("string", typeof TEST_FILE_NAME);
+
+var a = new Uint8Array(readbuffer(TEST_FILE_NAME));
+
+// First line of this file.
+var expected = "// Copyright 2014 the V8 project authors. All rights reserved.";
+
+for (var i = 0; i < expected.length; i++) {
+ assertEquals(expected.charCodeAt(i), a[i]);
+}
diff --git a/test/mjsunit/regress/debug-prepare-step-in.js b/test/mjsunit/regress/debug-prepare-step-in.js
new file mode 100644
index 0000000..60b47f7
--- /dev/null
+++ b/test/mjsunit/regress/debug-prepare-step-in.js
@@ -0,0 +1,56 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax --expose-gc
+// Get the Debug object exposed from the debug context global object.
+Debug = debug.Debug
+
+function breakListener(event, exec_state, event_data, data) {
+ exec_state.prepareStep(Debug.StepAction.StepIn, 1);
+}
+
+Debug.setListener(breakListener);
+
+var o = {x:function() { return 10; }};
+
+function f(o) {
+ var m = "x";
+ o[m]();
+}
+
+Debug.setBreakPoint(f, 2, 0);
+
+f(o);
+
+%NotifyContextDisposed();
+function g() {
+ gc();
+}
+
+g();
+
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/external-and-normal-array-polymorphism.js b/test/mjsunit/regress/external-and-normal-array-polymorphism.js
new file mode 100644
index 0000000..0ac1545
--- /dev/null
+++ b/test/mjsunit/regress/external-and-normal-array-polymorphism.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function store_generator(compare) {
+ return function(a,i,v) {
+ a[i] = v;
+ assertEquals(compare, a[i]);
+ assertEquals(compare, a[i]);
+ }
+}
+
+f = store_generator(5);
+a = [0,0,0];
+f(a,0,5);
+a = [0,0,0];
+f(a,1,5);
+a = [0,0,0];
+f(a,2,5);
+
+f = store_generator(5.5);
+a = new Float32Array(5);
+f(a,0,5.5);
+f(a,1,5.5);
+f(a,2,5.5);
diff --git a/test/mjsunit/regress/internalized-string-not-equal.js b/test/mjsunit/regress/internalized-string-not-equal.js
new file mode 100644
index 0000000..911279b
--- /dev/null
+++ b/test/mjsunit/regress/internalized-string-not-equal.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// A bug in r15773, when masks for internalized string and string types
+// were reorganized.
+function equal(o1, o2) {
+ return (o1 == o2);
+}
+var a = "abc";
+var b = "abc";
+equal(a, b);
+equal(a, b);
+%OptimizeFunctionOnNextCall(equal);
+assertTrue(equal(1.3, 1.3));
diff --git a/test/mjsunit/regress/json-stringifier-emptyhandle.js b/test/mjsunit/regress/json-stringifier-emptyhandle.js
new file mode 100644
index 0000000..970b0b8
--- /dev/null
+++ b/test/mjsunit/regress/json-stringifier-emptyhandle.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function explode() {
+ var array = [1,2,3];
+
+ Object.defineProperty(array, 4, {
+ get: function () { throw "dynamite"; },
+ });
+
+ JSON.stringify(array);
+}
+
+try {
+ explode();
+ assertUnreachable();
+} catch(e) {
+ assertEquals("dynamite", e);
+}
diff --git a/test/mjsunit/regress/negative_lookup.js b/test/mjsunit/regress/negative_lookup.js
new file mode 100644
index 0000000..e23e365
--- /dev/null
+++ b/test/mjsunit/regress/negative_lookup.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var p = {};
+
+// Make p the last prototype in the chain.
+p.__proto__ = null;
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make y go to slow mode.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Do something with x in slow-mode p.
+Object.defineProperty(p, "x", { writable: false, value: 5 });
+
+// Verify that directly setting x fails.
+o3.x = 10;
+assertEquals(5, o3.x);
+
+// Verify that setting x through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
diff --git a/test/mjsunit/regress/number-named-call-deopt.js b/test/mjsunit/regress/number-named-call-deopt.js
new file mode 100644
index 0000000..1598af1
--- /dev/null
+++ b/test/mjsunit/regress/number-named-call-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(x, deopt, osr) {
+ var res = "result";
+ void(x.toString(10, deopt + 0));
+ if (osr) for (var i = 0; i < 100000; i++) { }
+ return res;
+}
+
+f(4, 0, false);
+f(4, 0, false);
+f(4, 0, false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result", f(4, "deopt", true));
diff --git a/test/mjsunit/regress/poly_count_operation.js b/test/mjsunit/regress/poly_count_operation.js
new file mode 100644
index 0000000..99f041b
--- /dev/null
+++ b/test/mjsunit/regress/poly_count_operation.js
@@ -0,0 +1,155 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --turbo-deoptimization
+
+var o1 = {x:1};
+var o2 = {};
+var deopt_getter = false;
+var deopt_setter = false;
+
+function f_mono(o) {
+ return 5 + o.x++;
+}
+
+var to_deopt = f_mono;
+
+var v = 1;
+var g = 0;
+var s = 0;
+
+Object.defineProperty(o2, "x",
+ {get:function() {
+ g++;
+ if (deopt_getter) {
+ deopt_getter = false;
+ %DeoptimizeFunction(to_deopt);
+ }
+ return v;
+ },
+ set:function(new_v) {
+ v = new_v;
+ s++;
+ if (deopt_setter) {
+ deopt_setter = false;
+ %DeoptimizeFunction(to_deopt);
+ }
+ }});
+
+assertEquals(6, f_mono(o2));
+assertEquals(1, g);
+assertEquals(1, s);
+assertEquals(7, f_mono(o2));
+assertEquals(2, g);
+assertEquals(2, s);
+%OptimizeFunctionOnNextCall(f_mono);
+deopt_setter = true;
+assertEquals(8, f_mono(o2));
+assertEquals(3, g);
+assertEquals(3, s);
+
+function f_poly(o) {
+ return 5 + o.x++;
+}
+
+v = 1;
+to_deopt = f_poly;
+
+f_poly(o1);
+f_poly(o1);
+assertEquals(6, f_poly(o2));
+assertEquals(4, g);
+assertEquals(4, s);
+assertEquals(7, f_poly(o2));
+assertEquals(5, g);
+assertEquals(5, s);
+%OptimizeFunctionOnNextCall(f_poly);
+deopt_setter = true;
+assertEquals(8, f_poly(o2));
+assertEquals(6, g);
+assertEquals(6, s);
+
+%OptimizeFunctionOnNextCall(f_poly);
+v = undefined;
+assertEquals(NaN, f_poly(o2));
+assertEquals(7, g);
+assertEquals(7, s);
+
+function f_pre(o) {
+ return 5 + ++o.x;
+}
+
+v = 1;
+to_deopt = f_pre;
+
+f_pre(o1);
+f_pre(o1);
+assertEquals(7, f_pre(o2));
+assertEquals(8, g);
+assertEquals(8, s);
+assertEquals(8, f_pre(o2));
+assertEquals(9, g);
+assertEquals(9, s);
+%OptimizeFunctionOnNextCall(f_pre);
+deopt_setter = true;
+assertEquals(9, f_pre(o2));
+assertEquals(10, g);
+assertEquals(10, s);
+
+%OptimizeFunctionOnNextCall(f_pre);
+v = undefined;
+assertEquals(NaN, f_pre(o2));
+assertEquals(11, g);
+assertEquals(11, s);
+
+
+function f_get(o) {
+ return 5 + o.x++;
+}
+
+v = 1;
+to_deopt = f_get;
+
+f_get(o1);
+f_get(o1);
+assertEquals(6, f_get(o2));
+assertEquals(12, g);
+assertEquals(12, s);
+assertEquals(7, f_get(o2));
+assertEquals(13, g);
+assertEquals(13, s);
+%OptimizeFunctionOnNextCall(f_get);
+deopt_getter = true;
+assertEquals(8, f_get(o2));
+assertEquals(14, g);
+assertEquals(14, s);
+
+%OptimizeFunctionOnNextCall(f_get);
+v = undefined;
+assertEquals(NaN, f_get(o2));
+assertEquals(15, g);
+assertEquals(15, s);
diff --git a/test/mjsunit/regress/polymorphic-accessor-test-context.js b/test/mjsunit/regress/polymorphic-accessor-test-context.js
new file mode 100644
index 0000000..6188279
--- /dev/null
+++ b/test/mjsunit/regress/polymorphic-accessor-test-context.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function t1() { return this instanceof t1; }
+function t2() { return this instanceof t2; }
+
+var o1 = new (function() { })();
+Object.defineProperty(o1, "t", {get:function() { return this instanceof o1.constructor; }});
+var o2 = new (function() { })();
+Object.defineProperty(o2, "t", {get:function() { return this instanceof o1.constructor; }});
+var o3 = new (function() { })();
+o3.t = true;
+
+function f(o) {
+ return 1 + (o.t ? 1 : 2);
+}
+
+f(o1);
+f(o1);
+f(o2);
+%OptimizeFunctionOnNextCall(f);
+f(o3);
diff --git a/test/mjsunit/regress/post-increment-close-context.js b/test/mjsunit/regress/post-increment-close-context.js
new file mode 100644
index 0000000..08ade10
--- /dev/null
+++ b/test/mjsunit/regress/post-increment-close-context.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var foo = {bar: -2};
+function crash() {
+ return !(foo.bar++);
+}
+assertFalse(crash());
+assertEquals(-1, foo.bar);
+%OptimizeFunctionOnNextCall(crash);
+assertFalse(crash());
+assertEquals(0, foo.bar);
+assertTrue(crash());
+assertEquals(1, foo.bar);
+assertFalse(crash());
+assertEquals(2, foo.bar);
diff --git a/test/mjsunit/regress/readonly1.js b/test/mjsunit/regress/readonly1.js
new file mode 100644
index 0000000..366f432
--- /dev/null
+++ b/test/mjsunit/regress/readonly1.js
@@ -0,0 +1,71 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+ v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+
+// Make p go slow.
+// Do this after using p as prototype, since using an object as prototype kicks
+// it back into fast mode.
+p.y = 1;
+delete p.y;
+p.x = 5;
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1);
+s_strict(o2);
+
+// Make x non-writable.
+Object.defineProperty(p, "x", { writable: false });
+
+// Verify that direct setting fails.
+o3.x = 20;
+assertEquals(5, o3.x);
+
+// Verify that setting through the IC fails.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);
diff --git a/test/mjsunit/regress/readonly2.js b/test/mjsunit/regress/readonly2.js
new file mode 100644
index 0000000..4e53925
--- /dev/null
+++ b/test/mjsunit/regress/readonly2.js
@@ -0,0 +1,62 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.defineProperty(this, "x", { writable:true });
+
+function s(v) {
+ v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+// Make x non-writable.
+Object.defineProperty(this, "x", { writable:false, value:5 });
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);
diff --git a/test/mjsunit/regress/readonly3.js b/test/mjsunit/regress/readonly3.js
new file mode 100644
index 0000000..f81979d
--- /dev/null
+++ b/test/mjsunit/regress/readonly3.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.x = 0;
+
+var p = {};
+Object.defineProperty(p, "x", {writable:false, value:5});
+this.__proto__ = p;
+
+function s(v) {
+ v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var o1 = c(this);
+var o2 = c(this);
+
+// Initialize the store IC.
+s(c(this));
+s(c(this));
+s_strict(c(this));
+s_strict(c(this));
+
+delete this.x;
+
+// Verify that direct setting fails.
+o1.x = 20;
+assertEquals(5, o1.x);
+
+// Verify that setting through the IC fails.
+s(o2);
+assertEquals(5, o2.x);
+assertThrows("s_strict(o2);", TypeError);
diff --git a/test/mjsunit/regress/readonly4.js b/test/mjsunit/regress/readonly4.js
new file mode 100644
index 0000000..b2fde29
--- /dev/null
+++ b/test/mjsunit/regress/readonly4.js
@@ -0,0 +1,74 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var slow = {};
+var p = {};
+
+slow.__proto__ = p;
+slow.x = 10;
+slow.y = 10;
+Object.defineProperty(p, "x", {writable:false, value:5});
+
+function c(p) {
+ return {__proto__: p};
+}
+
+function s(v) {
+ return v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ v.x = 1;
+}
+
+var o1 = c(slow);
+var o2 = c(slow);
+var o1_strict = c(slow);
+var o2_strict = c(slow);
+var o3 = c(slow);
+var o4 = c(slow);
+
+// Make s slow.
+// Do this after using slow as prototype, since using an object as prototype
+// kicks it back into fast mode.
+delete slow.y;
+
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+delete slow.x;
+// Directly setting x should fail.
+o3.x = 20
+assertEquals(5, o3.x);
+
+// Setting x through IC should fail.
+s(o4);
+assertEquals(5, o4.x);
+assertThrows("s_strict(o4);", TypeError);
diff --git a/test/mjsunit/regress/readonly5.js b/test/mjsunit/regress/readonly5.js
new file mode 100644
index 0000000..b1499dd
--- /dev/null
+++ b/test/mjsunit/regress/readonly5.js
@@ -0,0 +1,68 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+this.__proto__ = null;
+this.x = 10;
+delete this.x;
+
+function s(v) {
+ return v.x = 1;
+}
+
+function s_strict(v) {
+ "use strict";
+ return v.x = 1;
+}
+
+function c() {
+ var o = {__proto__:this};
+ return o;
+}
+
+var o1 = c();
+var o2 = c();
+var o1_strict = c();
+var o2_strict = c();
+var o3 = c();
+var o4 = c();
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+s_strict(o1_strict);
+s_strict(o2_strict);
+
+Object.defineProperty(this, "x", {writable:false, configurable:true});
+
+// Verify that directly setting x fails.
+o3.x = 1;
+assertEquals(undefined, o3.x);
+
+// Verify that setting x through the IC fails.
+assertThrows("s_strict(o4)", TypeError);
+s(o4);
+assertEquals(undefined, o4.x);
diff --git a/test/mjsunit/regress/regress-1017.js b/test/mjsunit/regress/regress-1017.js
index 3daf542..440449a 100644
--- a/test/mjsunit/regress/regress-1017.js
+++ b/test/mjsunit/regress/regress-1017.js
@@ -33,4 +33,3 @@
// to store the 33rd character. This fails an ASSERT in debug mode.
assertEquals(33, "12345678901234567890123456789012\u2028".length);
-
diff --git a/test/mjsunit/regress/regress-1039610.js b/test/mjsunit/regress/regress-1039610.js
index fd5c549..757801f 100644
--- a/test/mjsunit/regress/regress-1039610.js
+++ b/test/mjsunit/regress/regress-1039610.js
@@ -26,4 +26,4 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Make sure that the Debug object does not return to the global object
-assertTrue(typeof(Debug) === 'undefined');
\ No newline at end of file
+assertTrue(typeof(Debug) === 'undefined');
diff --git a/test/mjsunit/regress/regress-105.js b/test/mjsunit/regress/regress-105.js
new file mode 100644
index 0000000..8b8030f
--- /dev/null
+++ b/test/mjsunit/regress/regress-105.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var custom_valueOf = function() {
+ assertEquals(Number, custom_valueOf.caller);
+ return 2;
+}
+
+var custom_toString = function() {
+ assertEquals(String, custom_toString.caller);
+ return "I used to be an adventurer like you";
+}
+
+var object = {};
+object.valueOf = custom_valueOf;
+object.toString = custom_toString;
+
+assertEquals(2, Number(object));
+assertEquals('I', String(object)[0]);
diff --git a/test/mjsunit/regress/regress-1066899.js b/test/mjsunit/regress/regress-1066899.js
index 37fd554..5840f26 100644
--- a/test/mjsunit/regress/regress-1066899.js
+++ b/test/mjsunit/regress/regress-1066899.js
@@ -34,4 +34,3 @@
}
Crash();
-
diff --git a/test/mjsunit/regress/regress-1092.js b/test/mjsunit/regress/regress-1092.js
index 00422cb..24efb37 100644
--- a/test/mjsunit/regress/regress-1092.js
+++ b/test/mjsunit/regress/regress-1092.js
@@ -32,4 +32,3 @@
this.x = 1;
this.y = 2;
this.z = 3;
-
diff --git a/test/mjsunit/regress/regress-1099.js b/test/mjsunit/regress/regress-1099.js
index 36f09e4..49e4a52 100644
--- a/test/mjsunit/regress/regress-1099.js
+++ b/test/mjsunit/regress/regress-1099.js
@@ -48,4 +48,4 @@
}
%OptimizeFunctionOnNextCall(y);
-assertTrue(y("foo"));
\ No newline at end of file
+assertTrue(y("foo"));
diff --git a/test/mjsunit/regress/regress-1112.js b/test/mjsunit/regress/regress-1112.js
index d780106..41c9193 100644
--- a/test/mjsunit/regress/regress-1112.js
+++ b/test/mjsunit/regress/regress-1112.js
@@ -33,4 +33,3 @@
{ configurable: true, enumerable: true, value: 3 });
assertEquals(3, this[1]);
assertTrue(this.hasOwnProperty("1"));
-
diff --git a/test/mjsunit/regress/regress-1114040.js b/test/mjsunit/regress/regress-1114040.js
index 9d1b320..ef7ee31 100644
--- a/test/mjsunit/regress/regress-1114040.js
+++ b/test/mjsunit/regress/regress-1114040.js
@@ -55,4 +55,3 @@
assertEquals("01", TestBreak());
assertEquals("01", TestContinue());
-
diff --git a/test/mjsunit/regress/regress-1117.js b/test/mjsunit/regress/regress-1117.js
index b013a22..664dadd 100644
--- a/test/mjsunit/regress/regress-1117.js
+++ b/test/mjsunit/regress/regress-1117.js
@@ -25,11 +25,19 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
// Test that we actually return the right value (-0) when we multiply
// constant 0 with a negative integer.
function foo(y) {return 0 * y; }
-for( var i = 0; i< 1000000; i++){
- foo(42);
-}
assertEquals(1/foo(-42), -Infinity);
+assertEquals(1/foo(-42), -Infinity);
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1/foo(-42), -Infinity);
+
+function bar(x) { return x * 0; }
+assertEquals(Infinity, 1/bar(5));
+assertEquals(Infinity, 1/bar(5));
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(-Infinity, 1/bar(-5));
diff --git a/test/mjsunit/regress/regress-1118.js b/test/mjsunit/regress/regress-1118.js
index 7e0461d..4fd2345 100644
--- a/test/mjsunit/regress/regress-1118.js
+++ b/test/mjsunit/regress/regress-1118.js
@@ -52,8 +52,10 @@
g();
} else {
// Run for a bit as long as h is unoptimized.
- while (%GetOptimizationStatus(h) == 2) {
- for (var j = 0; j < 100; j++) g();
+ if (%GetOptimizationStatus(h) != 4) {
+ while (%GetOptimizationCount(h) == 0) {
+ for (var j = 0; j < 100; j++) g();
+ }
}
g();
}
diff --git a/test/mjsunit/regress/regress-1119.js b/test/mjsunit/regress/regress-1119.js
index 16b2e4f..5fd8f36 100644
--- a/test/mjsunit/regress/regress-1119.js
+++ b/test/mjsunit/regress/regress-1119.js
@@ -28,17 +28,19 @@
// Test runtime declaration of properties with var which are intercepted
// by JS accessors.
-__proto__.__defineSetter__("x", function() { hasBeenInvoked = true; });
-__proto__.__defineSetter__("y", function() { throw 'exception'; });
+// Flags: --es52_globals
+
+this.__defineSetter__("x", function() { hasBeenInvoked = true; });
+this.__defineSetter__("y", function() { throw 'exception'; });
var hasBeenInvoked = false;
eval("try { } catch (e) { var x = false; }");
assertTrue(hasBeenInvoked);
-var exception;
+// This has to run in global scope, so cannot use assertThrows...
try {
eval("try { } catch (e) { var y = false; }");
+ assertUnreachable();
} catch (e) {
- exception = e;
+ assertEquals('exception', e);
}
-assertEquals('exception', exception);
diff --git a/test/mjsunit/regress/regress-1122.js b/test/mjsunit/regress/regress-1122.js
index 815511d..8f0bfb6 100644
--- a/test/mjsunit/regress/regress-1122.js
+++ b/test/mjsunit/regress/regress-1122.js
@@ -62,7 +62,5 @@
assertEquals('prefix undefined suffix',
function_with_n_params_and_m_args(32000, 10000));
-assertThrows("function_with_n_params_and_m_args(35000, 35000)");
-assertThrows("function_with_n_params_and_m_args(100000, 100000)");
-assertThrows("function_with_n_params_and_m_args(35000, 30000)");
-assertThrows("function_with_n_params_and_m_args(30000, 35000)");
+assertThrows("function_with_n_params_and_m_args(66000, 30000)");
+assertThrows("function_with_n_params_and_m_args(30000, 66000)");
diff --git a/test/mjsunit/regress/regress-115100.js b/test/mjsunit/regress/regress-115100.js
new file mode 100644
index 0000000..c917446
--- /dev/null
+++ b/test/mjsunit/regress/regress-115100.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(obj) { obj.prop = 0; }
+function mk() { return Object.create(null); }
+
+foo(mk());
+foo(mk());
+%OptimizeFunctionOnNextCall(foo);
+foo(mk());
diff --git a/test/mjsunit/regress/regress-115452.js b/test/mjsunit/regress/regress-115452.js
index 7e424ed..dc71158 100644
--- a/test/mjsunit/regress/regress-115452.js
+++ b/test/mjsunit/regress/regress-115452.js
@@ -27,22 +27,21 @@
// Test that a function declaration cannot overwrite a read-only property.
-print(0)
+// Flags: --es52_globals
+
function foobl() {}
assertTrue(typeof this.foobl == "function");
assertTrue(Object.getOwnPropertyDescriptor(this, "foobl").writable);
-print(1)
Object.defineProperty(this, "foobl", {value: 1, writable: false});
assertSame(1, this.foobl);
assertFalse(Object.getOwnPropertyDescriptor(this, "foobl").writable);
-print(2)
-eval("function foobl() {}");
+// This has to run in global scope, so cannot use assertThrows...
+try {
+ eval("function foobl() {}"); // Should throw.
+ assertUnreachable();
+} catch (e) {
+ assertInstanceof(e, TypeError);
+}
assertSame(1, this.foobl);
-assertFalse(Object.getOwnPropertyDescriptor(this, "foobl").writable);
-
-print(3)
-eval("function foobl() {}");
-assertSame(1, this.foobl);
-assertFalse(Object.getOwnPropertyDescriptor(this, "foobl").writable);
diff --git a/test/mjsunit/regress/regress-1170.js b/test/mjsunit/regress/regress-1170.js
index 66ed9f2..5d5800e 100644
--- a/test/mjsunit/regress/regress-1170.js
+++ b/test/mjsunit/regress/regress-1170.js
@@ -27,46 +27,69 @@
var setter_value = 0;
-__proto__.__defineSetter__("a", function(v) { setter_value = v; });
+this.__defineSetter__("a", function(v) { setter_value = v; });
eval("var a = 1");
assertEquals(1, setter_value);
-assertFalse(this.hasOwnProperty("a"));
+assertFalse("value" in Object.getOwnPropertyDescriptor(this, "a"));
eval("with({}) { eval('var a = 2') }");
+assertTrue("get" in Object.getOwnPropertyDescriptor(this, "a"));
+assertFalse("value" in Object.getOwnPropertyDescriptor(this, "a"));
assertEquals(2, setter_value);
-assertFalse(this.hasOwnProperty("a"));
// Function declarations are treated specially to match Safari. We do
// not call setters for them.
+this.__defineSetter__("a", function(v) { assertUnreachable(); });
eval("function a() {}");
-assertTrue(this.hasOwnProperty("a"));
+assertTrue("value" in Object.getOwnPropertyDescriptor(this, "a"));
-__proto__.__defineSetter__("b", function(v) { assertUnreachable(); });
-var exception = false;
+this.__defineSetter__("b", function(v) { setter_value = v; });
try {
- eval("const b = 23");
-} catch(e) {
- exception = true;
- assertTrue(/TypeError/.test(e));
-}
-assertFalse(exception);
+ eval("const b = 3");
+} catch(e) { }
+assertEquals(2, setter_value);
-exception = false;
try {
eval("with({}) { eval('const b = 23') }");
} catch(e) {
- exception = true;
- assertTrue(/TypeError/.test(e));
+ assertInstanceof(e, TypeError);
}
-assertTrue(exception);
-__proto__.__defineSetter__("c", function(v) { throw 42; });
-exception = false;
+this.__defineSetter__("c", function(v) { throw 42; });
try {
eval("var c = 1");
+ assertUnreachable();
} catch(e) {
- exception = true;
assertEquals(42, e);
- assertFalse(this.hasOwnProperty("c"));
+ assertFalse("value" in Object.getOwnPropertyDescriptor(this, "c"));
}
-assertTrue(exception);
+
+
+
+
+__proto__.__defineSetter__("aa", function(v) { assertUnreachable(); });
+eval("var aa = 1");
+assertTrue(this.hasOwnProperty("aa"));
+
+__proto__.__defineSetter__("bb", function(v) { assertUnreachable(); });
+eval("with({}) { eval('var bb = 2') }");
+assertTrue(this.hasOwnProperty("bb"));
+
+// Function declarations are treated specially to match Safari. We do
+// not call setters for them.
+__proto__.__defineSetter__("cc", function(v) { assertUnreachable(); });
+eval("function cc() {}");
+assertTrue(this.hasOwnProperty("cc"));
+
+__proto__.__defineSetter__("dd", function(v) { assertUnreachable(); });
+try {
+ eval("const dd = 23");
+} catch(e) {
+ assertUnreachable();
+}
+
+try {
+ eval("with({}) { eval('const dd = 23') }");
+} catch(e) {
+ assertInstanceof(e, TypeError);
+}
diff --git a/test/mjsunit/regress/regress-1170187.js b/test/mjsunit/regress/regress-1170187.js
index 5e82f8a..3621bc4 100644
--- a/test/mjsunit/regress/regress-1170187.js
+++ b/test/mjsunit/regress/regress-1170187.js
@@ -26,6 +26,8 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
// Make sure that the retreival of local variables are performed correctly even
// when an adapter frame is present.
diff --git a/test/mjsunit/regress/regress-117409.js b/test/mjsunit/regress/regress-117409.js
index 9222191..98aab5a 100644
--- a/test/mjsunit/regress/regress-117409.js
+++ b/test/mjsunit/regress/regress-117409.js
@@ -36,7 +36,7 @@
KeyedStoreIC(literal);
KeyedStoreIC(literal);
-// Trruncate array to 0 elements, at which point backing store will be replaced
+// Truncate array to 0 elements, at which point backing store will be replaced
// with empty fixed array.
literal.length = 0;
diff --git a/test/mjsunit/regress/regress-1178598.js b/test/mjsunit/regress/regress-1178598.js
index 9caaec2..135c596 100644
--- a/test/mjsunit/regress/regress-1178598.js
+++ b/test/mjsunit/regress/regress-1178598.js
@@ -86,5 +86,3 @@
})();
assertEquals(87, value);
-
-
diff --git a/test/mjsunit/regress/regress-1181.js b/test/mjsunit/regress/regress-1181.js
index d45a0be..d5b8ab1 100644
--- a/test/mjsunit/regress/regress-1181.js
+++ b/test/mjsunit/regress/regress-1181.js
@@ -51,4 +51,4 @@
check(150);
check(200);
-check(350);
\ No newline at end of file
+check(350);
diff --git a/test/mjsunit/regress/regress-119609.js b/test/mjsunit/regress/regress-119609.js
new file mode 100644
index 0000000..0c85063
--- /dev/null
+++ b/test/mjsunit/regress/regress-119609.js
@@ -0,0 +1,72 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
+Debug = debug.Debug;
+
+var exception = false;
+
+function listener(event, exec_state, event_data, data) {
+ try {
+ if (event == Debug.DebugEvent.Break) {
+ function lookup(name) {
+ return exec_state.frame(0).evaluate(name).value();
+ }
+
+ assertEquals(3, lookup("e"));
+ assertEquals(4, lookup("f"));
+ assertEquals(1, lookup("a"));
+
+ try {
+ assertEquals(2, lookup("b"));
+ } catch (e) {
+ assertEquals("ReferenceError: b is not defined", e.toString());
+ }
+ }
+ } catch (e) {
+ exception = e.toString() + e.stack;
+ }
+}
+
+Debug.setListener(listener);
+
+function f(a, b) {
+ var c = 3;
+ function d(e, f) {
+ var g = a;
+ var h = c;
+ debugger;
+ }
+
+ return d;
+}
+
+f(1, 2)(3, 4);
+
+assertFalse(exception);
diff --git a/test/mjsunit/regress/regress-1199637.js b/test/mjsunit/regress/regress-1199637.js
index 9c560a9..397aeb8 100644
--- a/test/mjsunit/regress/regress-1199637.js
+++ b/test/mjsunit/regress/regress-1199637.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax
+// Flags: --allow-natives-syntax --es52_globals
// Make sure that we can introduce global variables (using
// both var and const) that shadow even READ_ONLY variables
@@ -34,45 +34,43 @@
const READ_ONLY = 1;
// Use DeclareGlobal...
-%SetProperty(this.__proto__, "a", 1234, NONE);
+%AddNamedProperty(this.__proto__, "a", 1234, NONE);
assertEquals(1234, a);
eval("var a = 5678;");
assertEquals(5678, a);
-%SetProperty(this.__proto__, "b", 1234, NONE);
+%AddNamedProperty(this.__proto__, "b", 1234, NONE);
assertEquals(1234, b);
eval("const b = 5678;");
assertEquals(5678, b);
-%SetProperty(this.__proto__, "c", 1234, READ_ONLY);
+%AddNamedProperty(this.__proto__, "c", 1234, READ_ONLY);
assertEquals(1234, c);
eval("var c = 5678;");
assertEquals(5678, c);
-%SetProperty(this.__proto__, "d", 1234, READ_ONLY);
+%AddNamedProperty(this.__proto__, "d", 1234, READ_ONLY);
assertEquals(1234, d);
eval("const d = 5678;");
assertEquals(5678, d);
// Use DeclareContextSlot...
-%SetProperty(this.__proto__, "x", 1234, NONE);
+%AddNamedProperty(this.__proto__, "x", 1234, NONE);
assertEquals(1234, x);
eval("with({}) { var x = 5678; }");
assertEquals(5678, x);
-%SetProperty(this.__proto__, "y", 1234, NONE);
+%AddNamedProperty(this.__proto__, "y", 1234, NONE);
assertEquals(1234, y);
eval("with({}) { const y = 5678; }");
assertEquals(5678, y);
-%SetProperty(this.__proto__, "z", 1234, READ_ONLY);
+%AddNamedProperty(this.__proto__, "z", 1234, READ_ONLY);
assertEquals(1234, z);
eval("with({}) { var z = 5678; }");
assertEquals(5678, z);
-%SetProperty(this.__proto__, "w", 1234, READ_ONLY);
+%AddNamedProperty(this.__proto__, "w", 1234, READ_ONLY);
assertEquals(1234, w);
eval("with({}) { const w = 5678; }");
assertEquals(5678, w);
-
-
diff --git a/test/mjsunit/regress/regress-120099.js b/test/mjsunit/regress/regress-120099.js
new file mode 100644
index 0000000..3b06f4d
--- /dev/null
+++ b/test/mjsunit/regress/regress-120099.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+'use strict';
+
+var a = Object.create(Object.prototype);
+var b = Object.create(Object.prototype);
+assertFalse(a === b);
+
+Object.defineProperty(a, 'x', { value: 1 });
+assertTrue(a.x === 1);
+assertTrue(b.x === undefined);
+
+b.x = 2;
+assertTrue(a.x === 1);
+assertTrue(b.x === 2);
diff --git a/test/mjsunit/regress/regress-1213575.js b/test/mjsunit/regress/regress-1213575.js
index f3a11db..8c197bc 100644
--- a/test/mjsunit/regress/regress-1213575.js
+++ b/test/mjsunit/regress/regress-1213575.js
@@ -37,4 +37,4 @@
assertTrue(e instanceof TypeError);
caught = true;
}
-assertFalse(caught);
+assertTrue(caught);
diff --git a/test/mjsunit/regress/regress-121407.js b/test/mjsunit/regress/regress-121407.js
index 25033fb..4403708 100644
--- a/test/mjsunit/regress/regress-121407.js
+++ b/test/mjsunit/regress/regress-121407.js
@@ -37,4 +37,4 @@
a.length=2000;
for (var i = 0; i <= 256; i++) {
a[i] = new Object();
-}
\ No newline at end of file
+}
diff --git a/test/mjsunit/regress/regress-1217.js b/test/mjsunit/regress/regress-1217.js
index 6530549..e00d537 100644
--- a/test/mjsunit/regress/regress-1217.js
+++ b/test/mjsunit/regress/regress-1217.js
@@ -30,7 +30,7 @@
var proto = RegExp.prototype;
assertEquals("[object RegExp]", Object.prototype.toString.call(proto));
-assertEquals("", proto.source);
+assertEquals("(?:)", proto.source);
assertEquals(false, proto.global);
assertEquals(false, proto.multiline);
assertEquals(false, proto.ignoreCase);
diff --git a/test/mjsunit/regress/regress-123512.js b/test/mjsunit/regress/regress-123512.js
new file mode 100644
index 0000000..8a747bc
--- /dev/null
+++ b/test/mjsunit/regress/regress-123512.js
@@ -0,0 +1,78 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that boilerplate objects for array literals with non-constant
+// elements (which will contain the hole at non-constant positions) will
+// not cause prototype chain lookups when generating optimized code.
+
+function f(x) {
+ return [x][0];
+}
+
+// Test data element on prototype.
+Object.prototype[0] = 23;
+assertSame(1, f(1));
+assertSame(2, f(2));
+%OptimizeFunctionOnNextCall(f);
+assertSame(3, f(3));
+%DeoptimizeFunction(f);
+
+// Test accessor element on prototype.
+Object.prototype.__defineGetter__(0, function() { throw Error(); });
+assertSame(4, f(4));
+assertSame(5, f(5));
+%OptimizeFunctionOnNextCall(f);
+assertSame(6, f(6));
+%DeoptimizeFunction(f);
+
+// Test the same on boilerplate objects for object literals that contain
+// both non-constant properties and non-constant elements.
+
+function g(x, y) {
+ var o = { foo:x, 0:y };
+ return o.foo + o[0];
+}
+
+// Test data property and element on prototype.
+Object.prototype[0] = 23;
+Object.prototype.foo = 42;
+assertSame(3, g(1, 2));
+assertSame(5, g(2, 3));
+%OptimizeFunctionOnNextCall(g);
+assertSame(7, g(3, 4));
+%DeoptimizeFunction(g);
+
+// Test accessor property and element on prototype.
+Object.prototype.__defineGetter__(0, function() { throw Error(); });
+Object.prototype.__defineGetter__('foo', function() { throw Error(); });
+assertSame(3, g(1, 2));
+assertSame(5, g(2, 3));
+%OptimizeFunctionOnNextCall(g);
+assertSame(7, g(3, 4));
+%DeoptimizeFunction(g);
diff --git a/test/mjsunit/regress/regress-123919.js b/test/mjsunit/regress/regress-123919.js
new file mode 100644
index 0000000..be34608
--- /dev/null
+++ b/test/mjsunit/regress/regress-123919.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --gc-global
+
+function g(max,val) {
+ this.x = 0;
+ for (var i = 0; i < max; i++) {
+ this.x = i/100;
+ }
+ this.val = val;
+}
+
+function f(max) {
+ var val = 0.5;
+ var obj = new g(max,val);
+ assertSame(val, obj.val);
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(200000);
diff --git a/test/mjsunit/regress/regress-1246.js b/test/mjsunit/regress/regress-1246.js
index f3dbec6..ca425ec 100644
--- a/test/mjsunit/regress/regress-1246.js
+++ b/test/mjsunit/regress/regress-1246.js
@@ -80,4 +80,3 @@
assertEquals(0xaf, parseInt("0xaf", radix));
assertEquals(0xaf, parseInt("af", radix));
}
-
diff --git a/test/mjsunit/regress/regress-1254366.js b/test/mjsunit/regress/regress-1254366.js
index 2f9e011..9acda3c 100644
--- a/test/mjsunit/regress/regress-1254366.js
+++ b/test/mjsunit/regress/regress-1254366.js
@@ -35,4 +35,3 @@
var a = new Object();
assertEquals(gee, a.findOrStore());
assertEquals(gee, a.findOrStore());
-
diff --git a/test/mjsunit/regress/regress-126412.js b/test/mjsunit/regress/regress-126412.js
new file mode 100644
index 0000000..0677f70
--- /dev/null
+++ b/test/mjsunit/regress/regress-126412.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"".match(/(A{9999999999}B|C*)*D/);
+"C".match(/(A{9999999999}B|C*)*D/);
+"".match(/(A{9999999999}B|C*)*/ );
+"C".match(/(A{9999999999}B|C*)*/ );
+"".match(/(9u|(2\`shj{2147483649,}\r|3|f|y|3*)+8\B)\W93+/);
+"9u8 ".match(/(9u|(2\`shj{2147483649,}\r|3|f|y|3*)+8\B)\W93+/);
diff --git a/test/mjsunit/regress/regress-128146.js b/test/mjsunit/regress/regress-128146.js
new file mode 100644
index 0000000..730dd91
--- /dev/null
+++ b/test/mjsunit/regress/regress-128146.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Define accessor properties, resulting in an AccessorPair with 2 transitions.
+Object.defineProperty({},"foo",{set:function(){},configurable:false});
+Object.defineProperty({},"foo",{get:function(){},configurable:false});
+
+// Define a data property under the same name.
+Object.defineProperty({},"foo",{});
diff --git a/test/mjsunit/regress/regress-131923.js b/test/mjsunit/regress/regress-131923.js
new file mode 100644
index 0000000..58da07c
--- /dev/null
+++ b/test/mjsunit/regress/regress-131923.js
@@ -0,0 +1,30 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertFalse(/\u9999{4}/.test(""));
+assertTrue(/\u9999{0,4}/.test(""));
+assertFalse(/\u9999{4,}/.test(""));
diff --git a/test/mjsunit/regress/regress-131994.js b/test/mjsunit/regress/regress-131994.js
new file mode 100644
index 0000000..3de3813
--- /dev/null
+++ b/test/mjsunit/regress/regress-131994.js
@@ -0,0 +1,70 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
+// Test that a variable in the local scope that shadows a context-allocated
+// variable is correctly resolved when being evaluated in the debugger.
+
+Debug = debug.Debug;
+
+var exception = false;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ var breakpoint = exec_state.frame(0);
+ try {
+ // Assert correct break point.
+ assertTrue(breakpoint.sourceLineText().indexOf("// Break") > -1);
+ // Assert correct value.
+ assertEquals(3, breakpoint.evaluate('x').value());
+ } catch (e) {
+ exception = e;
+ }
+}
+
+Debug.setListener(listener);
+
+function h() {
+ var x; // Context-allocated due to g().
+
+ var g = function g() {
+ x = -7;
+ };
+
+ var f = function f() {
+ var x = 3; // Allocated in the local scope.
+ debugger; // Break.
+ };
+
+ f();
+}
+
+h();
+
+assertFalse(exception);
diff --git a/test/mjsunit/regress/regress-133211.js b/test/mjsunit/regress/regress-133211.js
new file mode 100644
index 0000000..f9473d1
--- /dev/null
+++ b/test/mjsunit/regress/regress-133211.js
@@ -0,0 +1,35 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Make sure we don't leak maps when reading intermediate property descriptors.
+
+var o = {};
+var x = {};
+Object.defineProperty(o, "foo", { get: undefined });
+Object.defineProperty(x, "foo", { get: undefined, set: undefined });
+var pd = Object.getOwnPropertyDescriptor(o, "foo");
+assertEquals(undefined, pd.set);
diff --git a/test/mjsunit/regress/regress-133211b.js b/test/mjsunit/regress/regress-133211b.js
new file mode 100644
index 0000000..87e35f4
--- /dev/null
+++ b/test/mjsunit/regress/regress-133211b.js
@@ -0,0 +1,39 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+setter = function(x) { return; }
+var o = {};
+Object.defineProperty(o, "foo", { set: setter });
+var x = {};
+Object.defineProperty(x, "foo", { set: setter });
+x.bar = 20;
+x = {};
+gc();
+o.foo = 20;
+assertEquals(undefined, o.foo);
diff --git a/test/mjsunit/regress/regress-136048.js b/test/mjsunit/regress/regress-136048.js
new file mode 100644
index 0000000..c9972e9
--- /dev/null
+++ b/test/mjsunit/regress/regress-136048.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+try {
+ /foo/\u0069
+} catch (e) {
+ assertEquals(
+ "SyntaxError: Invalid flags supplied to RegExp constructor '\\u0069'",
+ e.toString());
+}
diff --git a/test/mjsunit/regress/regress-137.js b/test/mjsunit/regress/regress-137.js
index cc7b68c..f343eba 100644
--- a/test/mjsunit/regress/regress-137.js
+++ b/test/mjsunit/regress/regress-137.js
@@ -43,4 +43,3 @@
};
fail("case 10", "Default case", "Heap number not recognized as Smi value");
})();
-
diff --git a/test/mjsunit/regress/regress-137768.js b/test/mjsunit/regress/regress-137768.js
new file mode 100644
index 0000000..9fbd7f3
--- /dev/null
+++ b/test/mjsunit/regress/regress-137768.js
@@ -0,0 +1,73 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Create elements in a constructor function to ensure map sharing.
+function TestConstructor() {
+ this[0] = 1;
+ this[1] = 2;
+ this[2] = 3;
+}
+
+function bad_func(o,a) {
+ var s = 0;
+ for (var i = 0; i < 1; ++i) {
+ o.newFileToChangeMap = undefined;
+ var x = a[0];
+ s += x;
+ }
+ return s;
+}
+
+o = new Object();
+a = new TestConstructor();
+bad_func(o, a);
+
+// Make sure that we're out of pre-monomorphic state for the member add of
+// 'newFileToChangeMap' which causes a map transition.
+o = new Object();
+a = new TestConstructor();
+bad_func(o, a);
+
+// Optimize, before the fix, the element load and subsequent tagged-to-i were
+// hoisted above the map check, which can't be hoisted due to the map-changing
+// store.
+o = new Object();
+a = new TestConstructor();
+%OptimizeFunctionOnNextCall(bad_func);
+bad_func(o, a);
+
+// Pass in a array of doubles. Before the fix, the optimized load and
+// tagged-to-i will treat part of a double value as a pointer and de-ref it
+// before the map check was executed that should have deopt.
+o = new Object();
+// Pass in an elements buffer where the bit representation of the double numbers
+// are two adjacent small 32-bit values with the lowest bit set to one, causing
+// tagged-to-i to SIGSEGV.
+a = [2.122e-314, 2.122e-314, 2.122e-314];
+bad_func(o, a);
diff --git a/test/mjsunit/regress/regress-1383.js b/test/mjsunit/regress/regress-1383.js
index 4b08f5a..387c8b4 100644
--- a/test/mjsunit/regress/regress-1383.js
+++ b/test/mjsunit/regress/regress-1383.js
@@ -33,7 +33,7 @@
function foo(){
"use strict";
var wxemsx=(4);
- var wxemsx_0=Float32Array(wxemsx);
+ var wxemsx_0=new Float32Array(wxemsx);
wxemsx_0[0]={};
}
diff --git a/test/mjsunit/regress/regress-143967.js b/test/mjsunit/regress/regress-143967.js
new file mode 100644
index 0000000..7c12e67
--- /dev/null
+++ b/test/mjsunit/regress/regress-143967.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that Accessors::FunctionGetPrototype traverses the prototype
+// chain correctly and doesn't get stuck.
+
+var functionWithoutProto = [].filter;
+var obj = Object.create(functionWithoutProto);
+functionWithoutProto.__proto__ = function() {};
+assertEquals(functionWithoutProto.prototype, obj.prototype);
diff --git a/test/mjsunit/regress/regress-145201.js b/test/mjsunit/regress/regress-145201.js
new file mode 100644
index 0000000..7fe7bce
--- /dev/null
+++ b/test/mjsunit/regress/regress-145201.js
@@ -0,0 +1,107 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Fix some corner cases in skipping native methods using caller.
+var net = [];
+
+
+var x = 0;
+
+function collect () {
+ function item(operator) {
+ binary(operator, 1, false);
+ binary(operator, 1, true);
+ binary(operator, '{}', false);
+ binary(operator, '{}', true);
+ binary(operator, '"x"', false);
+ binary(operator, '"x"', true);
+ unary(operator, "");
+ }
+
+ function unary(op, after) {
+ // Capture:
+ try {
+ eval(op + " custom " + after);
+ } catch(e) {
+ }
+ }
+
+ function binary(op, other_side, inverted) {
+ // Capture:
+ try {
+ if (inverted) {
+ eval("custom " + op + " " + other_side);
+ } else {
+ eval(other_side + " " + op + " custom");
+ }
+ } catch(e) {
+ }
+ }
+
+ function catcher() {
+ var caller = catcher.caller;
+ if (/native/i.test(caller) || /ADD/.test(caller)) {
+ net[caller] = 0;
+ }
+ }
+
+ var custom = Object.create(null, {
+ toString: { value: catcher },
+ length: { get: catcher }
+ });
+
+ item('^');
+ item('~');
+ item('<<');
+ item('<');
+ item('==');
+ item('>>>');
+ item('>>');
+ item('|');
+ item('-');
+ item('*');
+ item('&');
+ item('%');
+ item('+');
+ item('in');
+ item('instanceof');
+ unary('{}[', ']');
+ unary('delete {}[', ']');
+ unary('(function() {}).apply(null, ', ')');
+}
+
+collect();
+collect();
+collect();
+
+var keys = 0;
+for (var key in net) {
+ print(key);
+ keys++;
+}
+
+assertTrue(keys == 0);
diff --git a/test/mjsunit/regress/regress-147497.js b/test/mjsunit/regress/regress-147497.js
new file mode 100644
index 0000000..92e29d1
--- /dev/null
+++ b/test/mjsunit/regress/regress-147497.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+ if (event == Debug.DebugEvent.Break) {
+ exec_state.prepareStep(Debug.StepAction.StepNext, 10);
+ }
+};
+
+Debug.setListener(listener);
+
+var statement = "";
+for (var i = 0; i < 1024; i++) statement += "z";
+statement = 'with(0)' + statement + '=function foo(){}';
+
+debugger;
+eval(statement);
diff --git a/test/mjsunit/regress/regress-148378.js b/test/mjsunit/regress/regress-148378.js
new file mode 100644
index 0000000..d37cea1
--- /dev/null
+++ b/test/mjsunit/regress/regress-148378.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"a".replace(/a/g, function() { return "c"; });
+
+function test() {
+ try {
+ test();
+ } catch(e) {
+ "b".replace(/(b)/g, function() { return "c"; });
+ }
+}
+
+test();
diff --git a/test/mjsunit/regress/regress-1530.js b/test/mjsunit/regress/regress-1530.js
index db21144..20d1f26 100644
--- a/test/mjsunit/regress/regress-1530.js
+++ b/test/mjsunit/regress/regress-1530.js
@@ -33,34 +33,52 @@
// Verify that normal assignment of 'prototype' property works properly
// and updates the internal value.
-var x = { foo: 'bar' };
-f.prototype = x;
-assertSame(f.prototype, x);
+var a = { foo: 'bar' };
+f.prototype = a;
+assertSame(f.prototype, a);
assertSame(f.prototype.foo, 'bar');
assertSame(new f().foo, 'bar');
-assertSame(Object.getPrototypeOf(new f()), x);
-assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, x);
+assertSame(Object.getPrototypeOf(new f()), a);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, a);
+assertTrue(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
// Verify that 'prototype' behaves like a data property when it comes to
// redefining with Object.defineProperty() and the internal value gets
// updated.
-var y = { foo: 'baz' };
-Object.defineProperty(f, 'prototype', { value: y, writable: true });
-assertSame(f.prototype, y);
+var b = { foo: 'baz' };
+Object.defineProperty(f, 'prototype', { value: b, writable: true });
+assertSame(f.prototype, b);
assertSame(f.prototype.foo, 'baz');
assertSame(new f().foo, 'baz');
-assertSame(Object.getPrototypeOf(new f()), y);
-assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, y);
+assertSame(Object.getPrototypeOf(new f()), b);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, b);
+assertTrue(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
// Verify that the previous redefinition didn't screw up callbacks and
// the internal value still gets updated.
-var z = { foo: 'other' };
-f.prototype = z;
-assertSame(f.prototype, z);
+var c = { foo: 'other' };
+f.prototype = c;
+assertSame(f.prototype, c);
assertSame(f.prototype.foo, 'other');
assertSame(new f().foo, 'other');
-assertSame(Object.getPrototypeOf(new f()), z);
-assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, z);
+assertSame(Object.getPrototypeOf(new f()), c);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, c);
+assertTrue(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
+
+// Verify that 'prototype' can be redefined to contain a different value
+// and have a different writability attribute at the same time.
+var d = { foo: 'final' };
+Object.defineProperty(f, 'prototype', { value: d, writable: false });
+assertSame(f.prototype, d);
+assertSame(f.prototype.foo, 'final');
+assertSame(new f().foo, 'final');
+assertSame(Object.getPrototypeOf(new f()), d);
+assertSame(Object.getOwnPropertyDescriptor(f, 'prototype').value, d);
+assertFalse(Object.getOwnPropertyDescriptor(f, 'prototype').writable);
+
+// Verify that non-writability of redefined 'prototype' is respected.
+assertThrows("'use strict'; f.prototype = {}");
+assertThrows("Object.defineProperty(f, 'prototype', { value: {} })");
// Verify that non-writability of other properties is respected.
assertThrows("Object.defineProperty(f, 'name', { value: {} })");
diff --git a/test/mjsunit/regress/regress-1546.js b/test/mjsunit/regress/regress-1546.js
index 7f1fa58..3f1839c 100644
--- a/test/mjsunit/regress/regress-1546.js
+++ b/test/mjsunit/regress/regress-1546.js
@@ -29,4 +29,4 @@
// Should't throw. Scanner incorrectly truncated to char before comparing
// with "*", so it ended the comment early.
-eval("/*\u822a/ */");
\ No newline at end of file
+eval("/*\u822a/ */");
diff --git a/test/mjsunit/regress/regress-1548.js b/test/mjsunit/regress/regress-1548.js
index 074007b..5330e13 100644
--- a/test/mjsunit/regress/regress-1548.js
+++ b/test/mjsunit/regress/regress-1548.js
@@ -30,19 +30,19 @@
function testfn(f) { return [1].map(f)[0]; }
function foo() { return [].map.caller; }
-assertEquals(null, testfn(foo));
+assertThrows(function() { testfn(foo); } );
// Try to delete the caller property (to make sure that we can't get to the
// caller accessor on the prototype.
delete Array.prototype.map.caller;
-assertEquals(null, testfn(foo));
+assertThrows(function() { testfn(foo); } );
// Redo tests with arguments object.
function testarguments(f) { return [1].map(f)[0]; }
function bar() { return [].map.arguments; }
-assertEquals(null, testfn(bar));
+assertThrows(function() { testarguments(bar); } );
// Try to delete the arguments property (to make sure that we can't get to the
// caller accessor on the prototype.
delete Array.prototype.map.arguments;
-assertEquals(null, testarguments(bar));
+assertThrows(function() { testarguments(bar); } );
diff --git a/test/mjsunit/regress/regress-1563.js b/test/mjsunit/regress/regress-1563.js
index c25b6c7..884b125 100644
--- a/test/mjsunit/regress/regress-1563.js
+++ b/test/mjsunit/regress/regress-1563.js
@@ -27,7 +27,7 @@
// Flags: --allow-natives-syntax
-obj = new PixelArray(10);
+obj = new Uint8ClampedArray(10);
// Test that undefined gets properly clamped in Crankshafted pixel array
// assignments.
diff --git a/test/mjsunit/regress/regress-1591.js b/test/mjsunit/regress/regress-1591.js
new file mode 100644
index 0000000..dbf40df
--- /dev/null
+++ b/test/mjsunit/regress/regress-1591.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var stack;
+var used_custom_lookup = false;
+
+({
+ __lookupGetter__ : function() {
+ used_custom_lookup = true;
+ },
+
+ test : function() {
+ try {
+ f();
+ } catch (err) {
+ stack = err.stack;
+ }
+ }
+}).test();
+
+var expected_message = "ReferenceError: f is not defined";
+assertTrue(stack.indexOf(expected_message) >= 0);
+assertFalse(used_custom_lookup);
diff --git a/test/mjsunit/regress/regress-1639-2.js b/test/mjsunit/regress/regress-1639-2.js
index c439dd8..01f0dc2 100644
--- a/test/mjsunit/regress/regress-1639-2.js
+++ b/test/mjsunit/regress/regress-1639-2.js
@@ -1,4 +1,4 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -28,6 +28,7 @@
// Flags: --expose-debug-as debug
// Get the Debug object exposed from the debug context global object.
Debug = debug.Debug
+var exception = false;
function sendCommand(state, cmd) {
// Get the debug command processor in paused state.
@@ -79,6 +80,7 @@
}
} catch (e) {
print(e);
+ exception = true;
}
}
@@ -91,3 +93,4 @@
// Set a break point and call to invoke the debug event listener.
Debug.setBreakPoint(a, 0, 0);
a();
+assertFalse(exception);
diff --git a/test/mjsunit/regress/regress-1639.js b/test/mjsunit/regress/regress-1639.js
index ed68c97..47cdbc4 100644
--- a/test/mjsunit/regress/regress-1639.js
+++ b/test/mjsunit/regress/regress-1639.js
@@ -1,4 +1,4 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -29,6 +29,7 @@
// Get the Debug object exposed from the debug context global object.
Debug = debug.Debug
var breaks = 0;
+var exception = false;
function sendCommand(state, cmd) {
// Get the debug command processor in paused state.
@@ -47,15 +48,18 @@
"should not break on unexpected lines")
assertEquals('BREAK ' + breaks, line.substr(-7));
breaks++;
- sendCommand(exec_state, {
- seq: 0,
- type: "request",
- command: "continue",
- arguments: { stepaction: "next" }
- });
+ if (breaks < 4) {
+ sendCommand(exec_state, {
+ seq: 0,
+ type: "request",
+ command: "continue",
+ arguments: { stepaction: "next" }
+ });
+ }
}
} catch (e) {
print(e);
+ exception = true;
}
}
@@ -82,4 +86,6 @@
// Set a break point and call to invoke the debug event listener.
Debug.setBreakPoint(b, 0, 0);
a(b);
-// BREAK 3
+a(); // BREAK 3
+
+assertFalse(exception);
diff --git a/test/mjsunit/regress/regress-164442.js b/test/mjsunit/regress/regress-164442.js
new file mode 100644
index 0000000..1160d87
--- /dev/null
+++ b/test/mjsunit/regress/regress-164442.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Should not take a very long time (n^2 algorithms are bad)
+
+
+function ensureNotNegative(x) {
+ return Math.max(0, x | 0);
+}
+
+
+ensureNotNegative(1);
+ensureNotNegative(2);
+
+%OptimizeFunctionOnNextCall(ensureNotNegative);
+
+var r = ensureNotNegative(-1);
+
+assertEquals(0, r);
diff --git a/test/mjsunit/regress/regress-1647.js b/test/mjsunit/regress/regress-1647.js
index a6afcc0..ab6608c 100644
--- a/test/mjsunit/regress/regress-1647.js
+++ b/test/mjsunit/regress/regress-1647.js
@@ -40,4 +40,3 @@
%OptimizeFunctionOnNextCall(f);
t.number = 2;
f();
-
diff --git a/test/mjsunit/regress/regress-165637.js b/test/mjsunit/regress/regress-165637.js
new file mode 100644
index 0000000..84c9041
--- /dev/null
+++ b/test/mjsunit/regress/regress-165637.js
@@ -0,0 +1,57 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Should not take a very long time (n^2 algorithms are bad)
+
+function do_slices() {
+ var data = new Array(1024 * 12); // 12kB
+
+ for (var i = 0; i < data.length; i++) {
+ data[i] = 255;
+ }
+
+ var start = Date.now();
+
+ for (i = 0; i < 20000; i++) {
+ data.slice(4, 1);
+ }
+
+ return Date.now() - start;
+}
+
+// Should never take more than 3 seconds (if the bug is fixed, the test takes
+// considerably less time than 3 seconds).
+assertTrue(do_slices() < (3 * 1000));
+
+// Make sure that packed and unpacked array slices are still properly handled
+var holey_array = [1, 2, 3, 4, 5,,,,,,];
+assertFalse(%HasFastHoleyElements(holey_array.slice(6, 1)));
+assertEquals(undefined, holey_array.slice(6, 7)[0])
+assertFalse(%HasFastHoleyElements(holey_array.slice(2, 1)));
+assertEquals(3, holey_array.slice(2, 3)[0])
diff --git a/test/mjsunit/regress/regress-166379.js b/test/mjsunit/regress/regress-166379.js
new file mode 100644
index 0000000..2cda611
--- /dev/null
+++ b/test/mjsunit/regress/regress-166379.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function mod(a, b) { return a % b; }
+
+// Feed integer type info and optimize.
+assertEquals(0, mod(4, 2));
+assertEquals(1, mod(3, 2));
+%OptimizeFunctionOnNextCall(mod);
+
+// Surprise mod with overflow.
+assertEquals(-Infinity, 1/mod(-2147483648, -1));
diff --git a/test/mjsunit/regress/regress-166553.js b/test/mjsunit/regress/regress-166553.js
new file mode 100644
index 0000000..acaf34f
--- /dev/null
+++ b/test/mjsunit/regress/regress-166553.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose_gc
+
+JSON.stringify(String.fromCharCode(1, -11).toString())
+gc();
+var s = String.fromCharCode(1, -11)
+assertEquals(65525, s.charCodeAt(1))
diff --git a/test/mjsunit/regress/regress-1692.js b/test/mjsunit/regress/regress-1692.js
index 06bd66c..32be87f 100644
--- a/test/mjsunit/regress/regress-1692.js
+++ b/test/mjsunit/regress/regress-1692.js
@@ -82,7 +82,7 @@
// Non-string property on String object.
o[10] = 42;
assertTrue(o.propertyIsEnumerable(10));
-assertFalse(o.propertyIsEnumerable(0));
+assertTrue(o.propertyIsEnumerable(0));
// Fast elements.
var o = [1,2,3,4,5];
diff --git a/test/mjsunit/regress/regress-1708.js b/test/mjsunit/regress/regress-1708.js
index ab50e07..ed2ddb1 100644
--- a/test/mjsunit/regress/regress-1708.js
+++ b/test/mjsunit/regress/regress-1708.js
@@ -27,14 +27,18 @@
// Regression test of a very rare corner case where left-trimming an
// array caused invalid marking bit patterns on lazily swept pages.
+//
+// Lazy sweeping was deprecated. We are keeping the test case to make
+// sure that concurrent sweeping, which relies on similar assumptions
+// as lazy sweeping works correctly.
-// Flags: --expose-gc --noincremental-marking --max-new-space-size 1000
+// Flags: --expose-gc --noincremental-marking --max-semi-space-size=1
(function() {
var head = new Array(1);
var tail = head;
- // Fill heap to increase old-space size and trigger lazy sweeping on
+ // Fill heap to increase old-space size and trigger concurrent sweeping on
// some of the old-space pages.
for (var i = 0; i < 200; i++) {
tail[1] = new Array(1000);
@@ -44,7 +48,7 @@
gc(); gc();
// At this point "array" should have been promoted to old-space and be
- // located in a lazy swept page with intact marking bits. Now shift
+ // located in a concurrently swept page with intact marking bits. Now shift
// the array to trigger left-trimming operations.
assertEquals(100, array.length);
for (var i = 0; i < 50; i++) {
@@ -54,7 +58,7 @@
// At this point "array" should have been trimmed from the left with
// marking bits being correctly transfered to the new object start.
- // Scavenging operations cause lazy sweeping to advance and verify
+ // Scavenging operations cause concurrent sweeping to advance and verify
// that marking bit patterns are still sane.
for (var i = 0; i < 200; i++) {
tail[1] = new Array(1000);
diff --git a/test/mjsunit/regress/regress-1713.js b/test/mjsunit/regress/regress-1713.js
deleted file mode 100644
index 0af1144..0000000
--- a/test/mjsunit/regress/regress-1713.js
+++ /dev/null
@@ -1,127 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax --always-compact --expose-gc
-
-var O = { get f() { return 0; } };
-
-var CODE = [];
-
-var R = [];
-
-function Allocate4Kb(N) {
- var arr = [];
- do {arr.push(new Array(1024));} while (--N > 0);
- return arr;
-}
-
-function AllocateXMb(X) {
- return Allocate4Kb((1024 * X) / 4);
-}
-
-function Node(v, next) { this.v = v; this.next = next; }
-
-Node.prototype.execute = function (O) {
- var n = this;
- while (n.next !== null) n = n.next;
- n.v(O);
-};
-
-function LongList(N, x) {
- if (N == 0) return new Node(x, null);
- return new Node(new Array(1024), LongList(N - 1, x));
-}
-
-var L = LongList(1024, function (O) {
- for (var i = 0; i < 5; i++) O.f;
-});
-
-
-
-function Incremental(O, x) {
- if (!x) {
- return;
- }
- function CreateCode(i) {
- var f = new Function("return O.f_" + i);
- CODE.push(f);
- f(); // compile
- f(); // compile
- f(); // compile
- }
-
- for (var i = 0; i < 1e4; i++) CreateCode(i);
- gc();
- gc();
- gc();
-
- print(">>> 1 <<<");
-
- L.execute(O);
-
- try {} catch (e) {}
-
- L = null;
- print(">>> 2 <<<");
- AllocateXMb(8);
- //rint("1");
- //llocateXMb(8);
- //rint("1");
- //llocateXMb(8);
-
-}
-
-function foo(O, x) {
- Incremental(O, x);
-
- print('f');
-
- for (var i = 0; i < 5; i++) O.f;
-
-
- print('g');
-
- bar(x);
-}
-
-function bar(x) {
- if (!x) return;
- %DeoptimizeFunction(foo);
- AllocateXMb(8);
- AllocateXMb(8);
-}
-
-var O1 = {};
-var O2 = {};
-var O3 = {};
-var O4 = {f:0};
-
-foo(O1, false);
-foo(O2, false);
-foo(O3, false);
-%OptimizeFunctionOnNextCall(foo);
-foo(O4, true);
diff --git a/test/mjsunit/regress/regress-171641.js b/test/mjsunit/regress/regress-171641.js
new file mode 100644
index 0000000..8db6781
--- /dev/null
+++ b/test/mjsunit/regress/regress-171641.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(k, p) {
+ for (var i = 0; i < 1; i++) {
+ p = Math.min(p, i);
+ }
+ m = Math.floor((k | 0) / p);
+}
+
+foo(0, 1);
+foo(0, 1);
+%OptimizeFunctionOnNextCall(foo);
+foo(0, 1);
diff --git a/test/mjsunit/regress/regress-1748.js b/test/mjsunit/regress/regress-1748.js
index e287e55..41b7c70 100644
--- a/test/mjsunit/regress/regress-1748.js
+++ b/test/mjsunit/regress/regress-1748.js
@@ -32,4 +32,4 @@
var str = Array(10000).join("X");
str.replace(/^|X/g, function(m, i, s) {
if (i > 0) assertEquals("X", m, "at position 0x" + i.toString(16));
-});
\ No newline at end of file
+});
diff --git a/test/mjsunit/regress/regress-1757.js b/test/mjsunit/regress/regress-1757.js
index f7a5516..35e7355 100644
--- a/test/mjsunit/regress/regress-1757.js
+++ b/test/mjsunit/regress/regress-1757.js
@@ -29,4 +29,4 @@
var a = "abcdefghijklmnopqrstuvqxy"+"z";
externalizeString(a, true);
-assertEquals('b', a.substring(1).charAt(0));
\ No newline at end of file
+assertEquals('b', a.substring(1).charAt(0));
diff --git a/test/mjsunit/regress/regress-1849.js b/test/mjsunit/regress/regress-1849.js
index 176f918..5b8fc50 100644
--- a/test/mjsunit/regress/regress-1849.js
+++ b/test/mjsunit/regress/regress-1849.js
@@ -1,4 +1,4 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
+// Copyright 2012 the V8 project authors. All rights reserved.
// Redistribution and use in source and binary forms, with or without
// modification, are permitted provided that the following conditions are
// met:
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// See: http://code.google.com/p/v8/issues/detail?id=1878
+// See: http://code.google.com/p/v8/issues/detail?id=1849
// Flags: --allow-natives-syntax
@@ -36,4 +36,4 @@
arr[i] = 0;
}
assertFalse(%HasFastDoubleElements(arr));
-assertTrue(%HasFastSmiOnlyElements(arr));
+assertTrue(%HasFastSmiElements(arr));
diff --git a/test/mjsunit/regress/regress-1853.js b/test/mjsunit/regress/regress-1853.js
index f80bade..7175688 100644
--- a/test/mjsunit/regress/regress-1853.js
+++ b/test/mjsunit/regress/regress-1853.js
@@ -102,15 +102,14 @@
' assertFalse(test_break_1); \n' +
' assertTrue(test_break_1); \n' +
'} \n' +
- '//@ sourceURL=testScriptOne');
+ '//# sourceURL=testScriptOne');
eval('function test2() { \n' +
' assertFalse(test_break_2); \n' +
' assertTrue(test_break_2); \n' +
'} \n' +
- '//@ sourceURL=testScriptTwo');
+ '//# sourceURL=testScriptTwo');
test1();
test2();
assertEquals(3, break_count);
-
diff --git a/test/mjsunit/regress/regress-186.js b/test/mjsunit/regress/regress-186.js
index 335869d..0212855 100644
--- a/test/mjsunit/regress/regress-186.js
+++ b/test/mjsunit/regress/regress-186.js
@@ -69,4 +69,3 @@
runTest(testLocal);
runTest(testConstLocal);
runTest(testGlobal);
-
diff --git a/test/mjsunit/regress/regress-1878.js b/test/mjsunit/regress/regress-1878.js
index a1648b1..fbc47bd 100644
--- a/test/mjsunit/regress/regress-1878.js
+++ b/test/mjsunit/regress/regress-1878.js
@@ -34,11 +34,11 @@
for (var i = 0; i < 1000; i++) {
var ai = natives.InternalArray(10000);
assertFalse(%HaveSameMap(ai, a));
- assertTrue(%HasFastElements(ai));
+ assertTrue(%HasFastObjectElements(ai));
}
for (var i = 0; i < 1000; i++) {
var ai = new natives.InternalArray(10000);
assertFalse(%HaveSameMap(ai, a));
- assertTrue(%HasFastElements(ai));
+ assertTrue(%HasFastObjectElements(ai));
}
diff --git a/test/mjsunit/regress/regress-1919169.js b/test/mjsunit/regress/regress-1919169.js
index a732312..fbb82ba 100644
--- a/test/mjsunit/regress/regress-1919169.js
+++ b/test/mjsunit/regress/regress-1919169.js
@@ -37,4 +37,3 @@
// Crash does not occur when code is run at the top level.
test();
-
diff --git a/test/mjsunit/regress/regress-193.js b/test/mjsunit/regress/regress-193.js
index f803483..457c208 100644
--- a/test/mjsunit/regress/regress-193.js
+++ b/test/mjsunit/regress/regress-193.js
@@ -40,5 +40,3 @@
// The call to f should get the constructor of the receiver which is
// the constructor of the global object.
assertEquals(constructor, f());
-
-
diff --git a/test/mjsunit/regress/regress-1969.js b/test/mjsunit/regress/regress-1969.js
deleted file mode 100644
index 2728c2c..0000000
--- a/test/mjsunit/regress/regress-1969.js
+++ /dev/null
@@ -1,5045 +0,0 @@
-// Copyright 2012 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Flags: --allow-natives-syntax
-
-f();
-f();
-%OptimizeFunctionOnNextCall(f);
-var start = (new Date()).getTime();
-var array = f();
-var end = (new Date()).getTime();
-
-// Assert that recompiling and executing f() takes less than a second.
-assertTrue((end - start) < 1000);
-
-for (var i = 0; i < 5000; i++) assertEquals(0, array[i]);
-
-function f() {
- var a = new Array(5000);
- a[0]=0;
- a[1]=0;
- a[2]=0;
- a[3]=0;
- a[4]=0;
- a[5]=0;
- a[6]=0;
- a[7]=0;
- a[8]=0;
- a[9]=0;
- a[10]=0;
- a[11]=0;
- a[12]=0;
- a[13]=0;
- a[14]=0;
- a[15]=0;
- a[16]=0;
- a[17]=0;
- a[18]=0;
- a[19]=0;
- a[20]=0;
- a[21]=0;
- a[22]=0;
- a[23]=0;
- a[24]=0;
- a[25]=0;
- a[26]=0;
- a[27]=0;
- a[28]=0;
- a[29]=0;
- a[30]=0;
- a[31]=0;
- a[32]=0;
- a[33]=0;
- a[34]=0;
- a[35]=0;
- a[36]=0;
- a[37]=0;
- a[38]=0;
- a[39]=0;
- a[40]=0;
- a[41]=0;
- a[42]=0;
- a[43]=0;
- a[44]=0;
- a[45]=0;
- a[46]=0;
- a[47]=0;
- a[48]=0;
- a[49]=0;
- a[50]=0;
- a[51]=0;
- a[52]=0;
- a[53]=0;
- a[54]=0;
- a[55]=0;
- a[56]=0;
- a[57]=0;
- a[58]=0;
- a[59]=0;
- a[60]=0;
- a[61]=0;
- a[62]=0;
- a[63]=0;
- a[64]=0;
- a[65]=0;
- a[66]=0;
- a[67]=0;
- a[68]=0;
- a[69]=0;
- a[70]=0;
- a[71]=0;
- a[72]=0;
- a[73]=0;
- a[74]=0;
- a[75]=0;
- a[76]=0;
- a[77]=0;
- a[78]=0;
- a[79]=0;
- a[80]=0;
- a[81]=0;
- a[82]=0;
- a[83]=0;
- a[84]=0;
- a[85]=0;
- a[86]=0;
- a[87]=0;
- a[88]=0;
- a[89]=0;
- a[90]=0;
- a[91]=0;
- a[92]=0;
- a[93]=0;
- a[94]=0;
- a[95]=0;
- a[96]=0;
- a[97]=0;
- a[98]=0;
- a[99]=0;
- a[100]=0;
- a[101]=0;
- a[102]=0;
- a[103]=0;
- a[104]=0;
- a[105]=0;
- a[106]=0;
- a[107]=0;
- a[108]=0;
- a[109]=0;
- a[110]=0;
- a[111]=0;
- a[112]=0;
- a[113]=0;
- a[114]=0;
- a[115]=0;
- a[116]=0;
- a[117]=0;
- a[118]=0;
- a[119]=0;
- a[120]=0;
- a[121]=0;
- a[122]=0;
- a[123]=0;
- a[124]=0;
- a[125]=0;
- a[126]=0;
- a[127]=0;
- a[128]=0;
- a[129]=0;
- a[130]=0;
- a[131]=0;
- a[132]=0;
- a[133]=0;
- a[134]=0;
- a[135]=0;
- a[136]=0;
- a[137]=0;
- a[138]=0;
- a[139]=0;
- a[140]=0;
- a[141]=0;
- a[142]=0;
- a[143]=0;
- a[144]=0;
- a[145]=0;
- a[146]=0;
- a[147]=0;
- a[148]=0;
- a[149]=0;
- a[150]=0;
- a[151]=0;
- a[152]=0;
- a[153]=0;
- a[154]=0;
- a[155]=0;
- a[156]=0;
- a[157]=0;
- a[158]=0;
- a[159]=0;
- a[160]=0;
- a[161]=0;
- a[162]=0;
- a[163]=0;
- a[164]=0;
- a[165]=0;
- a[166]=0;
- a[167]=0;
- a[168]=0;
- a[169]=0;
- a[170]=0;
- a[171]=0;
- a[172]=0;
- a[173]=0;
- a[174]=0;
- a[175]=0;
- a[176]=0;
- a[177]=0;
- a[178]=0;
- a[179]=0;
- a[180]=0;
- a[181]=0;
- a[182]=0;
- a[183]=0;
- a[184]=0;
- a[185]=0;
- a[186]=0;
- a[187]=0;
- a[188]=0;
- a[189]=0;
- a[190]=0;
- a[191]=0;
- a[192]=0;
- a[193]=0;
- a[194]=0;
- a[195]=0;
- a[196]=0;
- a[197]=0;
- a[198]=0;
- a[199]=0;
- a[200]=0;
- a[201]=0;
- a[202]=0;
- a[203]=0;
- a[204]=0;
- a[205]=0;
- a[206]=0;
- a[207]=0;
- a[208]=0;
- a[209]=0;
- a[210]=0;
- a[211]=0;
- a[212]=0;
- a[213]=0;
- a[214]=0;
- a[215]=0;
- a[216]=0;
- a[217]=0;
- a[218]=0;
- a[219]=0;
- a[220]=0;
- a[221]=0;
- a[222]=0;
- a[223]=0;
- a[224]=0;
- a[225]=0;
- a[226]=0;
- a[227]=0;
- a[228]=0;
- a[229]=0;
- a[230]=0;
- a[231]=0;
- a[232]=0;
- a[233]=0;
- a[234]=0;
- a[235]=0;
- a[236]=0;
- a[237]=0;
- a[238]=0;
- a[239]=0;
- a[240]=0;
- a[241]=0;
- a[242]=0;
- a[243]=0;
- a[244]=0;
- a[245]=0;
- a[246]=0;
- a[247]=0;
- a[248]=0;
- a[249]=0;
- a[250]=0;
- a[251]=0;
- a[252]=0;
- a[253]=0;
- a[254]=0;
- a[255]=0;
- a[256]=0;
- a[257]=0;
- a[258]=0;
- a[259]=0;
- a[260]=0;
- a[261]=0;
- a[262]=0;
- a[263]=0;
- a[264]=0;
- a[265]=0;
- a[266]=0;
- a[267]=0;
- a[268]=0;
- a[269]=0;
- a[270]=0;
- a[271]=0;
- a[272]=0;
- a[273]=0;
- a[274]=0;
- a[275]=0;
- a[276]=0;
- a[277]=0;
- a[278]=0;
- a[279]=0;
- a[280]=0;
- a[281]=0;
- a[282]=0;
- a[283]=0;
- a[284]=0;
- a[285]=0;
- a[286]=0;
- a[287]=0;
- a[288]=0;
- a[289]=0;
- a[290]=0;
- a[291]=0;
- a[292]=0;
- a[293]=0;
- a[294]=0;
- a[295]=0;
- a[296]=0;
- a[297]=0;
- a[298]=0;
- a[299]=0;
- a[300]=0;
- a[301]=0;
- a[302]=0;
- a[303]=0;
- a[304]=0;
- a[305]=0;
- a[306]=0;
- a[307]=0;
- a[308]=0;
- a[309]=0;
- a[310]=0;
- a[311]=0;
- a[312]=0;
- a[313]=0;
- a[314]=0;
- a[315]=0;
- a[316]=0;
- a[317]=0;
- a[318]=0;
- a[319]=0;
- a[320]=0;
- a[321]=0;
- a[322]=0;
- a[323]=0;
- a[324]=0;
- a[325]=0;
- a[326]=0;
- a[327]=0;
- a[328]=0;
- a[329]=0;
- a[330]=0;
- a[331]=0;
- a[332]=0;
- a[333]=0;
- a[334]=0;
- a[335]=0;
- a[336]=0;
- a[337]=0;
- a[338]=0;
- a[339]=0;
- a[340]=0;
- a[341]=0;
- a[342]=0;
- a[343]=0;
- a[344]=0;
- a[345]=0;
- a[346]=0;
- a[347]=0;
- a[348]=0;
- a[349]=0;
- a[350]=0;
- a[351]=0;
- a[352]=0;
- a[353]=0;
- a[354]=0;
- a[355]=0;
- a[356]=0;
- a[357]=0;
- a[358]=0;
- a[359]=0;
- a[360]=0;
- a[361]=0;
- a[362]=0;
- a[363]=0;
- a[364]=0;
- a[365]=0;
- a[366]=0;
- a[367]=0;
- a[368]=0;
- a[369]=0;
- a[370]=0;
- a[371]=0;
- a[372]=0;
- a[373]=0;
- a[374]=0;
- a[375]=0;
- a[376]=0;
- a[377]=0;
- a[378]=0;
- a[379]=0;
- a[380]=0;
- a[381]=0;
- a[382]=0;
- a[383]=0;
- a[384]=0;
- a[385]=0;
- a[386]=0;
- a[387]=0;
- a[388]=0;
- a[389]=0;
- a[390]=0;
- a[391]=0;
- a[392]=0;
- a[393]=0;
- a[394]=0;
- a[395]=0;
- a[396]=0;
- a[397]=0;
- a[398]=0;
- a[399]=0;
- a[400]=0;
- a[401]=0;
- a[402]=0;
- a[403]=0;
- a[404]=0;
- a[405]=0;
- a[406]=0;
- a[407]=0;
- a[408]=0;
- a[409]=0;
- a[410]=0;
- a[411]=0;
- a[412]=0;
- a[413]=0;
- a[414]=0;
- a[415]=0;
- a[416]=0;
- a[417]=0;
- a[418]=0;
- a[419]=0;
- a[420]=0;
- a[421]=0;
- a[422]=0;
- a[423]=0;
- a[424]=0;
- a[425]=0;
- a[426]=0;
- a[427]=0;
- a[428]=0;
- a[429]=0;
- a[430]=0;
- a[431]=0;
- a[432]=0;
- a[433]=0;
- a[434]=0;
- a[435]=0;
- a[436]=0;
- a[437]=0;
- a[438]=0;
- a[439]=0;
- a[440]=0;
- a[441]=0;
- a[442]=0;
- a[443]=0;
- a[444]=0;
- a[445]=0;
- a[446]=0;
- a[447]=0;
- a[448]=0;
- a[449]=0;
- a[450]=0;
- a[451]=0;
- a[452]=0;
- a[453]=0;
- a[454]=0;
- a[455]=0;
- a[456]=0;
- a[457]=0;
- a[458]=0;
- a[459]=0;
- a[460]=0;
- a[461]=0;
- a[462]=0;
- a[463]=0;
- a[464]=0;
- a[465]=0;
- a[466]=0;
- a[467]=0;
- a[468]=0;
- a[469]=0;
- a[470]=0;
- a[471]=0;
- a[472]=0;
- a[473]=0;
- a[474]=0;
- a[475]=0;
- a[476]=0;
- a[477]=0;
- a[478]=0;
- a[479]=0;
- a[480]=0;
- a[481]=0;
- a[482]=0;
- a[483]=0;
- a[484]=0;
- a[485]=0;
- a[486]=0;
- a[487]=0;
- a[488]=0;
- a[489]=0;
- a[490]=0;
- a[491]=0;
- a[492]=0;
- a[493]=0;
- a[494]=0;
- a[495]=0;
- a[496]=0;
- a[497]=0;
- a[498]=0;
- a[499]=0;
- a[500]=0;
- a[501]=0;
- a[502]=0;
- a[503]=0;
- a[504]=0;
- a[505]=0;
- a[506]=0;
- a[507]=0;
- a[508]=0;
- a[509]=0;
- a[510]=0;
- a[511]=0;
- a[512]=0;
- a[513]=0;
- a[514]=0;
- a[515]=0;
- a[516]=0;
- a[517]=0;
- a[518]=0;
- a[519]=0;
- a[520]=0;
- a[521]=0;
- a[522]=0;
- a[523]=0;
- a[524]=0;
- a[525]=0;
- a[526]=0;
- a[527]=0;
- a[528]=0;
- a[529]=0;
- a[530]=0;
- a[531]=0;
- a[532]=0;
- a[533]=0;
- a[534]=0;
- a[535]=0;
- a[536]=0;
- a[537]=0;
- a[538]=0;
- a[539]=0;
- a[540]=0;
- a[541]=0;
- a[542]=0;
- a[543]=0;
- a[544]=0;
- a[545]=0;
- a[546]=0;
- a[547]=0;
- a[548]=0;
- a[549]=0;
- a[550]=0;
- a[551]=0;
- a[552]=0;
- a[553]=0;
- a[554]=0;
- a[555]=0;
- a[556]=0;
- a[557]=0;
- a[558]=0;
- a[559]=0;
- a[560]=0;
- a[561]=0;
- a[562]=0;
- a[563]=0;
- a[564]=0;
- a[565]=0;
- a[566]=0;
- a[567]=0;
- a[568]=0;
- a[569]=0;
- a[570]=0;
- a[571]=0;
- a[572]=0;
- a[573]=0;
- a[574]=0;
- a[575]=0;
- a[576]=0;
- a[577]=0;
- a[578]=0;
- a[579]=0;
- a[580]=0;
- a[581]=0;
- a[582]=0;
- a[583]=0;
- a[584]=0;
- a[585]=0;
- a[586]=0;
- a[587]=0;
- a[588]=0;
- a[589]=0;
- a[590]=0;
- a[591]=0;
- a[592]=0;
- a[593]=0;
- a[594]=0;
- a[595]=0;
- a[596]=0;
- a[597]=0;
- a[598]=0;
- a[599]=0;
- a[600]=0;
- a[601]=0;
- a[602]=0;
- a[603]=0;
- a[604]=0;
- a[605]=0;
- a[606]=0;
- a[607]=0;
- a[608]=0;
- a[609]=0;
- a[610]=0;
- a[611]=0;
- a[612]=0;
- a[613]=0;
- a[614]=0;
- a[615]=0;
- a[616]=0;
- a[617]=0;
- a[618]=0;
- a[619]=0;
- a[620]=0;
- a[621]=0;
- a[622]=0;
- a[623]=0;
- a[624]=0;
- a[625]=0;
- a[626]=0;
- a[627]=0;
- a[628]=0;
- a[629]=0;
- a[630]=0;
- a[631]=0;
- a[632]=0;
- a[633]=0;
- a[634]=0;
- a[635]=0;
- a[636]=0;
- a[637]=0;
- a[638]=0;
- a[639]=0;
- a[640]=0;
- a[641]=0;
- a[642]=0;
- a[643]=0;
- a[644]=0;
- a[645]=0;
- a[646]=0;
- a[647]=0;
- a[648]=0;
- a[649]=0;
- a[650]=0;
- a[651]=0;
- a[652]=0;
- a[653]=0;
- a[654]=0;
- a[655]=0;
- a[656]=0;
- a[657]=0;
- a[658]=0;
- a[659]=0;
- a[660]=0;
- a[661]=0;
- a[662]=0;
- a[663]=0;
- a[664]=0;
- a[665]=0;
- a[666]=0;
- a[667]=0;
- a[668]=0;
- a[669]=0;
- a[670]=0;
- a[671]=0;
- a[672]=0;
- a[673]=0;
- a[674]=0;
- a[675]=0;
- a[676]=0;
- a[677]=0;
- a[678]=0;
- a[679]=0;
- a[680]=0;
- a[681]=0;
- a[682]=0;
- a[683]=0;
- a[684]=0;
- a[685]=0;
- a[686]=0;
- a[687]=0;
- a[688]=0;
- a[689]=0;
- a[690]=0;
- a[691]=0;
- a[692]=0;
- a[693]=0;
- a[694]=0;
- a[695]=0;
- a[696]=0;
- a[697]=0;
- a[698]=0;
- a[699]=0;
- a[700]=0;
- a[701]=0;
- a[702]=0;
- a[703]=0;
- a[704]=0;
- a[705]=0;
- a[706]=0;
- a[707]=0;
- a[708]=0;
- a[709]=0;
- a[710]=0;
- a[711]=0;
- a[712]=0;
- a[713]=0;
- a[714]=0;
- a[715]=0;
- a[716]=0;
- a[717]=0;
- a[718]=0;
- a[719]=0;
- a[720]=0;
- a[721]=0;
- a[722]=0;
- a[723]=0;
- a[724]=0;
- a[725]=0;
- a[726]=0;
- a[727]=0;
- a[728]=0;
- a[729]=0;
- a[730]=0;
- a[731]=0;
- a[732]=0;
- a[733]=0;
- a[734]=0;
- a[735]=0;
- a[736]=0;
- a[737]=0;
- a[738]=0;
- a[739]=0;
- a[740]=0;
- a[741]=0;
- a[742]=0;
- a[743]=0;
- a[744]=0;
- a[745]=0;
- a[746]=0;
- a[747]=0;
- a[748]=0;
- a[749]=0;
- a[750]=0;
- a[751]=0;
- a[752]=0;
- a[753]=0;
- a[754]=0;
- a[755]=0;
- a[756]=0;
- a[757]=0;
- a[758]=0;
- a[759]=0;
- a[760]=0;
- a[761]=0;
- a[762]=0;
- a[763]=0;
- a[764]=0;
- a[765]=0;
- a[766]=0;
- a[767]=0;
- a[768]=0;
- a[769]=0;
- a[770]=0;
- a[771]=0;
- a[772]=0;
- a[773]=0;
- a[774]=0;
- a[775]=0;
- a[776]=0;
- a[777]=0;
- a[778]=0;
- a[779]=0;
- a[780]=0;
- a[781]=0;
- a[782]=0;
- a[783]=0;
- a[784]=0;
- a[785]=0;
- a[786]=0;
- a[787]=0;
- a[788]=0;
- a[789]=0;
- a[790]=0;
- a[791]=0;
- a[792]=0;
- a[793]=0;
- a[794]=0;
- a[795]=0;
- a[796]=0;
- a[797]=0;
- a[798]=0;
- a[799]=0;
- a[800]=0;
- a[801]=0;
- a[802]=0;
- a[803]=0;
- a[804]=0;
- a[805]=0;
- a[806]=0;
- a[807]=0;
- a[808]=0;
- a[809]=0;
- a[810]=0;
- a[811]=0;
- a[812]=0;
- a[813]=0;
- a[814]=0;
- a[815]=0;
- a[816]=0;
- a[817]=0;
- a[818]=0;
- a[819]=0;
- a[820]=0;
- a[821]=0;
- a[822]=0;
- a[823]=0;
- a[824]=0;
- a[825]=0;
- a[826]=0;
- a[827]=0;
- a[828]=0;
- a[829]=0;
- a[830]=0;
- a[831]=0;
- a[832]=0;
- a[833]=0;
- a[834]=0;
- a[835]=0;
- a[836]=0;
- a[837]=0;
- a[838]=0;
- a[839]=0;
- a[840]=0;
- a[841]=0;
- a[842]=0;
- a[843]=0;
- a[844]=0;
- a[845]=0;
- a[846]=0;
- a[847]=0;
- a[848]=0;
- a[849]=0;
- a[850]=0;
- a[851]=0;
- a[852]=0;
- a[853]=0;
- a[854]=0;
- a[855]=0;
- a[856]=0;
- a[857]=0;
- a[858]=0;
- a[859]=0;
- a[860]=0;
- a[861]=0;
- a[862]=0;
- a[863]=0;
- a[864]=0;
- a[865]=0;
- a[866]=0;
- a[867]=0;
- a[868]=0;
- a[869]=0;
- a[870]=0;
- a[871]=0;
- a[872]=0;
- a[873]=0;
- a[874]=0;
- a[875]=0;
- a[876]=0;
- a[877]=0;
- a[878]=0;
- a[879]=0;
- a[880]=0;
- a[881]=0;
- a[882]=0;
- a[883]=0;
- a[884]=0;
- a[885]=0;
- a[886]=0;
- a[887]=0;
- a[888]=0;
- a[889]=0;
- a[890]=0;
- a[891]=0;
- a[892]=0;
- a[893]=0;
- a[894]=0;
- a[895]=0;
- a[896]=0;
- a[897]=0;
- a[898]=0;
- a[899]=0;
- a[900]=0;
- a[901]=0;
- a[902]=0;
- a[903]=0;
- a[904]=0;
- a[905]=0;
- a[906]=0;
- a[907]=0;
- a[908]=0;
- a[909]=0;
- a[910]=0;
- a[911]=0;
- a[912]=0;
- a[913]=0;
- a[914]=0;
- a[915]=0;
- a[916]=0;
- a[917]=0;
- a[918]=0;
- a[919]=0;
- a[920]=0;
- a[921]=0;
- a[922]=0;
- a[923]=0;
- a[924]=0;
- a[925]=0;
- a[926]=0;
- a[927]=0;
- a[928]=0;
- a[929]=0;
- a[930]=0;
- a[931]=0;
- a[932]=0;
- a[933]=0;
- a[934]=0;
- a[935]=0;
- a[936]=0;
- a[937]=0;
- a[938]=0;
- a[939]=0;
- a[940]=0;
- a[941]=0;
- a[942]=0;
- a[943]=0;
- a[944]=0;
- a[945]=0;
- a[946]=0;
- a[947]=0;
- a[948]=0;
- a[949]=0;
- a[950]=0;
- a[951]=0;
- a[952]=0;
- a[953]=0;
- a[954]=0;
- a[955]=0;
- a[956]=0;
- a[957]=0;
- a[958]=0;
- a[959]=0;
- a[960]=0;
- a[961]=0;
- a[962]=0;
- a[963]=0;
- a[964]=0;
- a[965]=0;
- a[966]=0;
- a[967]=0;
- a[968]=0;
- a[969]=0;
- a[970]=0;
- a[971]=0;
- a[972]=0;
- a[973]=0;
- a[974]=0;
- a[975]=0;
- a[976]=0;
- a[977]=0;
- a[978]=0;
- a[979]=0;
- a[980]=0;
- a[981]=0;
- a[982]=0;
- a[983]=0;
- a[984]=0;
- a[985]=0;
- a[986]=0;
- a[987]=0;
- a[988]=0;
- a[989]=0;
- a[990]=0;
- a[991]=0;
- a[992]=0;
- a[993]=0;
- a[994]=0;
- a[995]=0;
- a[996]=0;
- a[997]=0;
- a[998]=0;
- a[999]=0;
- a[1000]=0;
- a[1001]=0;
- a[1002]=0;
- a[1003]=0;
- a[1004]=0;
- a[1005]=0;
- a[1006]=0;
- a[1007]=0;
- a[1008]=0;
- a[1009]=0;
- a[1010]=0;
- a[1011]=0;
- a[1012]=0;
- a[1013]=0;
- a[1014]=0;
- a[1015]=0;
- a[1016]=0;
- a[1017]=0;
- a[1018]=0;
- a[1019]=0;
- a[1020]=0;
- a[1021]=0;
- a[1022]=0;
- a[1023]=0;
- a[1024]=0;
- a[1025]=0;
- a[1026]=0;
- a[1027]=0;
- a[1028]=0;
- a[1029]=0;
- a[1030]=0;
- a[1031]=0;
- a[1032]=0;
- a[1033]=0;
- a[1034]=0;
- a[1035]=0;
- a[1036]=0;
- a[1037]=0;
- a[1038]=0;
- a[1039]=0;
- a[1040]=0;
- a[1041]=0;
- a[1042]=0;
- a[1043]=0;
- a[1044]=0;
- a[1045]=0;
- a[1046]=0;
- a[1047]=0;
- a[1048]=0;
- a[1049]=0;
- a[1050]=0;
- a[1051]=0;
- a[1052]=0;
- a[1053]=0;
- a[1054]=0;
- a[1055]=0;
- a[1056]=0;
- a[1057]=0;
- a[1058]=0;
- a[1059]=0;
- a[1060]=0;
- a[1061]=0;
- a[1062]=0;
- a[1063]=0;
- a[1064]=0;
- a[1065]=0;
- a[1066]=0;
- a[1067]=0;
- a[1068]=0;
- a[1069]=0;
- a[1070]=0;
- a[1071]=0;
- a[1072]=0;
- a[1073]=0;
- a[1074]=0;
- a[1075]=0;
- a[1076]=0;
- a[1077]=0;
- a[1078]=0;
- a[1079]=0;
- a[1080]=0;
- a[1081]=0;
- a[1082]=0;
- a[1083]=0;
- a[1084]=0;
- a[1085]=0;
- a[1086]=0;
- a[1087]=0;
- a[1088]=0;
- a[1089]=0;
- a[1090]=0;
- a[1091]=0;
- a[1092]=0;
- a[1093]=0;
- a[1094]=0;
- a[1095]=0;
- a[1096]=0;
- a[1097]=0;
- a[1098]=0;
- a[1099]=0;
- a[1100]=0;
- a[1101]=0;
- a[1102]=0;
- a[1103]=0;
- a[1104]=0;
- a[1105]=0;
- a[1106]=0;
- a[1107]=0;
- a[1108]=0;
- a[1109]=0;
- a[1110]=0;
- a[1111]=0;
- a[1112]=0;
- a[1113]=0;
- a[1114]=0;
- a[1115]=0;
- a[1116]=0;
- a[1117]=0;
- a[1118]=0;
- a[1119]=0;
- a[1120]=0;
- a[1121]=0;
- a[1122]=0;
- a[1123]=0;
- a[1124]=0;
- a[1125]=0;
- a[1126]=0;
- a[1127]=0;
- a[1128]=0;
- a[1129]=0;
- a[1130]=0;
- a[1131]=0;
- a[1132]=0;
- a[1133]=0;
- a[1134]=0;
- a[1135]=0;
- a[1136]=0;
- a[1137]=0;
- a[1138]=0;
- a[1139]=0;
- a[1140]=0;
- a[1141]=0;
- a[1142]=0;
- a[1143]=0;
- a[1144]=0;
- a[1145]=0;
- a[1146]=0;
- a[1147]=0;
- a[1148]=0;
- a[1149]=0;
- a[1150]=0;
- a[1151]=0;
- a[1152]=0;
- a[1153]=0;
- a[1154]=0;
- a[1155]=0;
- a[1156]=0;
- a[1157]=0;
- a[1158]=0;
- a[1159]=0;
- a[1160]=0;
- a[1161]=0;
- a[1162]=0;
- a[1163]=0;
- a[1164]=0;
- a[1165]=0;
- a[1166]=0;
- a[1167]=0;
- a[1168]=0;
- a[1169]=0;
- a[1170]=0;
- a[1171]=0;
- a[1172]=0;
- a[1173]=0;
- a[1174]=0;
- a[1175]=0;
- a[1176]=0;
- a[1177]=0;
- a[1178]=0;
- a[1179]=0;
- a[1180]=0;
- a[1181]=0;
- a[1182]=0;
- a[1183]=0;
- a[1184]=0;
- a[1185]=0;
- a[1186]=0;
- a[1187]=0;
- a[1188]=0;
- a[1189]=0;
- a[1190]=0;
- a[1191]=0;
- a[1192]=0;
- a[1193]=0;
- a[1194]=0;
- a[1195]=0;
- a[1196]=0;
- a[1197]=0;
- a[1198]=0;
- a[1199]=0;
- a[1200]=0;
- a[1201]=0;
- a[1202]=0;
- a[1203]=0;
- a[1204]=0;
- a[1205]=0;
- a[1206]=0;
- a[1207]=0;
- a[1208]=0;
- a[1209]=0;
- a[1210]=0;
- a[1211]=0;
- a[1212]=0;
- a[1213]=0;
- a[1214]=0;
- a[1215]=0;
- a[1216]=0;
- a[1217]=0;
- a[1218]=0;
- a[1219]=0;
- a[1220]=0;
- a[1221]=0;
- a[1222]=0;
- a[1223]=0;
- a[1224]=0;
- a[1225]=0;
- a[1226]=0;
- a[1227]=0;
- a[1228]=0;
- a[1229]=0;
- a[1230]=0;
- a[1231]=0;
- a[1232]=0;
- a[1233]=0;
- a[1234]=0;
- a[1235]=0;
- a[1236]=0;
- a[1237]=0;
- a[1238]=0;
- a[1239]=0;
- a[1240]=0;
- a[1241]=0;
- a[1242]=0;
- a[1243]=0;
- a[1244]=0;
- a[1245]=0;
- a[1246]=0;
- a[1247]=0;
- a[1248]=0;
- a[1249]=0;
- a[1250]=0;
- a[1251]=0;
- a[1252]=0;
- a[1253]=0;
- a[1254]=0;
- a[1255]=0;
- a[1256]=0;
- a[1257]=0;
- a[1258]=0;
- a[1259]=0;
- a[1260]=0;
- a[1261]=0;
- a[1262]=0;
- a[1263]=0;
- a[1264]=0;
- a[1265]=0;
- a[1266]=0;
- a[1267]=0;
- a[1268]=0;
- a[1269]=0;
- a[1270]=0;
- a[1271]=0;
- a[1272]=0;
- a[1273]=0;
- a[1274]=0;
- a[1275]=0;
- a[1276]=0;
- a[1277]=0;
- a[1278]=0;
- a[1279]=0;
- a[1280]=0;
- a[1281]=0;
- a[1282]=0;
- a[1283]=0;
- a[1284]=0;
- a[1285]=0;
- a[1286]=0;
- a[1287]=0;
- a[1288]=0;
- a[1289]=0;
- a[1290]=0;
- a[1291]=0;
- a[1292]=0;
- a[1293]=0;
- a[1294]=0;
- a[1295]=0;
- a[1296]=0;
- a[1297]=0;
- a[1298]=0;
- a[1299]=0;
- a[1300]=0;
- a[1301]=0;
- a[1302]=0;
- a[1303]=0;
- a[1304]=0;
- a[1305]=0;
- a[1306]=0;
- a[1307]=0;
- a[1308]=0;
- a[1309]=0;
- a[1310]=0;
- a[1311]=0;
- a[1312]=0;
- a[1313]=0;
- a[1314]=0;
- a[1315]=0;
- a[1316]=0;
- a[1317]=0;
- a[1318]=0;
- a[1319]=0;
- a[1320]=0;
- a[1321]=0;
- a[1322]=0;
- a[1323]=0;
- a[1324]=0;
- a[1325]=0;
- a[1326]=0;
- a[1327]=0;
- a[1328]=0;
- a[1329]=0;
- a[1330]=0;
- a[1331]=0;
- a[1332]=0;
- a[1333]=0;
- a[1334]=0;
- a[1335]=0;
- a[1336]=0;
- a[1337]=0;
- a[1338]=0;
- a[1339]=0;
- a[1340]=0;
- a[1341]=0;
- a[1342]=0;
- a[1343]=0;
- a[1344]=0;
- a[1345]=0;
- a[1346]=0;
- a[1347]=0;
- a[1348]=0;
- a[1349]=0;
- a[1350]=0;
- a[1351]=0;
- a[1352]=0;
- a[1353]=0;
- a[1354]=0;
- a[1355]=0;
- a[1356]=0;
- a[1357]=0;
- a[1358]=0;
- a[1359]=0;
- a[1360]=0;
- a[1361]=0;
- a[1362]=0;
- a[1363]=0;
- a[1364]=0;
- a[1365]=0;
- a[1366]=0;
- a[1367]=0;
- a[1368]=0;
- a[1369]=0;
- a[1370]=0;
- a[1371]=0;
- a[1372]=0;
- a[1373]=0;
- a[1374]=0;
- a[1375]=0;
- a[1376]=0;
- a[1377]=0;
- a[1378]=0;
- a[1379]=0;
- a[1380]=0;
- a[1381]=0;
- a[1382]=0;
- a[1383]=0;
- a[1384]=0;
- a[1385]=0;
- a[1386]=0;
- a[1387]=0;
- a[1388]=0;
- a[1389]=0;
- a[1390]=0;
- a[1391]=0;
- a[1392]=0;
- a[1393]=0;
- a[1394]=0;
- a[1395]=0;
- a[1396]=0;
- a[1397]=0;
- a[1398]=0;
- a[1399]=0;
- a[1400]=0;
- a[1401]=0;
- a[1402]=0;
- a[1403]=0;
- a[1404]=0;
- a[1405]=0;
- a[1406]=0;
- a[1407]=0;
- a[1408]=0;
- a[1409]=0;
- a[1410]=0;
- a[1411]=0;
- a[1412]=0;
- a[1413]=0;
- a[1414]=0;
- a[1415]=0;
- a[1416]=0;
- a[1417]=0;
- a[1418]=0;
- a[1419]=0;
- a[1420]=0;
- a[1421]=0;
- a[1422]=0;
- a[1423]=0;
- a[1424]=0;
- a[1425]=0;
- a[1426]=0;
- a[1427]=0;
- a[1428]=0;
- a[1429]=0;
- a[1430]=0;
- a[1431]=0;
- a[1432]=0;
- a[1433]=0;
- a[1434]=0;
- a[1435]=0;
- a[1436]=0;
- a[1437]=0;
- a[1438]=0;
- a[1439]=0;
- a[1440]=0;
- a[1441]=0;
- a[1442]=0;
- a[1443]=0;
- a[1444]=0;
- a[1445]=0;
- a[1446]=0;
- a[1447]=0;
- a[1448]=0;
- a[1449]=0;
- a[1450]=0;
- a[1451]=0;
- a[1452]=0;
- a[1453]=0;
- a[1454]=0;
- a[1455]=0;
- a[1456]=0;
- a[1457]=0;
- a[1458]=0;
- a[1459]=0;
- a[1460]=0;
- a[1461]=0;
- a[1462]=0;
- a[1463]=0;
- a[1464]=0;
- a[1465]=0;
- a[1466]=0;
- a[1467]=0;
- a[1468]=0;
- a[1469]=0;
- a[1470]=0;
- a[1471]=0;
- a[1472]=0;
- a[1473]=0;
- a[1474]=0;
- a[1475]=0;
- a[1476]=0;
- a[1477]=0;
- a[1478]=0;
- a[1479]=0;
- a[1480]=0;
- a[1481]=0;
- a[1482]=0;
- a[1483]=0;
- a[1484]=0;
- a[1485]=0;
- a[1486]=0;
- a[1487]=0;
- a[1488]=0;
- a[1489]=0;
- a[1490]=0;
- a[1491]=0;
- a[1492]=0;
- a[1493]=0;
- a[1494]=0;
- a[1495]=0;
- a[1496]=0;
- a[1497]=0;
- a[1498]=0;
- a[1499]=0;
- a[1500]=0;
- a[1501]=0;
- a[1502]=0;
- a[1503]=0;
- a[1504]=0;
- a[1505]=0;
- a[1506]=0;
- a[1507]=0;
- a[1508]=0;
- a[1509]=0;
- a[1510]=0;
- a[1511]=0;
- a[1512]=0;
- a[1513]=0;
- a[1514]=0;
- a[1515]=0;
- a[1516]=0;
- a[1517]=0;
- a[1518]=0;
- a[1519]=0;
- a[1520]=0;
- a[1521]=0;
- a[1522]=0;
- a[1523]=0;
- a[1524]=0;
- a[1525]=0;
- a[1526]=0;
- a[1527]=0;
- a[1528]=0;
- a[1529]=0;
- a[1530]=0;
- a[1531]=0;
- a[1532]=0;
- a[1533]=0;
- a[1534]=0;
- a[1535]=0;
- a[1536]=0;
- a[1537]=0;
- a[1538]=0;
- a[1539]=0;
- a[1540]=0;
- a[1541]=0;
- a[1542]=0;
- a[1543]=0;
- a[1544]=0;
- a[1545]=0;
- a[1546]=0;
- a[1547]=0;
- a[1548]=0;
- a[1549]=0;
- a[1550]=0;
- a[1551]=0;
- a[1552]=0;
- a[1553]=0;
- a[1554]=0;
- a[1555]=0;
- a[1556]=0;
- a[1557]=0;
- a[1558]=0;
- a[1559]=0;
- a[1560]=0;
- a[1561]=0;
- a[1562]=0;
- a[1563]=0;
- a[1564]=0;
- a[1565]=0;
- a[1566]=0;
- a[1567]=0;
- a[1568]=0;
- a[1569]=0;
- a[1570]=0;
- a[1571]=0;
- a[1572]=0;
- a[1573]=0;
- a[1574]=0;
- a[1575]=0;
- a[1576]=0;
- a[1577]=0;
- a[1578]=0;
- a[1579]=0;
- a[1580]=0;
- a[1581]=0;
- a[1582]=0;
- a[1583]=0;
- a[1584]=0;
- a[1585]=0;
- a[1586]=0;
- a[1587]=0;
- a[1588]=0;
- a[1589]=0;
- a[1590]=0;
- a[1591]=0;
- a[1592]=0;
- a[1593]=0;
- a[1594]=0;
- a[1595]=0;
- a[1596]=0;
- a[1597]=0;
- a[1598]=0;
- a[1599]=0;
- a[1600]=0;
- a[1601]=0;
- a[1602]=0;
- a[1603]=0;
- a[1604]=0;
- a[1605]=0;
- a[1606]=0;
- a[1607]=0;
- a[1608]=0;
- a[1609]=0;
- a[1610]=0;
- a[1611]=0;
- a[1612]=0;
- a[1613]=0;
- a[1614]=0;
- a[1615]=0;
- a[1616]=0;
- a[1617]=0;
- a[1618]=0;
- a[1619]=0;
- a[1620]=0;
- a[1621]=0;
- a[1622]=0;
- a[1623]=0;
- a[1624]=0;
- a[1625]=0;
- a[1626]=0;
- a[1627]=0;
- a[1628]=0;
- a[1629]=0;
- a[1630]=0;
- a[1631]=0;
- a[1632]=0;
- a[1633]=0;
- a[1634]=0;
- a[1635]=0;
- a[1636]=0;
- a[1637]=0;
- a[1638]=0;
- a[1639]=0;
- a[1640]=0;
- a[1641]=0;
- a[1642]=0;
- a[1643]=0;
- a[1644]=0;
- a[1645]=0;
- a[1646]=0;
- a[1647]=0;
- a[1648]=0;
- a[1649]=0;
- a[1650]=0;
- a[1651]=0;
- a[1652]=0;
- a[1653]=0;
- a[1654]=0;
- a[1655]=0;
- a[1656]=0;
- a[1657]=0;
- a[1658]=0;
- a[1659]=0;
- a[1660]=0;
- a[1661]=0;
- a[1662]=0;
- a[1663]=0;
- a[1664]=0;
- a[1665]=0;
- a[1666]=0;
- a[1667]=0;
- a[1668]=0;
- a[1669]=0;
- a[1670]=0;
- a[1671]=0;
- a[1672]=0;
- a[1673]=0;
- a[1674]=0;
- a[1675]=0;
- a[1676]=0;
- a[1677]=0;
- a[1678]=0;
- a[1679]=0;
- a[1680]=0;
- a[1681]=0;
- a[1682]=0;
- a[1683]=0;
- a[1684]=0;
- a[1685]=0;
- a[1686]=0;
- a[1687]=0;
- a[1688]=0;
- a[1689]=0;
- a[1690]=0;
- a[1691]=0;
- a[1692]=0;
- a[1693]=0;
- a[1694]=0;
- a[1695]=0;
- a[1696]=0;
- a[1697]=0;
- a[1698]=0;
- a[1699]=0;
- a[1700]=0;
- a[1701]=0;
- a[1702]=0;
- a[1703]=0;
- a[1704]=0;
- a[1705]=0;
- a[1706]=0;
- a[1707]=0;
- a[1708]=0;
- a[1709]=0;
- a[1710]=0;
- a[1711]=0;
- a[1712]=0;
- a[1713]=0;
- a[1714]=0;
- a[1715]=0;
- a[1716]=0;
- a[1717]=0;
- a[1718]=0;
- a[1719]=0;
- a[1720]=0;
- a[1721]=0;
- a[1722]=0;
- a[1723]=0;
- a[1724]=0;
- a[1725]=0;
- a[1726]=0;
- a[1727]=0;
- a[1728]=0;
- a[1729]=0;
- a[1730]=0;
- a[1731]=0;
- a[1732]=0;
- a[1733]=0;
- a[1734]=0;
- a[1735]=0;
- a[1736]=0;
- a[1737]=0;
- a[1738]=0;
- a[1739]=0;
- a[1740]=0;
- a[1741]=0;
- a[1742]=0;
- a[1743]=0;
- a[1744]=0;
- a[1745]=0;
- a[1746]=0;
- a[1747]=0;
- a[1748]=0;
- a[1749]=0;
- a[1750]=0;
- a[1751]=0;
- a[1752]=0;
- a[1753]=0;
- a[1754]=0;
- a[1755]=0;
- a[1756]=0;
- a[1757]=0;
- a[1758]=0;
- a[1759]=0;
- a[1760]=0;
- a[1761]=0;
- a[1762]=0;
- a[1763]=0;
- a[1764]=0;
- a[1765]=0;
- a[1766]=0;
- a[1767]=0;
- a[1768]=0;
- a[1769]=0;
- a[1770]=0;
- a[1771]=0;
- a[1772]=0;
- a[1773]=0;
- a[1774]=0;
- a[1775]=0;
- a[1776]=0;
- a[1777]=0;
- a[1778]=0;
- a[1779]=0;
- a[1780]=0;
- a[1781]=0;
- a[1782]=0;
- a[1783]=0;
- a[1784]=0;
- a[1785]=0;
- a[1786]=0;
- a[1787]=0;
- a[1788]=0;
- a[1789]=0;
- a[1790]=0;
- a[1791]=0;
- a[1792]=0;
- a[1793]=0;
- a[1794]=0;
- a[1795]=0;
- a[1796]=0;
- a[1797]=0;
- a[1798]=0;
- a[1799]=0;
- a[1800]=0;
- a[1801]=0;
- a[1802]=0;
- a[1803]=0;
- a[1804]=0;
- a[1805]=0;
- a[1806]=0;
- a[1807]=0;
- a[1808]=0;
- a[1809]=0;
- a[1810]=0;
- a[1811]=0;
- a[1812]=0;
- a[1813]=0;
- a[1814]=0;
- a[1815]=0;
- a[1816]=0;
- a[1817]=0;
- a[1818]=0;
- a[1819]=0;
- a[1820]=0;
- a[1821]=0;
- a[1822]=0;
- a[1823]=0;
- a[1824]=0;
- a[1825]=0;
- a[1826]=0;
- a[1827]=0;
- a[1828]=0;
- a[1829]=0;
- a[1830]=0;
- a[1831]=0;
- a[1832]=0;
- a[1833]=0;
- a[1834]=0;
- a[1835]=0;
- a[1836]=0;
- a[1837]=0;
- a[1838]=0;
- a[1839]=0;
- a[1840]=0;
- a[1841]=0;
- a[1842]=0;
- a[1843]=0;
- a[1844]=0;
- a[1845]=0;
- a[1846]=0;
- a[1847]=0;
- a[1848]=0;
- a[1849]=0;
- a[1850]=0;
- a[1851]=0;
- a[1852]=0;
- a[1853]=0;
- a[1854]=0;
- a[1855]=0;
- a[1856]=0;
- a[1857]=0;
- a[1858]=0;
- a[1859]=0;
- a[1860]=0;
- a[1861]=0;
- a[1862]=0;
- a[1863]=0;
- a[1864]=0;
- a[1865]=0;
- a[1866]=0;
- a[1867]=0;
- a[1868]=0;
- a[1869]=0;
- a[1870]=0;
- a[1871]=0;
- a[1872]=0;
- a[1873]=0;
- a[1874]=0;
- a[1875]=0;
- a[1876]=0;
- a[1877]=0;
- a[1878]=0;
- a[1879]=0;
- a[1880]=0;
- a[1881]=0;
- a[1882]=0;
- a[1883]=0;
- a[1884]=0;
- a[1885]=0;
- a[1886]=0;
- a[1887]=0;
- a[1888]=0;
- a[1889]=0;
- a[1890]=0;
- a[1891]=0;
- a[1892]=0;
- a[1893]=0;
- a[1894]=0;
- a[1895]=0;
- a[1896]=0;
- a[1897]=0;
- a[1898]=0;
- a[1899]=0;
- a[1900]=0;
- a[1901]=0;
- a[1902]=0;
- a[1903]=0;
- a[1904]=0;
- a[1905]=0;
- a[1906]=0;
- a[1907]=0;
- a[1908]=0;
- a[1909]=0;
- a[1910]=0;
- a[1911]=0;
- a[1912]=0;
- a[1913]=0;
- a[1914]=0;
- a[1915]=0;
- a[1916]=0;
- a[1917]=0;
- a[1918]=0;
- a[1919]=0;
- a[1920]=0;
- a[1921]=0;
- a[1922]=0;
- a[1923]=0;
- a[1924]=0;
- a[1925]=0;
- a[1926]=0;
- a[1927]=0;
- a[1928]=0;
- a[1929]=0;
- a[1930]=0;
- a[1931]=0;
- a[1932]=0;
- a[1933]=0;
- a[1934]=0;
- a[1935]=0;
- a[1936]=0;
- a[1937]=0;
- a[1938]=0;
- a[1939]=0;
- a[1940]=0;
- a[1941]=0;
- a[1942]=0;
- a[1943]=0;
- a[1944]=0;
- a[1945]=0;
- a[1946]=0;
- a[1947]=0;
- a[1948]=0;
- a[1949]=0;
- a[1950]=0;
- a[1951]=0;
- a[1952]=0;
- a[1953]=0;
- a[1954]=0;
- a[1955]=0;
- a[1956]=0;
- a[1957]=0;
- a[1958]=0;
- a[1959]=0;
- a[1960]=0;
- a[1961]=0;
- a[1962]=0;
- a[1963]=0;
- a[1964]=0;
- a[1965]=0;
- a[1966]=0;
- a[1967]=0;
- a[1968]=0;
- a[1969]=0;
- a[1970]=0;
- a[1971]=0;
- a[1972]=0;
- a[1973]=0;
- a[1974]=0;
- a[1975]=0;
- a[1976]=0;
- a[1977]=0;
- a[1978]=0;
- a[1979]=0;
- a[1980]=0;
- a[1981]=0;
- a[1982]=0;
- a[1983]=0;
- a[1984]=0;
- a[1985]=0;
- a[1986]=0;
- a[1987]=0;
- a[1988]=0;
- a[1989]=0;
- a[1990]=0;
- a[1991]=0;
- a[1992]=0;
- a[1993]=0;
- a[1994]=0;
- a[1995]=0;
- a[1996]=0;
- a[1997]=0;
- a[1998]=0;
- a[1999]=0;
- a[2000]=0;
- a[2001]=0;
- a[2002]=0;
- a[2003]=0;
- a[2004]=0;
- a[2005]=0;
- a[2006]=0;
- a[2007]=0;
- a[2008]=0;
- a[2009]=0;
- a[2010]=0;
- a[2011]=0;
- a[2012]=0;
- a[2013]=0;
- a[2014]=0;
- a[2015]=0;
- a[2016]=0;
- a[2017]=0;
- a[2018]=0;
- a[2019]=0;
- a[2020]=0;
- a[2021]=0;
- a[2022]=0;
- a[2023]=0;
- a[2024]=0;
- a[2025]=0;
- a[2026]=0;
- a[2027]=0;
- a[2028]=0;
- a[2029]=0;
- a[2030]=0;
- a[2031]=0;
- a[2032]=0;
- a[2033]=0;
- a[2034]=0;
- a[2035]=0;
- a[2036]=0;
- a[2037]=0;
- a[2038]=0;
- a[2039]=0;
- a[2040]=0;
- a[2041]=0;
- a[2042]=0;
- a[2043]=0;
- a[2044]=0;
- a[2045]=0;
- a[2046]=0;
- a[2047]=0;
- a[2048]=0;
- a[2049]=0;
- a[2050]=0;
- a[2051]=0;
- a[2052]=0;
- a[2053]=0;
- a[2054]=0;
- a[2055]=0;
- a[2056]=0;
- a[2057]=0;
- a[2058]=0;
- a[2059]=0;
- a[2060]=0;
- a[2061]=0;
- a[2062]=0;
- a[2063]=0;
- a[2064]=0;
- a[2065]=0;
- a[2066]=0;
- a[2067]=0;
- a[2068]=0;
- a[2069]=0;
- a[2070]=0;
- a[2071]=0;
- a[2072]=0;
- a[2073]=0;
- a[2074]=0;
- a[2075]=0;
- a[2076]=0;
- a[2077]=0;
- a[2078]=0;
- a[2079]=0;
- a[2080]=0;
- a[2081]=0;
- a[2082]=0;
- a[2083]=0;
- a[2084]=0;
- a[2085]=0;
- a[2086]=0;
- a[2087]=0;
- a[2088]=0;
- a[2089]=0;
- a[2090]=0;
- a[2091]=0;
- a[2092]=0;
- a[2093]=0;
- a[2094]=0;
- a[2095]=0;
- a[2096]=0;
- a[2097]=0;
- a[2098]=0;
- a[2099]=0;
- a[2100]=0;
- a[2101]=0;
- a[2102]=0;
- a[2103]=0;
- a[2104]=0;
- a[2105]=0;
- a[2106]=0;
- a[2107]=0;
- a[2108]=0;
- a[2109]=0;
- a[2110]=0;
- a[2111]=0;
- a[2112]=0;
- a[2113]=0;
- a[2114]=0;
- a[2115]=0;
- a[2116]=0;
- a[2117]=0;
- a[2118]=0;
- a[2119]=0;
- a[2120]=0;
- a[2121]=0;
- a[2122]=0;
- a[2123]=0;
- a[2124]=0;
- a[2125]=0;
- a[2126]=0;
- a[2127]=0;
- a[2128]=0;
- a[2129]=0;
- a[2130]=0;
- a[2131]=0;
- a[2132]=0;
- a[2133]=0;
- a[2134]=0;
- a[2135]=0;
- a[2136]=0;
- a[2137]=0;
- a[2138]=0;
- a[2139]=0;
- a[2140]=0;
- a[2141]=0;
- a[2142]=0;
- a[2143]=0;
- a[2144]=0;
- a[2145]=0;
- a[2146]=0;
- a[2147]=0;
- a[2148]=0;
- a[2149]=0;
- a[2150]=0;
- a[2151]=0;
- a[2152]=0;
- a[2153]=0;
- a[2154]=0;
- a[2155]=0;
- a[2156]=0;
- a[2157]=0;
- a[2158]=0;
- a[2159]=0;
- a[2160]=0;
- a[2161]=0;
- a[2162]=0;
- a[2163]=0;
- a[2164]=0;
- a[2165]=0;
- a[2166]=0;
- a[2167]=0;
- a[2168]=0;
- a[2169]=0;
- a[2170]=0;
- a[2171]=0;
- a[2172]=0;
- a[2173]=0;
- a[2174]=0;
- a[2175]=0;
- a[2176]=0;
- a[2177]=0;
- a[2178]=0;
- a[2179]=0;
- a[2180]=0;
- a[2181]=0;
- a[2182]=0;
- a[2183]=0;
- a[2184]=0;
- a[2185]=0;
- a[2186]=0;
- a[2187]=0;
- a[2188]=0;
- a[2189]=0;
- a[2190]=0;
- a[2191]=0;
- a[2192]=0;
- a[2193]=0;
- a[2194]=0;
- a[2195]=0;
- a[2196]=0;
- a[2197]=0;
- a[2198]=0;
- a[2199]=0;
- a[2200]=0;
- a[2201]=0;
- a[2202]=0;
- a[2203]=0;
- a[2204]=0;
- a[2205]=0;
- a[2206]=0;
- a[2207]=0;
- a[2208]=0;
- a[2209]=0;
- a[2210]=0;
- a[2211]=0;
- a[2212]=0;
- a[2213]=0;
- a[2214]=0;
- a[2215]=0;
- a[2216]=0;
- a[2217]=0;
- a[2218]=0;
- a[2219]=0;
- a[2220]=0;
- a[2221]=0;
- a[2222]=0;
- a[2223]=0;
- a[2224]=0;
- a[2225]=0;
- a[2226]=0;
- a[2227]=0;
- a[2228]=0;
- a[2229]=0;
- a[2230]=0;
- a[2231]=0;
- a[2232]=0;
- a[2233]=0;
- a[2234]=0;
- a[2235]=0;
- a[2236]=0;
- a[2237]=0;
- a[2238]=0;
- a[2239]=0;
- a[2240]=0;
- a[2241]=0;
- a[2242]=0;
- a[2243]=0;
- a[2244]=0;
- a[2245]=0;
- a[2246]=0;
- a[2247]=0;
- a[2248]=0;
- a[2249]=0;
- a[2250]=0;
- a[2251]=0;
- a[2252]=0;
- a[2253]=0;
- a[2254]=0;
- a[2255]=0;
- a[2256]=0;
- a[2257]=0;
- a[2258]=0;
- a[2259]=0;
- a[2260]=0;
- a[2261]=0;
- a[2262]=0;
- a[2263]=0;
- a[2264]=0;
- a[2265]=0;
- a[2266]=0;
- a[2267]=0;
- a[2268]=0;
- a[2269]=0;
- a[2270]=0;
- a[2271]=0;
- a[2272]=0;
- a[2273]=0;
- a[2274]=0;
- a[2275]=0;
- a[2276]=0;
- a[2277]=0;
- a[2278]=0;
- a[2279]=0;
- a[2280]=0;
- a[2281]=0;
- a[2282]=0;
- a[2283]=0;
- a[2284]=0;
- a[2285]=0;
- a[2286]=0;
- a[2287]=0;
- a[2288]=0;
- a[2289]=0;
- a[2290]=0;
- a[2291]=0;
- a[2292]=0;
- a[2293]=0;
- a[2294]=0;
- a[2295]=0;
- a[2296]=0;
- a[2297]=0;
- a[2298]=0;
- a[2299]=0;
- a[2300]=0;
- a[2301]=0;
- a[2302]=0;
- a[2303]=0;
- a[2304]=0;
- a[2305]=0;
- a[2306]=0;
- a[2307]=0;
- a[2308]=0;
- a[2309]=0;
- a[2310]=0;
- a[2311]=0;
- a[2312]=0;
- a[2313]=0;
- a[2314]=0;
- a[2315]=0;
- a[2316]=0;
- a[2317]=0;
- a[2318]=0;
- a[2319]=0;
- a[2320]=0;
- a[2321]=0;
- a[2322]=0;
- a[2323]=0;
- a[2324]=0;
- a[2325]=0;
- a[2326]=0;
- a[2327]=0;
- a[2328]=0;
- a[2329]=0;
- a[2330]=0;
- a[2331]=0;
- a[2332]=0;
- a[2333]=0;
- a[2334]=0;
- a[2335]=0;
- a[2336]=0;
- a[2337]=0;
- a[2338]=0;
- a[2339]=0;
- a[2340]=0;
- a[2341]=0;
- a[2342]=0;
- a[2343]=0;
- a[2344]=0;
- a[2345]=0;
- a[2346]=0;
- a[2347]=0;
- a[2348]=0;
- a[2349]=0;
- a[2350]=0;
- a[2351]=0;
- a[2352]=0;
- a[2353]=0;
- a[2354]=0;
- a[2355]=0;
- a[2356]=0;
- a[2357]=0;
- a[2358]=0;
- a[2359]=0;
- a[2360]=0;
- a[2361]=0;
- a[2362]=0;
- a[2363]=0;
- a[2364]=0;
- a[2365]=0;
- a[2366]=0;
- a[2367]=0;
- a[2368]=0;
- a[2369]=0;
- a[2370]=0;
- a[2371]=0;
- a[2372]=0;
- a[2373]=0;
- a[2374]=0;
- a[2375]=0;
- a[2376]=0;
- a[2377]=0;
- a[2378]=0;
- a[2379]=0;
- a[2380]=0;
- a[2381]=0;
- a[2382]=0;
- a[2383]=0;
- a[2384]=0;
- a[2385]=0;
- a[2386]=0;
- a[2387]=0;
- a[2388]=0;
- a[2389]=0;
- a[2390]=0;
- a[2391]=0;
- a[2392]=0;
- a[2393]=0;
- a[2394]=0;
- a[2395]=0;
- a[2396]=0;
- a[2397]=0;
- a[2398]=0;
- a[2399]=0;
- a[2400]=0;
- a[2401]=0;
- a[2402]=0;
- a[2403]=0;
- a[2404]=0;
- a[2405]=0;
- a[2406]=0;
- a[2407]=0;
- a[2408]=0;
- a[2409]=0;
- a[2410]=0;
- a[2411]=0;
- a[2412]=0;
- a[2413]=0;
- a[2414]=0;
- a[2415]=0;
- a[2416]=0;
- a[2417]=0;
- a[2418]=0;
- a[2419]=0;
- a[2420]=0;
- a[2421]=0;
- a[2422]=0;
- a[2423]=0;
- a[2424]=0;
- a[2425]=0;
- a[2426]=0;
- a[2427]=0;
- a[2428]=0;
- a[2429]=0;
- a[2430]=0;
- a[2431]=0;
- a[2432]=0;
- a[2433]=0;
- a[2434]=0;
- a[2435]=0;
- a[2436]=0;
- a[2437]=0;
- a[2438]=0;
- a[2439]=0;
- a[2440]=0;
- a[2441]=0;
- a[2442]=0;
- a[2443]=0;
- a[2444]=0;
- a[2445]=0;
- a[2446]=0;
- a[2447]=0;
- a[2448]=0;
- a[2449]=0;
- a[2450]=0;
- a[2451]=0;
- a[2452]=0;
- a[2453]=0;
- a[2454]=0;
- a[2455]=0;
- a[2456]=0;
- a[2457]=0;
- a[2458]=0;
- a[2459]=0;
- a[2460]=0;
- a[2461]=0;
- a[2462]=0;
- a[2463]=0;
- a[2464]=0;
- a[2465]=0;
- a[2466]=0;
- a[2467]=0;
- a[2468]=0;
- a[2469]=0;
- a[2470]=0;
- a[2471]=0;
- a[2472]=0;
- a[2473]=0;
- a[2474]=0;
- a[2475]=0;
- a[2476]=0;
- a[2477]=0;
- a[2478]=0;
- a[2479]=0;
- a[2480]=0;
- a[2481]=0;
- a[2482]=0;
- a[2483]=0;
- a[2484]=0;
- a[2485]=0;
- a[2486]=0;
- a[2487]=0;
- a[2488]=0;
- a[2489]=0;
- a[2490]=0;
- a[2491]=0;
- a[2492]=0;
- a[2493]=0;
- a[2494]=0;
- a[2495]=0;
- a[2496]=0;
- a[2497]=0;
- a[2498]=0;
- a[2499]=0;
- a[2500]=0;
- a[2501]=0;
- a[2502]=0;
- a[2503]=0;
- a[2504]=0;
- a[2505]=0;
- a[2506]=0;
- a[2507]=0;
- a[2508]=0;
- a[2509]=0;
- a[2510]=0;
- a[2511]=0;
- a[2512]=0;
- a[2513]=0;
- a[2514]=0;
- a[2515]=0;
- a[2516]=0;
- a[2517]=0;
- a[2518]=0;
- a[2519]=0;
- a[2520]=0;
- a[2521]=0;
- a[2522]=0;
- a[2523]=0;
- a[2524]=0;
- a[2525]=0;
- a[2526]=0;
- a[2527]=0;
- a[2528]=0;
- a[2529]=0;
- a[2530]=0;
- a[2531]=0;
- a[2532]=0;
- a[2533]=0;
- a[2534]=0;
- a[2535]=0;
- a[2536]=0;
- a[2537]=0;
- a[2538]=0;
- a[2539]=0;
- a[2540]=0;
- a[2541]=0;
- a[2542]=0;
- a[2543]=0;
- a[2544]=0;
- a[2545]=0;
- a[2546]=0;
- a[2547]=0;
- a[2548]=0;
- a[2549]=0;
- a[2550]=0;
- a[2551]=0;
- a[2552]=0;
- a[2553]=0;
- a[2554]=0;
- a[2555]=0;
- a[2556]=0;
- a[2557]=0;
- a[2558]=0;
- a[2559]=0;
- a[2560]=0;
- a[2561]=0;
- a[2562]=0;
- a[2563]=0;
- a[2564]=0;
- a[2565]=0;
- a[2566]=0;
- a[2567]=0;
- a[2568]=0;
- a[2569]=0;
- a[2570]=0;
- a[2571]=0;
- a[2572]=0;
- a[2573]=0;
- a[2574]=0;
- a[2575]=0;
- a[2576]=0;
- a[2577]=0;
- a[2578]=0;
- a[2579]=0;
- a[2580]=0;
- a[2581]=0;
- a[2582]=0;
- a[2583]=0;
- a[2584]=0;
- a[2585]=0;
- a[2586]=0;
- a[2587]=0;
- a[2588]=0;
- a[2589]=0;
- a[2590]=0;
- a[2591]=0;
- a[2592]=0;
- a[2593]=0;
- a[2594]=0;
- a[2595]=0;
- a[2596]=0;
- a[2597]=0;
- a[2598]=0;
- a[2599]=0;
- a[2600]=0;
- a[2601]=0;
- a[2602]=0;
- a[2603]=0;
- a[2604]=0;
- a[2605]=0;
- a[2606]=0;
- a[2607]=0;
- a[2608]=0;
- a[2609]=0;
- a[2610]=0;
- a[2611]=0;
- a[2612]=0;
- a[2613]=0;
- a[2614]=0;
- a[2615]=0;
- a[2616]=0;
- a[2617]=0;
- a[2618]=0;
- a[2619]=0;
- a[2620]=0;
- a[2621]=0;
- a[2622]=0;
- a[2623]=0;
- a[2624]=0;
- a[2625]=0;
- a[2626]=0;
- a[2627]=0;
- a[2628]=0;
- a[2629]=0;
- a[2630]=0;
- a[2631]=0;
- a[2632]=0;
- a[2633]=0;
- a[2634]=0;
- a[2635]=0;
- a[2636]=0;
- a[2637]=0;
- a[2638]=0;
- a[2639]=0;
- a[2640]=0;
- a[2641]=0;
- a[2642]=0;
- a[2643]=0;
- a[2644]=0;
- a[2645]=0;
- a[2646]=0;
- a[2647]=0;
- a[2648]=0;
- a[2649]=0;
- a[2650]=0;
- a[2651]=0;
- a[2652]=0;
- a[2653]=0;
- a[2654]=0;
- a[2655]=0;
- a[2656]=0;
- a[2657]=0;
- a[2658]=0;
- a[2659]=0;
- a[2660]=0;
- a[2661]=0;
- a[2662]=0;
- a[2663]=0;
- a[2664]=0;
- a[2665]=0;
- a[2666]=0;
- a[2667]=0;
- a[2668]=0;
- a[2669]=0;
- a[2670]=0;
- a[2671]=0;
- a[2672]=0;
- a[2673]=0;
- a[2674]=0;
- a[2675]=0;
- a[2676]=0;
- a[2677]=0;
- a[2678]=0;
- a[2679]=0;
- a[2680]=0;
- a[2681]=0;
- a[2682]=0;
- a[2683]=0;
- a[2684]=0;
- a[2685]=0;
- a[2686]=0;
- a[2687]=0;
- a[2688]=0;
- a[2689]=0;
- a[2690]=0;
- a[2691]=0;
- a[2692]=0;
- a[2693]=0;
- a[2694]=0;
- a[2695]=0;
- a[2696]=0;
- a[2697]=0;
- a[2698]=0;
- a[2699]=0;
- a[2700]=0;
- a[2701]=0;
- a[2702]=0;
- a[2703]=0;
- a[2704]=0;
- a[2705]=0;
- a[2706]=0;
- a[2707]=0;
- a[2708]=0;
- a[2709]=0;
- a[2710]=0;
- a[2711]=0;
- a[2712]=0;
- a[2713]=0;
- a[2714]=0;
- a[2715]=0;
- a[2716]=0;
- a[2717]=0;
- a[2718]=0;
- a[2719]=0;
- a[2720]=0;
- a[2721]=0;
- a[2722]=0;
- a[2723]=0;
- a[2724]=0;
- a[2725]=0;
- a[2726]=0;
- a[2727]=0;
- a[2728]=0;
- a[2729]=0;
- a[2730]=0;
- a[2731]=0;
- a[2732]=0;
- a[2733]=0;
- a[2734]=0;
- a[2735]=0;
- a[2736]=0;
- a[2737]=0;
- a[2738]=0;
- a[2739]=0;
- a[2740]=0;
- a[2741]=0;
- a[2742]=0;
- a[2743]=0;
- a[2744]=0;
- a[2745]=0;
- a[2746]=0;
- a[2747]=0;
- a[2748]=0;
- a[2749]=0;
- a[2750]=0;
- a[2751]=0;
- a[2752]=0;
- a[2753]=0;
- a[2754]=0;
- a[2755]=0;
- a[2756]=0;
- a[2757]=0;
- a[2758]=0;
- a[2759]=0;
- a[2760]=0;
- a[2761]=0;
- a[2762]=0;
- a[2763]=0;
- a[2764]=0;
- a[2765]=0;
- a[2766]=0;
- a[2767]=0;
- a[2768]=0;
- a[2769]=0;
- a[2770]=0;
- a[2771]=0;
- a[2772]=0;
- a[2773]=0;
- a[2774]=0;
- a[2775]=0;
- a[2776]=0;
- a[2777]=0;
- a[2778]=0;
- a[2779]=0;
- a[2780]=0;
- a[2781]=0;
- a[2782]=0;
- a[2783]=0;
- a[2784]=0;
- a[2785]=0;
- a[2786]=0;
- a[2787]=0;
- a[2788]=0;
- a[2789]=0;
- a[2790]=0;
- a[2791]=0;
- a[2792]=0;
- a[2793]=0;
- a[2794]=0;
- a[2795]=0;
- a[2796]=0;
- a[2797]=0;
- a[2798]=0;
- a[2799]=0;
- a[2800]=0;
- a[2801]=0;
- a[2802]=0;
- a[2803]=0;
- a[2804]=0;
- a[2805]=0;
- a[2806]=0;
- a[2807]=0;
- a[2808]=0;
- a[2809]=0;
- a[2810]=0;
- a[2811]=0;
- a[2812]=0;
- a[2813]=0;
- a[2814]=0;
- a[2815]=0;
- a[2816]=0;
- a[2817]=0;
- a[2818]=0;
- a[2819]=0;
- a[2820]=0;
- a[2821]=0;
- a[2822]=0;
- a[2823]=0;
- a[2824]=0;
- a[2825]=0;
- a[2826]=0;
- a[2827]=0;
- a[2828]=0;
- a[2829]=0;
- a[2830]=0;
- a[2831]=0;
- a[2832]=0;
- a[2833]=0;
- a[2834]=0;
- a[2835]=0;
- a[2836]=0;
- a[2837]=0;
- a[2838]=0;
- a[2839]=0;
- a[2840]=0;
- a[2841]=0;
- a[2842]=0;
- a[2843]=0;
- a[2844]=0;
- a[2845]=0;
- a[2846]=0;
- a[2847]=0;
- a[2848]=0;
- a[2849]=0;
- a[2850]=0;
- a[2851]=0;
- a[2852]=0;
- a[2853]=0;
- a[2854]=0;
- a[2855]=0;
- a[2856]=0;
- a[2857]=0;
- a[2858]=0;
- a[2859]=0;
- a[2860]=0;
- a[2861]=0;
- a[2862]=0;
- a[2863]=0;
- a[2864]=0;
- a[2865]=0;
- a[2866]=0;
- a[2867]=0;
- a[2868]=0;
- a[2869]=0;
- a[2870]=0;
- a[2871]=0;
- a[2872]=0;
- a[2873]=0;
- a[2874]=0;
- a[2875]=0;
- a[2876]=0;
- a[2877]=0;
- a[2878]=0;
- a[2879]=0;
- a[2880]=0;
- a[2881]=0;
- a[2882]=0;
- a[2883]=0;
- a[2884]=0;
- a[2885]=0;
- a[2886]=0;
- a[2887]=0;
- a[2888]=0;
- a[2889]=0;
- a[2890]=0;
- a[2891]=0;
- a[2892]=0;
- a[2893]=0;
- a[2894]=0;
- a[2895]=0;
- a[2896]=0;
- a[2897]=0;
- a[2898]=0;
- a[2899]=0;
- a[2900]=0;
- a[2901]=0;
- a[2902]=0;
- a[2903]=0;
- a[2904]=0;
- a[2905]=0;
- a[2906]=0;
- a[2907]=0;
- a[2908]=0;
- a[2909]=0;
- a[2910]=0;
- a[2911]=0;
- a[2912]=0;
- a[2913]=0;
- a[2914]=0;
- a[2915]=0;
- a[2916]=0;
- a[2917]=0;
- a[2918]=0;
- a[2919]=0;
- a[2920]=0;
- a[2921]=0;
- a[2922]=0;
- a[2923]=0;
- a[2924]=0;
- a[2925]=0;
- a[2926]=0;
- a[2927]=0;
- a[2928]=0;
- a[2929]=0;
- a[2930]=0;
- a[2931]=0;
- a[2932]=0;
- a[2933]=0;
- a[2934]=0;
- a[2935]=0;
- a[2936]=0;
- a[2937]=0;
- a[2938]=0;
- a[2939]=0;
- a[2940]=0;
- a[2941]=0;
- a[2942]=0;
- a[2943]=0;
- a[2944]=0;
- a[2945]=0;
- a[2946]=0;
- a[2947]=0;
- a[2948]=0;
- a[2949]=0;
- a[2950]=0;
- a[2951]=0;
- a[2952]=0;
- a[2953]=0;
- a[2954]=0;
- a[2955]=0;
- a[2956]=0;
- a[2957]=0;
- a[2958]=0;
- a[2959]=0;
- a[2960]=0;
- a[2961]=0;
- a[2962]=0;
- a[2963]=0;
- a[2964]=0;
- a[2965]=0;
- a[2966]=0;
- a[2967]=0;
- a[2968]=0;
- a[2969]=0;
- a[2970]=0;
- a[2971]=0;
- a[2972]=0;
- a[2973]=0;
- a[2974]=0;
- a[2975]=0;
- a[2976]=0;
- a[2977]=0;
- a[2978]=0;
- a[2979]=0;
- a[2980]=0;
- a[2981]=0;
- a[2982]=0;
- a[2983]=0;
- a[2984]=0;
- a[2985]=0;
- a[2986]=0;
- a[2987]=0;
- a[2988]=0;
- a[2989]=0;
- a[2990]=0;
- a[2991]=0;
- a[2992]=0;
- a[2993]=0;
- a[2994]=0;
- a[2995]=0;
- a[2996]=0;
- a[2997]=0;
- a[2998]=0;
- a[2999]=0;
- a[3000]=0;
- a[3001]=0;
- a[3002]=0;
- a[3003]=0;
- a[3004]=0;
- a[3005]=0;
- a[3006]=0;
- a[3007]=0;
- a[3008]=0;
- a[3009]=0;
- a[3010]=0;
- a[3011]=0;
- a[3012]=0;
- a[3013]=0;
- a[3014]=0;
- a[3015]=0;
- a[3016]=0;
- a[3017]=0;
- a[3018]=0;
- a[3019]=0;
- a[3020]=0;
- a[3021]=0;
- a[3022]=0;
- a[3023]=0;
- a[3024]=0;
- a[3025]=0;
- a[3026]=0;
- a[3027]=0;
- a[3028]=0;
- a[3029]=0;
- a[3030]=0;
- a[3031]=0;
- a[3032]=0;
- a[3033]=0;
- a[3034]=0;
- a[3035]=0;
- a[3036]=0;
- a[3037]=0;
- a[3038]=0;
- a[3039]=0;
- a[3040]=0;
- a[3041]=0;
- a[3042]=0;
- a[3043]=0;
- a[3044]=0;
- a[3045]=0;
- a[3046]=0;
- a[3047]=0;
- a[3048]=0;
- a[3049]=0;
- a[3050]=0;
- a[3051]=0;
- a[3052]=0;
- a[3053]=0;
- a[3054]=0;
- a[3055]=0;
- a[3056]=0;
- a[3057]=0;
- a[3058]=0;
- a[3059]=0;
- a[3060]=0;
- a[3061]=0;
- a[3062]=0;
- a[3063]=0;
- a[3064]=0;
- a[3065]=0;
- a[3066]=0;
- a[3067]=0;
- a[3068]=0;
- a[3069]=0;
- a[3070]=0;
- a[3071]=0;
- a[3072]=0;
- a[3073]=0;
- a[3074]=0;
- a[3075]=0;
- a[3076]=0;
- a[3077]=0;
- a[3078]=0;
- a[3079]=0;
- a[3080]=0;
- a[3081]=0;
- a[3082]=0;
- a[3083]=0;
- a[3084]=0;
- a[3085]=0;
- a[3086]=0;
- a[3087]=0;
- a[3088]=0;
- a[3089]=0;
- a[3090]=0;
- a[3091]=0;
- a[3092]=0;
- a[3093]=0;
- a[3094]=0;
- a[3095]=0;
- a[3096]=0;
- a[3097]=0;
- a[3098]=0;
- a[3099]=0;
- a[3100]=0;
- a[3101]=0;
- a[3102]=0;
- a[3103]=0;
- a[3104]=0;
- a[3105]=0;
- a[3106]=0;
- a[3107]=0;
- a[3108]=0;
- a[3109]=0;
- a[3110]=0;
- a[3111]=0;
- a[3112]=0;
- a[3113]=0;
- a[3114]=0;
- a[3115]=0;
- a[3116]=0;
- a[3117]=0;
- a[3118]=0;
- a[3119]=0;
- a[3120]=0;
- a[3121]=0;
- a[3122]=0;
- a[3123]=0;
- a[3124]=0;
- a[3125]=0;
- a[3126]=0;
- a[3127]=0;
- a[3128]=0;
- a[3129]=0;
- a[3130]=0;
- a[3131]=0;
- a[3132]=0;
- a[3133]=0;
- a[3134]=0;
- a[3135]=0;
- a[3136]=0;
- a[3137]=0;
- a[3138]=0;
- a[3139]=0;
- a[3140]=0;
- a[3141]=0;
- a[3142]=0;
- a[3143]=0;
- a[3144]=0;
- a[3145]=0;
- a[3146]=0;
- a[3147]=0;
- a[3148]=0;
- a[3149]=0;
- a[3150]=0;
- a[3151]=0;
- a[3152]=0;
- a[3153]=0;
- a[3154]=0;
- a[3155]=0;
- a[3156]=0;
- a[3157]=0;
- a[3158]=0;
- a[3159]=0;
- a[3160]=0;
- a[3161]=0;
- a[3162]=0;
- a[3163]=0;
- a[3164]=0;
- a[3165]=0;
- a[3166]=0;
- a[3167]=0;
- a[3168]=0;
- a[3169]=0;
- a[3170]=0;
- a[3171]=0;
- a[3172]=0;
- a[3173]=0;
- a[3174]=0;
- a[3175]=0;
- a[3176]=0;
- a[3177]=0;
- a[3178]=0;
- a[3179]=0;
- a[3180]=0;
- a[3181]=0;
- a[3182]=0;
- a[3183]=0;
- a[3184]=0;
- a[3185]=0;
- a[3186]=0;
- a[3187]=0;
- a[3188]=0;
- a[3189]=0;
- a[3190]=0;
- a[3191]=0;
- a[3192]=0;
- a[3193]=0;
- a[3194]=0;
- a[3195]=0;
- a[3196]=0;
- a[3197]=0;
- a[3198]=0;
- a[3199]=0;
- a[3200]=0;
- a[3201]=0;
- a[3202]=0;
- a[3203]=0;
- a[3204]=0;
- a[3205]=0;
- a[3206]=0;
- a[3207]=0;
- a[3208]=0;
- a[3209]=0;
- a[3210]=0;
- a[3211]=0;
- a[3212]=0;
- a[3213]=0;
- a[3214]=0;
- a[3215]=0;
- a[3216]=0;
- a[3217]=0;
- a[3218]=0;
- a[3219]=0;
- a[3220]=0;
- a[3221]=0;
- a[3222]=0;
- a[3223]=0;
- a[3224]=0;
- a[3225]=0;
- a[3226]=0;
- a[3227]=0;
- a[3228]=0;
- a[3229]=0;
- a[3230]=0;
- a[3231]=0;
- a[3232]=0;
- a[3233]=0;
- a[3234]=0;
- a[3235]=0;
- a[3236]=0;
- a[3237]=0;
- a[3238]=0;
- a[3239]=0;
- a[3240]=0;
- a[3241]=0;
- a[3242]=0;
- a[3243]=0;
- a[3244]=0;
- a[3245]=0;
- a[3246]=0;
- a[3247]=0;
- a[3248]=0;
- a[3249]=0;
- a[3250]=0;
- a[3251]=0;
- a[3252]=0;
- a[3253]=0;
- a[3254]=0;
- a[3255]=0;
- a[3256]=0;
- a[3257]=0;
- a[3258]=0;
- a[3259]=0;
- a[3260]=0;
- a[3261]=0;
- a[3262]=0;
- a[3263]=0;
- a[3264]=0;
- a[3265]=0;
- a[3266]=0;
- a[3267]=0;
- a[3268]=0;
- a[3269]=0;
- a[3270]=0;
- a[3271]=0;
- a[3272]=0;
- a[3273]=0;
- a[3274]=0;
- a[3275]=0;
- a[3276]=0;
- a[3277]=0;
- a[3278]=0;
- a[3279]=0;
- a[3280]=0;
- a[3281]=0;
- a[3282]=0;
- a[3283]=0;
- a[3284]=0;
- a[3285]=0;
- a[3286]=0;
- a[3287]=0;
- a[3288]=0;
- a[3289]=0;
- a[3290]=0;
- a[3291]=0;
- a[3292]=0;
- a[3293]=0;
- a[3294]=0;
- a[3295]=0;
- a[3296]=0;
- a[3297]=0;
- a[3298]=0;
- a[3299]=0;
- a[3300]=0;
- a[3301]=0;
- a[3302]=0;
- a[3303]=0;
- a[3304]=0;
- a[3305]=0;
- a[3306]=0;
- a[3307]=0;
- a[3308]=0;
- a[3309]=0;
- a[3310]=0;
- a[3311]=0;
- a[3312]=0;
- a[3313]=0;
- a[3314]=0;
- a[3315]=0;
- a[3316]=0;
- a[3317]=0;
- a[3318]=0;
- a[3319]=0;
- a[3320]=0;
- a[3321]=0;
- a[3322]=0;
- a[3323]=0;
- a[3324]=0;
- a[3325]=0;
- a[3326]=0;
- a[3327]=0;
- a[3328]=0;
- a[3329]=0;
- a[3330]=0;
- a[3331]=0;
- a[3332]=0;
- a[3333]=0;
- a[3334]=0;
- a[3335]=0;
- a[3336]=0;
- a[3337]=0;
- a[3338]=0;
- a[3339]=0;
- a[3340]=0;
- a[3341]=0;
- a[3342]=0;
- a[3343]=0;
- a[3344]=0;
- a[3345]=0;
- a[3346]=0;
- a[3347]=0;
- a[3348]=0;
- a[3349]=0;
- a[3350]=0;
- a[3351]=0;
- a[3352]=0;
- a[3353]=0;
- a[3354]=0;
- a[3355]=0;
- a[3356]=0;
- a[3357]=0;
- a[3358]=0;
- a[3359]=0;
- a[3360]=0;
- a[3361]=0;
- a[3362]=0;
- a[3363]=0;
- a[3364]=0;
- a[3365]=0;
- a[3366]=0;
- a[3367]=0;
- a[3368]=0;
- a[3369]=0;
- a[3370]=0;
- a[3371]=0;
- a[3372]=0;
- a[3373]=0;
- a[3374]=0;
- a[3375]=0;
- a[3376]=0;
- a[3377]=0;
- a[3378]=0;
- a[3379]=0;
- a[3380]=0;
- a[3381]=0;
- a[3382]=0;
- a[3383]=0;
- a[3384]=0;
- a[3385]=0;
- a[3386]=0;
- a[3387]=0;
- a[3388]=0;
- a[3389]=0;
- a[3390]=0;
- a[3391]=0;
- a[3392]=0;
- a[3393]=0;
- a[3394]=0;
- a[3395]=0;
- a[3396]=0;
- a[3397]=0;
- a[3398]=0;
- a[3399]=0;
- a[3400]=0;
- a[3401]=0;
- a[3402]=0;
- a[3403]=0;
- a[3404]=0;
- a[3405]=0;
- a[3406]=0;
- a[3407]=0;
- a[3408]=0;
- a[3409]=0;
- a[3410]=0;
- a[3411]=0;
- a[3412]=0;
- a[3413]=0;
- a[3414]=0;
- a[3415]=0;
- a[3416]=0;
- a[3417]=0;
- a[3418]=0;
- a[3419]=0;
- a[3420]=0;
- a[3421]=0;
- a[3422]=0;
- a[3423]=0;
- a[3424]=0;
- a[3425]=0;
- a[3426]=0;
- a[3427]=0;
- a[3428]=0;
- a[3429]=0;
- a[3430]=0;
- a[3431]=0;
- a[3432]=0;
- a[3433]=0;
- a[3434]=0;
- a[3435]=0;
- a[3436]=0;
- a[3437]=0;
- a[3438]=0;
- a[3439]=0;
- a[3440]=0;
- a[3441]=0;
- a[3442]=0;
- a[3443]=0;
- a[3444]=0;
- a[3445]=0;
- a[3446]=0;
- a[3447]=0;
- a[3448]=0;
- a[3449]=0;
- a[3450]=0;
- a[3451]=0;
- a[3452]=0;
- a[3453]=0;
- a[3454]=0;
- a[3455]=0;
- a[3456]=0;
- a[3457]=0;
- a[3458]=0;
- a[3459]=0;
- a[3460]=0;
- a[3461]=0;
- a[3462]=0;
- a[3463]=0;
- a[3464]=0;
- a[3465]=0;
- a[3466]=0;
- a[3467]=0;
- a[3468]=0;
- a[3469]=0;
- a[3470]=0;
- a[3471]=0;
- a[3472]=0;
- a[3473]=0;
- a[3474]=0;
- a[3475]=0;
- a[3476]=0;
- a[3477]=0;
- a[3478]=0;
- a[3479]=0;
- a[3480]=0;
- a[3481]=0;
- a[3482]=0;
- a[3483]=0;
- a[3484]=0;
- a[3485]=0;
- a[3486]=0;
- a[3487]=0;
- a[3488]=0;
- a[3489]=0;
- a[3490]=0;
- a[3491]=0;
- a[3492]=0;
- a[3493]=0;
- a[3494]=0;
- a[3495]=0;
- a[3496]=0;
- a[3497]=0;
- a[3498]=0;
- a[3499]=0;
- a[3500]=0;
- a[3501]=0;
- a[3502]=0;
- a[3503]=0;
- a[3504]=0;
- a[3505]=0;
- a[3506]=0;
- a[3507]=0;
- a[3508]=0;
- a[3509]=0;
- a[3510]=0;
- a[3511]=0;
- a[3512]=0;
- a[3513]=0;
- a[3514]=0;
- a[3515]=0;
- a[3516]=0;
- a[3517]=0;
- a[3518]=0;
- a[3519]=0;
- a[3520]=0;
- a[3521]=0;
- a[3522]=0;
- a[3523]=0;
- a[3524]=0;
- a[3525]=0;
- a[3526]=0;
- a[3527]=0;
- a[3528]=0;
- a[3529]=0;
- a[3530]=0;
- a[3531]=0;
- a[3532]=0;
- a[3533]=0;
- a[3534]=0;
- a[3535]=0;
- a[3536]=0;
- a[3537]=0;
- a[3538]=0;
- a[3539]=0;
- a[3540]=0;
- a[3541]=0;
- a[3542]=0;
- a[3543]=0;
- a[3544]=0;
- a[3545]=0;
- a[3546]=0;
- a[3547]=0;
- a[3548]=0;
- a[3549]=0;
- a[3550]=0;
- a[3551]=0;
- a[3552]=0;
- a[3553]=0;
- a[3554]=0;
- a[3555]=0;
- a[3556]=0;
- a[3557]=0;
- a[3558]=0;
- a[3559]=0;
- a[3560]=0;
- a[3561]=0;
- a[3562]=0;
- a[3563]=0;
- a[3564]=0;
- a[3565]=0;
- a[3566]=0;
- a[3567]=0;
- a[3568]=0;
- a[3569]=0;
- a[3570]=0;
- a[3571]=0;
- a[3572]=0;
- a[3573]=0;
- a[3574]=0;
- a[3575]=0;
- a[3576]=0;
- a[3577]=0;
- a[3578]=0;
- a[3579]=0;
- a[3580]=0;
- a[3581]=0;
- a[3582]=0;
- a[3583]=0;
- a[3584]=0;
- a[3585]=0;
- a[3586]=0;
- a[3587]=0;
- a[3588]=0;
- a[3589]=0;
- a[3590]=0;
- a[3591]=0;
- a[3592]=0;
- a[3593]=0;
- a[3594]=0;
- a[3595]=0;
- a[3596]=0;
- a[3597]=0;
- a[3598]=0;
- a[3599]=0;
- a[3600]=0;
- a[3601]=0;
- a[3602]=0;
- a[3603]=0;
- a[3604]=0;
- a[3605]=0;
- a[3606]=0;
- a[3607]=0;
- a[3608]=0;
- a[3609]=0;
- a[3610]=0;
- a[3611]=0;
- a[3612]=0;
- a[3613]=0;
- a[3614]=0;
- a[3615]=0;
- a[3616]=0;
- a[3617]=0;
- a[3618]=0;
- a[3619]=0;
- a[3620]=0;
- a[3621]=0;
- a[3622]=0;
- a[3623]=0;
- a[3624]=0;
- a[3625]=0;
- a[3626]=0;
- a[3627]=0;
- a[3628]=0;
- a[3629]=0;
- a[3630]=0;
- a[3631]=0;
- a[3632]=0;
- a[3633]=0;
- a[3634]=0;
- a[3635]=0;
- a[3636]=0;
- a[3637]=0;
- a[3638]=0;
- a[3639]=0;
- a[3640]=0;
- a[3641]=0;
- a[3642]=0;
- a[3643]=0;
- a[3644]=0;
- a[3645]=0;
- a[3646]=0;
- a[3647]=0;
- a[3648]=0;
- a[3649]=0;
- a[3650]=0;
- a[3651]=0;
- a[3652]=0;
- a[3653]=0;
- a[3654]=0;
- a[3655]=0;
- a[3656]=0;
- a[3657]=0;
- a[3658]=0;
- a[3659]=0;
- a[3660]=0;
- a[3661]=0;
- a[3662]=0;
- a[3663]=0;
- a[3664]=0;
- a[3665]=0;
- a[3666]=0;
- a[3667]=0;
- a[3668]=0;
- a[3669]=0;
- a[3670]=0;
- a[3671]=0;
- a[3672]=0;
- a[3673]=0;
- a[3674]=0;
- a[3675]=0;
- a[3676]=0;
- a[3677]=0;
- a[3678]=0;
- a[3679]=0;
- a[3680]=0;
- a[3681]=0;
- a[3682]=0;
- a[3683]=0;
- a[3684]=0;
- a[3685]=0;
- a[3686]=0;
- a[3687]=0;
- a[3688]=0;
- a[3689]=0;
- a[3690]=0;
- a[3691]=0;
- a[3692]=0;
- a[3693]=0;
- a[3694]=0;
- a[3695]=0;
- a[3696]=0;
- a[3697]=0;
- a[3698]=0;
- a[3699]=0;
- a[3700]=0;
- a[3701]=0;
- a[3702]=0;
- a[3703]=0;
- a[3704]=0;
- a[3705]=0;
- a[3706]=0;
- a[3707]=0;
- a[3708]=0;
- a[3709]=0;
- a[3710]=0;
- a[3711]=0;
- a[3712]=0;
- a[3713]=0;
- a[3714]=0;
- a[3715]=0;
- a[3716]=0;
- a[3717]=0;
- a[3718]=0;
- a[3719]=0;
- a[3720]=0;
- a[3721]=0;
- a[3722]=0;
- a[3723]=0;
- a[3724]=0;
- a[3725]=0;
- a[3726]=0;
- a[3727]=0;
- a[3728]=0;
- a[3729]=0;
- a[3730]=0;
- a[3731]=0;
- a[3732]=0;
- a[3733]=0;
- a[3734]=0;
- a[3735]=0;
- a[3736]=0;
- a[3737]=0;
- a[3738]=0;
- a[3739]=0;
- a[3740]=0;
- a[3741]=0;
- a[3742]=0;
- a[3743]=0;
- a[3744]=0;
- a[3745]=0;
- a[3746]=0;
- a[3747]=0;
- a[3748]=0;
- a[3749]=0;
- a[3750]=0;
- a[3751]=0;
- a[3752]=0;
- a[3753]=0;
- a[3754]=0;
- a[3755]=0;
- a[3756]=0;
- a[3757]=0;
- a[3758]=0;
- a[3759]=0;
- a[3760]=0;
- a[3761]=0;
- a[3762]=0;
- a[3763]=0;
- a[3764]=0;
- a[3765]=0;
- a[3766]=0;
- a[3767]=0;
- a[3768]=0;
- a[3769]=0;
- a[3770]=0;
- a[3771]=0;
- a[3772]=0;
- a[3773]=0;
- a[3774]=0;
- a[3775]=0;
- a[3776]=0;
- a[3777]=0;
- a[3778]=0;
- a[3779]=0;
- a[3780]=0;
- a[3781]=0;
- a[3782]=0;
- a[3783]=0;
- a[3784]=0;
- a[3785]=0;
- a[3786]=0;
- a[3787]=0;
- a[3788]=0;
- a[3789]=0;
- a[3790]=0;
- a[3791]=0;
- a[3792]=0;
- a[3793]=0;
- a[3794]=0;
- a[3795]=0;
- a[3796]=0;
- a[3797]=0;
- a[3798]=0;
- a[3799]=0;
- a[3800]=0;
- a[3801]=0;
- a[3802]=0;
- a[3803]=0;
- a[3804]=0;
- a[3805]=0;
- a[3806]=0;
- a[3807]=0;
- a[3808]=0;
- a[3809]=0;
- a[3810]=0;
- a[3811]=0;
- a[3812]=0;
- a[3813]=0;
- a[3814]=0;
- a[3815]=0;
- a[3816]=0;
- a[3817]=0;
- a[3818]=0;
- a[3819]=0;
- a[3820]=0;
- a[3821]=0;
- a[3822]=0;
- a[3823]=0;
- a[3824]=0;
- a[3825]=0;
- a[3826]=0;
- a[3827]=0;
- a[3828]=0;
- a[3829]=0;
- a[3830]=0;
- a[3831]=0;
- a[3832]=0;
- a[3833]=0;
- a[3834]=0;
- a[3835]=0;
- a[3836]=0;
- a[3837]=0;
- a[3838]=0;
- a[3839]=0;
- a[3840]=0;
- a[3841]=0;
- a[3842]=0;
- a[3843]=0;
- a[3844]=0;
- a[3845]=0;
- a[3846]=0;
- a[3847]=0;
- a[3848]=0;
- a[3849]=0;
- a[3850]=0;
- a[3851]=0;
- a[3852]=0;
- a[3853]=0;
- a[3854]=0;
- a[3855]=0;
- a[3856]=0;
- a[3857]=0;
- a[3858]=0;
- a[3859]=0;
- a[3860]=0;
- a[3861]=0;
- a[3862]=0;
- a[3863]=0;
- a[3864]=0;
- a[3865]=0;
- a[3866]=0;
- a[3867]=0;
- a[3868]=0;
- a[3869]=0;
- a[3870]=0;
- a[3871]=0;
- a[3872]=0;
- a[3873]=0;
- a[3874]=0;
- a[3875]=0;
- a[3876]=0;
- a[3877]=0;
- a[3878]=0;
- a[3879]=0;
- a[3880]=0;
- a[3881]=0;
- a[3882]=0;
- a[3883]=0;
- a[3884]=0;
- a[3885]=0;
- a[3886]=0;
- a[3887]=0;
- a[3888]=0;
- a[3889]=0;
- a[3890]=0;
- a[3891]=0;
- a[3892]=0;
- a[3893]=0;
- a[3894]=0;
- a[3895]=0;
- a[3896]=0;
- a[3897]=0;
- a[3898]=0;
- a[3899]=0;
- a[3900]=0;
- a[3901]=0;
- a[3902]=0;
- a[3903]=0;
- a[3904]=0;
- a[3905]=0;
- a[3906]=0;
- a[3907]=0;
- a[3908]=0;
- a[3909]=0;
- a[3910]=0;
- a[3911]=0;
- a[3912]=0;
- a[3913]=0;
- a[3914]=0;
- a[3915]=0;
- a[3916]=0;
- a[3917]=0;
- a[3918]=0;
- a[3919]=0;
- a[3920]=0;
- a[3921]=0;
- a[3922]=0;
- a[3923]=0;
- a[3924]=0;
- a[3925]=0;
- a[3926]=0;
- a[3927]=0;
- a[3928]=0;
- a[3929]=0;
- a[3930]=0;
- a[3931]=0;
- a[3932]=0;
- a[3933]=0;
- a[3934]=0;
- a[3935]=0;
- a[3936]=0;
- a[3937]=0;
- a[3938]=0;
- a[3939]=0;
- a[3940]=0;
- a[3941]=0;
- a[3942]=0;
- a[3943]=0;
- a[3944]=0;
- a[3945]=0;
- a[3946]=0;
- a[3947]=0;
- a[3948]=0;
- a[3949]=0;
- a[3950]=0;
- a[3951]=0;
- a[3952]=0;
- a[3953]=0;
- a[3954]=0;
- a[3955]=0;
- a[3956]=0;
- a[3957]=0;
- a[3958]=0;
- a[3959]=0;
- a[3960]=0;
- a[3961]=0;
- a[3962]=0;
- a[3963]=0;
- a[3964]=0;
- a[3965]=0;
- a[3966]=0;
- a[3967]=0;
- a[3968]=0;
- a[3969]=0;
- a[3970]=0;
- a[3971]=0;
- a[3972]=0;
- a[3973]=0;
- a[3974]=0;
- a[3975]=0;
- a[3976]=0;
- a[3977]=0;
- a[3978]=0;
- a[3979]=0;
- a[3980]=0;
- a[3981]=0;
- a[3982]=0;
- a[3983]=0;
- a[3984]=0;
- a[3985]=0;
- a[3986]=0;
- a[3987]=0;
- a[3988]=0;
- a[3989]=0;
- a[3990]=0;
- a[3991]=0;
- a[3992]=0;
- a[3993]=0;
- a[3994]=0;
- a[3995]=0;
- a[3996]=0;
- a[3997]=0;
- a[3998]=0;
- a[3999]=0;
- a[4000]=0;
- a[4001]=0;
- a[4002]=0;
- a[4003]=0;
- a[4004]=0;
- a[4005]=0;
- a[4006]=0;
- a[4007]=0;
- a[4008]=0;
- a[4009]=0;
- a[4010]=0;
- a[4011]=0;
- a[4012]=0;
- a[4013]=0;
- a[4014]=0;
- a[4015]=0;
- a[4016]=0;
- a[4017]=0;
- a[4018]=0;
- a[4019]=0;
- a[4020]=0;
- a[4021]=0;
- a[4022]=0;
- a[4023]=0;
- a[4024]=0;
- a[4025]=0;
- a[4026]=0;
- a[4027]=0;
- a[4028]=0;
- a[4029]=0;
- a[4030]=0;
- a[4031]=0;
- a[4032]=0;
- a[4033]=0;
- a[4034]=0;
- a[4035]=0;
- a[4036]=0;
- a[4037]=0;
- a[4038]=0;
- a[4039]=0;
- a[4040]=0;
- a[4041]=0;
- a[4042]=0;
- a[4043]=0;
- a[4044]=0;
- a[4045]=0;
- a[4046]=0;
- a[4047]=0;
- a[4048]=0;
- a[4049]=0;
- a[4050]=0;
- a[4051]=0;
- a[4052]=0;
- a[4053]=0;
- a[4054]=0;
- a[4055]=0;
- a[4056]=0;
- a[4057]=0;
- a[4058]=0;
- a[4059]=0;
- a[4060]=0;
- a[4061]=0;
- a[4062]=0;
- a[4063]=0;
- a[4064]=0;
- a[4065]=0;
- a[4066]=0;
- a[4067]=0;
- a[4068]=0;
- a[4069]=0;
- a[4070]=0;
- a[4071]=0;
- a[4072]=0;
- a[4073]=0;
- a[4074]=0;
- a[4075]=0;
- a[4076]=0;
- a[4077]=0;
- a[4078]=0;
- a[4079]=0;
- a[4080]=0;
- a[4081]=0;
- a[4082]=0;
- a[4083]=0;
- a[4084]=0;
- a[4085]=0;
- a[4086]=0;
- a[4087]=0;
- a[4088]=0;
- a[4089]=0;
- a[4090]=0;
- a[4091]=0;
- a[4092]=0;
- a[4093]=0;
- a[4094]=0;
- a[4095]=0;
- a[4096]=0;
- a[4097]=0;
- a[4098]=0;
- a[4099]=0;
- a[4100]=0;
- a[4101]=0;
- a[4102]=0;
- a[4103]=0;
- a[4104]=0;
- a[4105]=0;
- a[4106]=0;
- a[4107]=0;
- a[4108]=0;
- a[4109]=0;
- a[4110]=0;
- a[4111]=0;
- a[4112]=0;
- a[4113]=0;
- a[4114]=0;
- a[4115]=0;
- a[4116]=0;
- a[4117]=0;
- a[4118]=0;
- a[4119]=0;
- a[4120]=0;
- a[4121]=0;
- a[4122]=0;
- a[4123]=0;
- a[4124]=0;
- a[4125]=0;
- a[4126]=0;
- a[4127]=0;
- a[4128]=0;
- a[4129]=0;
- a[4130]=0;
- a[4131]=0;
- a[4132]=0;
- a[4133]=0;
- a[4134]=0;
- a[4135]=0;
- a[4136]=0;
- a[4137]=0;
- a[4138]=0;
- a[4139]=0;
- a[4140]=0;
- a[4141]=0;
- a[4142]=0;
- a[4143]=0;
- a[4144]=0;
- a[4145]=0;
- a[4146]=0;
- a[4147]=0;
- a[4148]=0;
- a[4149]=0;
- a[4150]=0;
- a[4151]=0;
- a[4152]=0;
- a[4153]=0;
- a[4154]=0;
- a[4155]=0;
- a[4156]=0;
- a[4157]=0;
- a[4158]=0;
- a[4159]=0;
- a[4160]=0;
- a[4161]=0;
- a[4162]=0;
- a[4163]=0;
- a[4164]=0;
- a[4165]=0;
- a[4166]=0;
- a[4167]=0;
- a[4168]=0;
- a[4169]=0;
- a[4170]=0;
- a[4171]=0;
- a[4172]=0;
- a[4173]=0;
- a[4174]=0;
- a[4175]=0;
- a[4176]=0;
- a[4177]=0;
- a[4178]=0;
- a[4179]=0;
- a[4180]=0;
- a[4181]=0;
- a[4182]=0;
- a[4183]=0;
- a[4184]=0;
- a[4185]=0;
- a[4186]=0;
- a[4187]=0;
- a[4188]=0;
- a[4189]=0;
- a[4190]=0;
- a[4191]=0;
- a[4192]=0;
- a[4193]=0;
- a[4194]=0;
- a[4195]=0;
- a[4196]=0;
- a[4197]=0;
- a[4198]=0;
- a[4199]=0;
- a[4200]=0;
- a[4201]=0;
- a[4202]=0;
- a[4203]=0;
- a[4204]=0;
- a[4205]=0;
- a[4206]=0;
- a[4207]=0;
- a[4208]=0;
- a[4209]=0;
- a[4210]=0;
- a[4211]=0;
- a[4212]=0;
- a[4213]=0;
- a[4214]=0;
- a[4215]=0;
- a[4216]=0;
- a[4217]=0;
- a[4218]=0;
- a[4219]=0;
- a[4220]=0;
- a[4221]=0;
- a[4222]=0;
- a[4223]=0;
- a[4224]=0;
- a[4225]=0;
- a[4226]=0;
- a[4227]=0;
- a[4228]=0;
- a[4229]=0;
- a[4230]=0;
- a[4231]=0;
- a[4232]=0;
- a[4233]=0;
- a[4234]=0;
- a[4235]=0;
- a[4236]=0;
- a[4237]=0;
- a[4238]=0;
- a[4239]=0;
- a[4240]=0;
- a[4241]=0;
- a[4242]=0;
- a[4243]=0;
- a[4244]=0;
- a[4245]=0;
- a[4246]=0;
- a[4247]=0;
- a[4248]=0;
- a[4249]=0;
- a[4250]=0;
- a[4251]=0;
- a[4252]=0;
- a[4253]=0;
- a[4254]=0;
- a[4255]=0;
- a[4256]=0;
- a[4257]=0;
- a[4258]=0;
- a[4259]=0;
- a[4260]=0;
- a[4261]=0;
- a[4262]=0;
- a[4263]=0;
- a[4264]=0;
- a[4265]=0;
- a[4266]=0;
- a[4267]=0;
- a[4268]=0;
- a[4269]=0;
- a[4270]=0;
- a[4271]=0;
- a[4272]=0;
- a[4273]=0;
- a[4274]=0;
- a[4275]=0;
- a[4276]=0;
- a[4277]=0;
- a[4278]=0;
- a[4279]=0;
- a[4280]=0;
- a[4281]=0;
- a[4282]=0;
- a[4283]=0;
- a[4284]=0;
- a[4285]=0;
- a[4286]=0;
- a[4287]=0;
- a[4288]=0;
- a[4289]=0;
- a[4290]=0;
- a[4291]=0;
- a[4292]=0;
- a[4293]=0;
- a[4294]=0;
- a[4295]=0;
- a[4296]=0;
- a[4297]=0;
- a[4298]=0;
- a[4299]=0;
- a[4300]=0;
- a[4301]=0;
- a[4302]=0;
- a[4303]=0;
- a[4304]=0;
- a[4305]=0;
- a[4306]=0;
- a[4307]=0;
- a[4308]=0;
- a[4309]=0;
- a[4310]=0;
- a[4311]=0;
- a[4312]=0;
- a[4313]=0;
- a[4314]=0;
- a[4315]=0;
- a[4316]=0;
- a[4317]=0;
- a[4318]=0;
- a[4319]=0;
- a[4320]=0;
- a[4321]=0;
- a[4322]=0;
- a[4323]=0;
- a[4324]=0;
- a[4325]=0;
- a[4326]=0;
- a[4327]=0;
- a[4328]=0;
- a[4329]=0;
- a[4330]=0;
- a[4331]=0;
- a[4332]=0;
- a[4333]=0;
- a[4334]=0;
- a[4335]=0;
- a[4336]=0;
- a[4337]=0;
- a[4338]=0;
- a[4339]=0;
- a[4340]=0;
- a[4341]=0;
- a[4342]=0;
- a[4343]=0;
- a[4344]=0;
- a[4345]=0;
- a[4346]=0;
- a[4347]=0;
- a[4348]=0;
- a[4349]=0;
- a[4350]=0;
- a[4351]=0;
- a[4352]=0;
- a[4353]=0;
- a[4354]=0;
- a[4355]=0;
- a[4356]=0;
- a[4357]=0;
- a[4358]=0;
- a[4359]=0;
- a[4360]=0;
- a[4361]=0;
- a[4362]=0;
- a[4363]=0;
- a[4364]=0;
- a[4365]=0;
- a[4366]=0;
- a[4367]=0;
- a[4368]=0;
- a[4369]=0;
- a[4370]=0;
- a[4371]=0;
- a[4372]=0;
- a[4373]=0;
- a[4374]=0;
- a[4375]=0;
- a[4376]=0;
- a[4377]=0;
- a[4378]=0;
- a[4379]=0;
- a[4380]=0;
- a[4381]=0;
- a[4382]=0;
- a[4383]=0;
- a[4384]=0;
- a[4385]=0;
- a[4386]=0;
- a[4387]=0;
- a[4388]=0;
- a[4389]=0;
- a[4390]=0;
- a[4391]=0;
- a[4392]=0;
- a[4393]=0;
- a[4394]=0;
- a[4395]=0;
- a[4396]=0;
- a[4397]=0;
- a[4398]=0;
- a[4399]=0;
- a[4400]=0;
- a[4401]=0;
- a[4402]=0;
- a[4403]=0;
- a[4404]=0;
- a[4405]=0;
- a[4406]=0;
- a[4407]=0;
- a[4408]=0;
- a[4409]=0;
- a[4410]=0;
- a[4411]=0;
- a[4412]=0;
- a[4413]=0;
- a[4414]=0;
- a[4415]=0;
- a[4416]=0;
- a[4417]=0;
- a[4418]=0;
- a[4419]=0;
- a[4420]=0;
- a[4421]=0;
- a[4422]=0;
- a[4423]=0;
- a[4424]=0;
- a[4425]=0;
- a[4426]=0;
- a[4427]=0;
- a[4428]=0;
- a[4429]=0;
- a[4430]=0;
- a[4431]=0;
- a[4432]=0;
- a[4433]=0;
- a[4434]=0;
- a[4435]=0;
- a[4436]=0;
- a[4437]=0;
- a[4438]=0;
- a[4439]=0;
- a[4440]=0;
- a[4441]=0;
- a[4442]=0;
- a[4443]=0;
- a[4444]=0;
- a[4445]=0;
- a[4446]=0;
- a[4447]=0;
- a[4448]=0;
- a[4449]=0;
- a[4450]=0;
- a[4451]=0;
- a[4452]=0;
- a[4453]=0;
- a[4454]=0;
- a[4455]=0;
- a[4456]=0;
- a[4457]=0;
- a[4458]=0;
- a[4459]=0;
- a[4460]=0;
- a[4461]=0;
- a[4462]=0;
- a[4463]=0;
- a[4464]=0;
- a[4465]=0;
- a[4466]=0;
- a[4467]=0;
- a[4468]=0;
- a[4469]=0;
- a[4470]=0;
- a[4471]=0;
- a[4472]=0;
- a[4473]=0;
- a[4474]=0;
- a[4475]=0;
- a[4476]=0;
- a[4477]=0;
- a[4478]=0;
- a[4479]=0;
- a[4480]=0;
- a[4481]=0;
- a[4482]=0;
- a[4483]=0;
- a[4484]=0;
- a[4485]=0;
- a[4486]=0;
- a[4487]=0;
- a[4488]=0;
- a[4489]=0;
- a[4490]=0;
- a[4491]=0;
- a[4492]=0;
- a[4493]=0;
- a[4494]=0;
- a[4495]=0;
- a[4496]=0;
- a[4497]=0;
- a[4498]=0;
- a[4499]=0;
- a[4500]=0;
- a[4501]=0;
- a[4502]=0;
- a[4503]=0;
- a[4504]=0;
- a[4505]=0;
- a[4506]=0;
- a[4507]=0;
- a[4508]=0;
- a[4509]=0;
- a[4510]=0;
- a[4511]=0;
- a[4512]=0;
- a[4513]=0;
- a[4514]=0;
- a[4515]=0;
- a[4516]=0;
- a[4517]=0;
- a[4518]=0;
- a[4519]=0;
- a[4520]=0;
- a[4521]=0;
- a[4522]=0;
- a[4523]=0;
- a[4524]=0;
- a[4525]=0;
- a[4526]=0;
- a[4527]=0;
- a[4528]=0;
- a[4529]=0;
- a[4530]=0;
- a[4531]=0;
- a[4532]=0;
- a[4533]=0;
- a[4534]=0;
- a[4535]=0;
- a[4536]=0;
- a[4537]=0;
- a[4538]=0;
- a[4539]=0;
- a[4540]=0;
- a[4541]=0;
- a[4542]=0;
- a[4543]=0;
- a[4544]=0;
- a[4545]=0;
- a[4546]=0;
- a[4547]=0;
- a[4548]=0;
- a[4549]=0;
- a[4550]=0;
- a[4551]=0;
- a[4552]=0;
- a[4553]=0;
- a[4554]=0;
- a[4555]=0;
- a[4556]=0;
- a[4557]=0;
- a[4558]=0;
- a[4559]=0;
- a[4560]=0;
- a[4561]=0;
- a[4562]=0;
- a[4563]=0;
- a[4564]=0;
- a[4565]=0;
- a[4566]=0;
- a[4567]=0;
- a[4568]=0;
- a[4569]=0;
- a[4570]=0;
- a[4571]=0;
- a[4572]=0;
- a[4573]=0;
- a[4574]=0;
- a[4575]=0;
- a[4576]=0;
- a[4577]=0;
- a[4578]=0;
- a[4579]=0;
- a[4580]=0;
- a[4581]=0;
- a[4582]=0;
- a[4583]=0;
- a[4584]=0;
- a[4585]=0;
- a[4586]=0;
- a[4587]=0;
- a[4588]=0;
- a[4589]=0;
- a[4590]=0;
- a[4591]=0;
- a[4592]=0;
- a[4593]=0;
- a[4594]=0;
- a[4595]=0;
- a[4596]=0;
- a[4597]=0;
- a[4598]=0;
- a[4599]=0;
- a[4600]=0;
- a[4601]=0;
- a[4602]=0;
- a[4603]=0;
- a[4604]=0;
- a[4605]=0;
- a[4606]=0;
- a[4607]=0;
- a[4608]=0;
- a[4609]=0;
- a[4610]=0;
- a[4611]=0;
- a[4612]=0;
- a[4613]=0;
- a[4614]=0;
- a[4615]=0;
- a[4616]=0;
- a[4617]=0;
- a[4618]=0;
- a[4619]=0;
- a[4620]=0;
- a[4621]=0;
- a[4622]=0;
- a[4623]=0;
- a[4624]=0;
- a[4625]=0;
- a[4626]=0;
- a[4627]=0;
- a[4628]=0;
- a[4629]=0;
- a[4630]=0;
- a[4631]=0;
- a[4632]=0;
- a[4633]=0;
- a[4634]=0;
- a[4635]=0;
- a[4636]=0;
- a[4637]=0;
- a[4638]=0;
- a[4639]=0;
- a[4640]=0;
- a[4641]=0;
- a[4642]=0;
- a[4643]=0;
- a[4644]=0;
- a[4645]=0;
- a[4646]=0;
- a[4647]=0;
- a[4648]=0;
- a[4649]=0;
- a[4650]=0;
- a[4651]=0;
- a[4652]=0;
- a[4653]=0;
- a[4654]=0;
- a[4655]=0;
- a[4656]=0;
- a[4657]=0;
- a[4658]=0;
- a[4659]=0;
- a[4660]=0;
- a[4661]=0;
- a[4662]=0;
- a[4663]=0;
- a[4664]=0;
- a[4665]=0;
- a[4666]=0;
- a[4667]=0;
- a[4668]=0;
- a[4669]=0;
- a[4670]=0;
- a[4671]=0;
- a[4672]=0;
- a[4673]=0;
- a[4674]=0;
- a[4675]=0;
- a[4676]=0;
- a[4677]=0;
- a[4678]=0;
- a[4679]=0;
- a[4680]=0;
- a[4681]=0;
- a[4682]=0;
- a[4683]=0;
- a[4684]=0;
- a[4685]=0;
- a[4686]=0;
- a[4687]=0;
- a[4688]=0;
- a[4689]=0;
- a[4690]=0;
- a[4691]=0;
- a[4692]=0;
- a[4693]=0;
- a[4694]=0;
- a[4695]=0;
- a[4696]=0;
- a[4697]=0;
- a[4698]=0;
- a[4699]=0;
- a[4700]=0;
- a[4701]=0;
- a[4702]=0;
- a[4703]=0;
- a[4704]=0;
- a[4705]=0;
- a[4706]=0;
- a[4707]=0;
- a[4708]=0;
- a[4709]=0;
- a[4710]=0;
- a[4711]=0;
- a[4712]=0;
- a[4713]=0;
- a[4714]=0;
- a[4715]=0;
- a[4716]=0;
- a[4717]=0;
- a[4718]=0;
- a[4719]=0;
- a[4720]=0;
- a[4721]=0;
- a[4722]=0;
- a[4723]=0;
- a[4724]=0;
- a[4725]=0;
- a[4726]=0;
- a[4727]=0;
- a[4728]=0;
- a[4729]=0;
- a[4730]=0;
- a[4731]=0;
- a[4732]=0;
- a[4733]=0;
- a[4734]=0;
- a[4735]=0;
- a[4736]=0;
- a[4737]=0;
- a[4738]=0;
- a[4739]=0;
- a[4740]=0;
- a[4741]=0;
- a[4742]=0;
- a[4743]=0;
- a[4744]=0;
- a[4745]=0;
- a[4746]=0;
- a[4747]=0;
- a[4748]=0;
- a[4749]=0;
- a[4750]=0;
- a[4751]=0;
- a[4752]=0;
- a[4753]=0;
- a[4754]=0;
- a[4755]=0;
- a[4756]=0;
- a[4757]=0;
- a[4758]=0;
- a[4759]=0;
- a[4760]=0;
- a[4761]=0;
- a[4762]=0;
- a[4763]=0;
- a[4764]=0;
- a[4765]=0;
- a[4766]=0;
- a[4767]=0;
- a[4768]=0;
- a[4769]=0;
- a[4770]=0;
- a[4771]=0;
- a[4772]=0;
- a[4773]=0;
- a[4774]=0;
- a[4775]=0;
- a[4776]=0;
- a[4777]=0;
- a[4778]=0;
- a[4779]=0;
- a[4780]=0;
- a[4781]=0;
- a[4782]=0;
- a[4783]=0;
- a[4784]=0;
- a[4785]=0;
- a[4786]=0;
- a[4787]=0;
- a[4788]=0;
- a[4789]=0;
- a[4790]=0;
- a[4791]=0;
- a[4792]=0;
- a[4793]=0;
- a[4794]=0;
- a[4795]=0;
- a[4796]=0;
- a[4797]=0;
- a[4798]=0;
- a[4799]=0;
- a[4800]=0;
- a[4801]=0;
- a[4802]=0;
- a[4803]=0;
- a[4804]=0;
- a[4805]=0;
- a[4806]=0;
- a[4807]=0;
- a[4808]=0;
- a[4809]=0;
- a[4810]=0;
- a[4811]=0;
- a[4812]=0;
- a[4813]=0;
- a[4814]=0;
- a[4815]=0;
- a[4816]=0;
- a[4817]=0;
- a[4818]=0;
- a[4819]=0;
- a[4820]=0;
- a[4821]=0;
- a[4822]=0;
- a[4823]=0;
- a[4824]=0;
- a[4825]=0;
- a[4826]=0;
- a[4827]=0;
- a[4828]=0;
- a[4829]=0;
- a[4830]=0;
- a[4831]=0;
- a[4832]=0;
- a[4833]=0;
- a[4834]=0;
- a[4835]=0;
- a[4836]=0;
- a[4837]=0;
- a[4838]=0;
- a[4839]=0;
- a[4840]=0;
- a[4841]=0;
- a[4842]=0;
- a[4843]=0;
- a[4844]=0;
- a[4845]=0;
- a[4846]=0;
- a[4847]=0;
- a[4848]=0;
- a[4849]=0;
- a[4850]=0;
- a[4851]=0;
- a[4852]=0;
- a[4853]=0;
- a[4854]=0;
- a[4855]=0;
- a[4856]=0;
- a[4857]=0;
- a[4858]=0;
- a[4859]=0;
- a[4860]=0;
- a[4861]=0;
- a[4862]=0;
- a[4863]=0;
- a[4864]=0;
- a[4865]=0;
- a[4866]=0;
- a[4867]=0;
- a[4868]=0;
- a[4869]=0;
- a[4870]=0;
- a[4871]=0;
- a[4872]=0;
- a[4873]=0;
- a[4874]=0;
- a[4875]=0;
- a[4876]=0;
- a[4877]=0;
- a[4878]=0;
- a[4879]=0;
- a[4880]=0;
- a[4881]=0;
- a[4882]=0;
- a[4883]=0;
- a[4884]=0;
- a[4885]=0;
- a[4886]=0;
- a[4887]=0;
- a[4888]=0;
- a[4889]=0;
- a[4890]=0;
- a[4891]=0;
- a[4892]=0;
- a[4893]=0;
- a[4894]=0;
- a[4895]=0;
- a[4896]=0;
- a[4897]=0;
- a[4898]=0;
- a[4899]=0;
- a[4900]=0;
- a[4901]=0;
- a[4902]=0;
- a[4903]=0;
- a[4904]=0;
- a[4905]=0;
- a[4906]=0;
- a[4907]=0;
- a[4908]=0;
- a[4909]=0;
- a[4910]=0;
- a[4911]=0;
- a[4912]=0;
- a[4913]=0;
- a[4914]=0;
- a[4915]=0;
- a[4916]=0;
- a[4917]=0;
- a[4918]=0;
- a[4919]=0;
- a[4920]=0;
- a[4921]=0;
- a[4922]=0;
- a[4923]=0;
- a[4924]=0;
- a[4925]=0;
- a[4926]=0;
- a[4927]=0;
- a[4928]=0;
- a[4929]=0;
- a[4930]=0;
- a[4931]=0;
- a[4932]=0;
- a[4933]=0;
- a[4934]=0;
- a[4935]=0;
- a[4936]=0;
- a[4937]=0;
- a[4938]=0;
- a[4939]=0;
- a[4940]=0;
- a[4941]=0;
- a[4942]=0;
- a[4943]=0;
- a[4944]=0;
- a[4945]=0;
- a[4946]=0;
- a[4947]=0;
- a[4948]=0;
- a[4949]=0;
- a[4950]=0;
- a[4951]=0;
- a[4952]=0;
- a[4953]=0;
- a[4954]=0;
- a[4955]=0;
- a[4956]=0;
- a[4957]=0;
- a[4958]=0;
- a[4959]=0;
- a[4960]=0;
- a[4961]=0;
- a[4962]=0;
- a[4963]=0;
- a[4964]=0;
- a[4965]=0;
- a[4966]=0;
- a[4967]=0;
- a[4968]=0;
- a[4969]=0;
- a[4970]=0;
- a[4971]=0;
- a[4972]=0;
- a[4973]=0;
- a[4974]=0;
- a[4975]=0;
- a[4976]=0;
- a[4977]=0;
- a[4978]=0;
- a[4979]=0;
- a[4980]=0;
- a[4981]=0;
- a[4982]=0;
- a[4983]=0;
- a[4984]=0;
- a[4985]=0;
- a[4986]=0;
- a[4987]=0;
- a[4988]=0;
- a[4989]=0;
- a[4990]=0;
- a[4991]=0;
- a[4992]=0;
- a[4993]=0;
- a[4994]=0;
- a[4995]=0;
- a[4996]=0;
- a[4997]=0;
- a[4998]=0;
- a[4999]=0;
- return a;
-}
diff --git a/test/mjsunit/regress/regress-1980.js b/test/mjsunit/regress/regress-1980.js
index 49dfd06..d87ff45 100644
--- a/test/mjsunit/regress/regress-1980.js
+++ b/test/mjsunit/regress/regress-1980.js
@@ -34,7 +34,7 @@
Error.prototype.toString.call(invalid_this[i]);
} catch (e) {
exception = true;
- assertTrue("called_on_non_object" == e.type);
+ assertEquals("Error.prototype.toString called on non-object", e.message);
}
assertTrue(exception);
}
diff --git a/test/mjsunit/regress/regress-20070207.js b/test/mjsunit/regress/regress-20070207.js
index b7f7a5c..701a079 100644
--- a/test/mjsunit/regress/regress-20070207.js
+++ b/test/mjsunit/regress/regress-20070207.js
@@ -39,4 +39,3 @@
assertFalse(f(-5));
assertFalse(f(0));
assertFalse(f(10));
-
diff --git a/test/mjsunit/regress/regress-201590.js b/test/mjsunit/regress/regress-201590.js
new file mode 100644
index 0000000..0e7ba57
--- /dev/null
+++ b/test/mjsunit/regress/regress-201590.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var gdpRatio = 16/9;
+
+function Foo(initialX, initialY, initialScale, initialMapHeight) {
+ this.ORIGIN = { x: initialX, y: initialY };
+ this.scale = initialScale;
+ this.mapHeight = initialMapHeight;
+}
+
+Foo.prototype.bar = function (x, y, xOffset, yOffset) {
+ var tileHeight = 64 * 0.25 * this.scale,
+ tileWidth = 128 * 0.25 * this.scale,
+ xOffset = xOffset * 0.5 || 0,
+ yOffset = yOffset * 0.5 || 0;
+ var xPos = ((xOffset) * gdpRatio) + this.ORIGIN.x * this.scale -
+ ((y * tileWidth ) * gdpRatio) + ((x * tileWidth ) * gdpRatio);
+ var yPos = ((yOffset) * gdpRatio) + this.ORIGIN.y * this.scale +
+ ((y * tileHeight) * gdpRatio) + ((x * tileHeight) * gdpRatio);
+ xPos = xPos - Math.round(((tileWidth) * gdpRatio)) +
+ this.mapHeight * Math.round(((tileWidth) * gdpRatio));
+ return {
+ x: Math.floor(xPos),
+ y: Math.floor(yPos)
+ };
+}
+
+var f = new Foo(10, 20, 2.5, 400);
+
+function baz() {
+ var b = f.bar(1.1, 2.2, 3.3, 4.4);
+ assertEquals(56529, b.x);
+ assertEquals(288, b.y);
+}
+
+baz();
+baz();
+%OptimizeFunctionOnNextCall(Foo.prototype.bar);
+baz();
diff --git a/test/mjsunit/regress/regress-2027.js b/test/mjsunit/regress/regress-2027.js
index 00ed03f..3f2062b 100644
--- a/test/mjsunit/regress/regress-2027.js
+++ b/test/mjsunit/regress/regress-2027.js
@@ -45,4 +45,3 @@
Check(d.setUTCDate(10));
Check(d.setUTCMonth(10));
Check(d.setUTCFullYear(2010));
-
diff --git a/test/mjsunit/regress/regress-2030.js b/test/mjsunit/regress/regress-2030.js
new file mode 100644
index 0000000..fb5a3d0
--- /dev/null
+++ b/test/mjsunit/regress/regress-2030.js
@@ -0,0 +1,53 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function a() {
+ this.x = 1;
+}
+var aa = new a();
+%DebugPrint(aa);
+
+function b() {
+ this.z = 23;
+ this.x = 2;
+}
+var bb = new b();
+%DebugPrint(bb);
+
+function f(o) {
+ return o.x;
+}
+
+assertSame(1, f(aa));
+assertSame(1, f(aa));
+assertSame(2, f(bb));
+assertSame(2, f(bb));
+%OptimizeFunctionOnNextCall(f);
+assertSame(1, f(aa));
+assertSame(2, f(bb));
diff --git a/test/mjsunit/regress/regress-2032.js b/test/mjsunit/regress/regress-2032.js
new file mode 100644
index 0000000..ad6408d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2032.js
@@ -0,0 +1,64 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// See: http://code.google.com/p/v8/issues/detail?id=2032
+
+// Case independent regexp that ends on the first character in a block.
+assertTrue(/[@-A]/i.test("a"));
+assertTrue(/[@-A]/i.test("A"));
+assertTrue(/[@-A]/i.test("@"));
+
+assertFalse(/[@-A]/.test("a"));
+assertTrue(/[@-A]/.test("A"));
+assertTrue(/[@-A]/.test("@"));
+
+assertFalse(/[¿-À]/i.test('¾'));
+assertTrue(/[¿-À]/i.test('¿'));
+assertTrue(/[¿-À]/i.test('À'));
+assertTrue(/[¿-À]/i.test('à'));
+assertFalse(/[¿-À]/i.test('á'));
+assertFalse(/[¿-À]/i.test('Á'));
+
+assertFalse(/[¿-À]/.test('¾'));
+assertTrue(/[¿-À]/.test('¿'));
+assertTrue(/[¿-À]/.test('À'));
+assertFalse(/[¿-À]/.test('à'));
+assertFalse(/[¿-À]/.test('á'));
+assertFalse(/[¿-À]/.test('á'));
+assertFalse(/[¿-À]/i.test('Á'));
+
+assertFalse(/[Ö-×]/i.test('Õ'));
+assertTrue(/[Ö-×]/i.test('Ö'));
+assertTrue(/[Ö-×]/i.test('ö'));
+assertTrue(/[Ö-×]/i.test('×'));
+assertFalse(/[Ö-×]/i.test('Ø'));
+
+assertFalse(/[Ö-×]/.test('Õ'));
+assertTrue(/[Ö-×]/.test('Ö'));
+assertFalse(/[Ö-×]/.test('ö'));
+assertTrue(/[Ö-×]/.test('×'));
+assertFalse(/[Ö-×]/.test('Ø'));
diff --git a/test/mjsunit/regress/regress-2054.js b/test/mjsunit/regress/regress-2054.js
new file mode 100644
index 0000000..97b989c
--- /dev/null
+++ b/test/mjsunit/regress/regress-2054.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can correctly optimize top level code that contains a
+// throw (or return) as it's last statement.
+
+var N = 1e5; // Number of iterations that trigger optimization.
+for (var i = 0; i < N; i++) {
+ if (i > N) throw new Error;
+}
diff --git a/test/mjsunit/regress/regress-2055.js b/test/mjsunit/regress/regress-2055.js
new file mode 100644
index 0000000..1eaf62c
--- /dev/null
+++ b/test/mjsunit/regress/regress-2055.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that array literal boilerplate objects can be transitioned while
+// existing un-transitioned clones are still being populated.
+
+function test1(depth) {
+ if (--depth < 0) {
+ return [];
+ } else {
+ return [ 0, test1(depth) ];
+ }
+}
+assertEquals([0,[0,[]]], test1(2));
+
+function test2(depth) {
+ if (--depth < 0) {
+ return [];
+ } else {
+ var o = [ 0, test2(depth) ];
+ return (depth == 0) ? 0.5 : o;
+ }
+}
+assertEquals([0,0.5], test2(2));
diff --git a/test/mjsunit/regress/regress-2058.js b/test/mjsunit/regress/regress-2058.js
new file mode 100644
index 0000000..9a69ea1
--- /dev/null
+++ b/test/mjsunit/regress/regress-2058.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+// See http://code.google.com/p/v8/issues/detail?id=2058
+
+// A match after a replace with a function argument needs to reset
+// the flag that determines whether we are using indices or substrings
+// to indicate the last match.
+"Now is the".replace(/Now (\w+) the/g, function() {
+ "foo bar".match(/( )/);
+ assertEquals(RegExp.$1, " ");
+})
diff --git a/test/mjsunit/regress/regress-2073.js b/test/mjsunit/regress/regress-2073.js
new file mode 100644
index 0000000..4e40b04
--- /dev/null
+++ b/test/mjsunit/regress/regress-2073.js
@@ -0,0 +1,99 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Running this test with --trace_gc will show heap size growth due to
+// leaking objects via embedded maps in optimized code.
+
+var counter = 0;
+
+function nextid() {
+ counter += 1;
+ return counter;
+}
+
+function Scope() {
+ this.id = nextid();
+ this.parent = null;
+ this.left = null;
+ this.right = null;
+ this.head = null;
+ this.tail = null;
+ this.counter = 0;
+}
+
+Scope.prototype = {
+ new: function() {
+ var Child,
+ child;
+ Child = function() {};
+ Child.prototype = this;
+ child = new Child();
+ child.id = nextid();
+ child.parent = this;
+ child.left = this.last;
+ child.right = null;
+ child.head = null;
+ child.tail = null;
+ child.counter = 0;
+ if (this.head) {
+ this.tail.right = child;
+ this.tail = child;
+ } else {
+ this.head = this.tail = child;
+ }
+ return child;
+ },
+
+ destroy: function() {
+ if ($root == this) return;
+ var parent = this.parent;
+ if (parent.head == this) parent.head = this.right;
+ if (parent.tail == this) parent.tail = this.left;
+ if (this.left) this.left.right = this.right;
+ if (this.right) this.right.left = this.left;
+ }
+};
+
+function inc(scope) {
+ scope.counter = scope.counter + 1;
+}
+
+var $root = new Scope();
+
+n = 100000;
+m = 10;
+
+function doit() {
+ var a = $root.new();
+ var b = a.new();
+ inc(b);
+ if (i > m) $root.head.destroy();
+}
+
+for (var i = 0; i < n; i++) {
+ doit();
+}
diff --git a/test/mjsunit/regress/regress-2110.js b/test/mjsunit/regress/regress-2110.js
new file mode 100644
index 0000000..d7f78d2
--- /dev/null
+++ b/test/mjsunit/regress/regress-2110.js
@@ -0,0 +1,53 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var uint8 = new Uint8Array(1);
+
+function test() {
+ uint8[0] = 0x800000aa;
+ assertEquals(0xaa, uint8[0]);
+}
+
+test();
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+
+var uint32 = new Uint32Array(1);
+
+function test2() {
+ uint32[0] = 0x80123456789abcde;
+ assertEquals(0x789ac000, uint32[0]);
+}
+
+test2();
+test2();
+%OptimizeFunctionOnNextCall(test2);
+test2();
diff --git a/test/mjsunit/regress/regress-2119.js b/test/mjsunit/regress/regress-2119.js
new file mode 100644
index 0000000..b735ddf
--- /dev/null
+++ b/test/mjsunit/regress/regress-2119.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nouse-ic
+
+function strict_function() {
+ "use strict"
+ undeclared = 1;
+}
+
+assertThrows(strict_function);
diff --git a/test/mjsunit/regress/regress-2132.js b/test/mjsunit/regress/regress-2132.js
new file mode 100644
index 0000000..9eb2dc5
--- /dev/null
+++ b/test/mjsunit/regress/regress-2132.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function mul(x, y) {
+ return (x * y) | 0;
+}
+
+mul(0, 0);
+mul(0, 0);
+%OptimizeFunctionOnNextCall(mul);
+assertEquals(0, mul(0, -1));
+assertOptimized(mul);
+
+function div(x, y) {
+ return (x / y) | 0;
+}
+
+div(4, 2);
+div(4, 2);
+%OptimizeFunctionOnNextCall(div);
+assertEquals(1, div(5, 3));
+assertOptimized(div);
diff --git a/test/mjsunit/regress/regress-2153.js b/test/mjsunit/regress/regress-2153.js
new file mode 100644
index 0000000..3170042
--- /dev/null
+++ b/test/mjsunit/regress/regress-2153.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+o.__defineGetter__('foo', function () { return null; });
+var o = {};
+o.foo = 42;
+assertEquals(42, o.foo);
diff --git a/test/mjsunit/regress/regress-2163.js b/test/mjsunit/regress/regress-2163.js
new file mode 100644
index 0000000..bfce9ff
--- /dev/null
+++ b/test/mjsunit/regress/regress-2163.js
@@ -0,0 +1,70 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Handy abbreviation.
+var dp = Object.defineProperty;
+
+function getter() { return 111; }
+function setter(x) { print(222); }
+function anotherGetter() { return 333; }
+function anotherSetter(x) { print(444); }
+var obj1, obj2;
+
+// obj1 and obj2 share the getter accessor.
+obj1 = {};
+dp(obj1, "alpha", { get: getter, set: setter });
+obj2 = {}
+dp(obj2, "alpha", { get: getter });
+obj1 = {};
+assertEquals(111, obj2.alpha);
+gc();
+assertEquals(111, obj2.alpha);
+
+// obj1, obj2, and obj3 share the getter accessor.
+obj1 = {};
+dp(obj1, "alpha", { get: getter, set: setter });
+obj2 = {}
+dp(obj2, "alpha", { get: getter });
+obj1 = {};
+gc();
+obj3 = {}
+dp(obj3, "alpha", { get: getter });
+
+
+// obj1 and obj2 share the getter and setter accessor.
+obj1 = {};
+dp(obj1, "alpha", { get: getter, set: setter });
+obj1.beta = 10;
+obj2 = {}
+dp(obj2, "alpha", { get: getter, set: setter });
+obj1 = {};
+assertEquals(111, obj2.alpha);
+gc();
+obj2.alpha = 100
+assertEquals(111, obj2.alpha);
diff --git a/test/mjsunit/regress/regress-2170.js b/test/mjsunit/regress/regress-2170.js
new file mode 100644
index 0000000..99f432d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2170.js
@@ -0,0 +1,57 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function array_fun() {
+ for (var i = 0; i < 2; i++) {
+ var a = [1.1, 1.2, 1.3, 1.4, 1.5, 1.6, 1.7, 1.8];
+ var x = new Array();
+ x.fixed$length = true;
+ for (var j = 0; j < a.length; j++) {
+ x.push(a[j]);
+ }
+ for(var j = 0; j < x.length; j++) {
+ if (typeof x[j] != 'number') {
+ throw "foo";
+ }
+ x[j] = x[j];
+ }
+ }
+}
+
+try {
+ for (var i = 0; i < 10; ++i) {
+ array_fun();
+ }
+ %OptimizeFunctionOnNextCall(array_fun);
+ for (var i = 0; i < 10; ++i) {
+ array_fun();
+ }
+} catch (e) {
+ assertUnreachable();
+}
diff --git a/test/mjsunit/regress/regress-2172.js b/test/mjsunit/regress/regress-2172.js
new file mode 100644
index 0000000..6d93845
--- /dev/null
+++ b/test/mjsunit/regress/regress-2172.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+for (var i = 0; i < 10000; i++){
+ (i + "\0").split(/(.)\1/i);
+}
+
+for (var i = 0; i < 10000; i++){
+ (i + "\u1234\0").split(/(.)\1/i);
+}
diff --git a/test/mjsunit/regress/regress-2185-2.js b/test/mjsunit/regress/regress-2185-2.js
new file mode 100644
index 0000000..b1eedb9
--- /dev/null
+++ b/test/mjsunit/regress/regress-2185-2.js
@@ -0,0 +1,145 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// These tests used to time out before this was fixed.
+
+var LEN = 2e4;
+
+function short() {
+ var sum = 0;
+ for (var i = 0; i < 1000; i++) {
+ var a = [1, 4, 34, 23, 6, 123, 3, 2, 11, 515, 4, 33, 22, 2, 2, 1, 0, 123,
+ 23, 42, 43, 1002, 44, 43, 101, 23, 55, 11, 101, 102, 45, 11, 404,
+ 31415, 34, 53, 453, 45, 34, 5, 2, 35, 5, 345, 36, 45, 345, 3, 45,
+ 3, 5, 5, 2, 2342344, 2234, 23, 2718, 1500, 2, 19, 22, 43, 41, 0,
+ -1, 33, 45, 78];
+ a.sort(function(a, b) { return a - b; });
+ sum += a[0];
+ }
+ return sum;
+}
+
+function short_bench(name, array) {
+ var start = new Date();
+ short();
+ var end = new Date();
+ var ms = end - start;
+ print("Short " + Math.floor(ms) + "ms");
+}
+
+function sawseq(a, tooth) {
+ var count = 0;
+ while (true) {
+ for (var i = 0; i < tooth; i++) {
+ a.push(i);
+ if (++count >= LEN) return a;
+ }
+ }
+}
+
+function sawseq2(a, tooth) {
+ var count = 0;
+ while (true) {
+ for (var i = 0; i < tooth; i++) {
+ a.push(i);
+ if (++count >= LEN) return a;
+ }
+ for (var i = 0; i < tooth; i++) {
+ a.push(tooth - i);
+ if (++count >= LEN) return a;
+ }
+ }
+}
+
+function sawseq3(a, tooth) {
+ var count = 0;
+ while (true) {
+ for (var i = 0; i < tooth; i++) {
+ a.push(tooth - i);
+ if (++count >= LEN) return a;
+ }
+ }
+}
+
+function up(a) {
+ for (var i = 0; i < LEN; i++) {
+ a.push(i);
+ }
+ return a;
+}
+
+function down(a) {
+ for (var i = 0; i < LEN; i++) {
+ a.push(LEN - i);
+ }
+ return a;
+}
+
+function ran(a) {
+ for (var i = 0; i < LEN; i++) {
+ a.push(Math.floor(Math.random() * LEN));
+ }
+ return a;
+}
+
+var random = ran([]);
+var asc = up([]);
+var desc = down([]);
+var asc_desc = down(up([]));
+var desc_asc = up(down([]));
+var asc_asc = up(up([]));
+var desc_desc = down(down([]));
+var saw1 = sawseq([], 1000);
+var saw2 = sawseq([], 500);
+var saw3 = sawseq([], 200);
+var saw4 = sawseq2([], 200);
+var saw5 = sawseq3([], 200);
+
+function bench(name, array) {
+ var start = new Date();
+ array.sort(function(a, b) { return a - b; });
+ var end = new Date();
+ for (var i = 0; i < array.length - 1; i++) {
+ if (array[i] > array[i + 1]) throw name + " " + i;
+ }
+ var ms = end - start;
+ print(name + " " + Math.floor(ms) + "ms");
+}
+
+short_bench();
+bench("random", random);
+bench("up", asc);
+bench("down", desc);
+bench("saw 1000", saw1);
+bench("saw 500", saw2);
+bench("saw 200", saw3);
+bench("saw 200 symmetric", saw4);
+bench("saw 200 down", saw4);
+bench("up, down", asc_desc);
+bench("up, up", asc_asc);
+bench("down, down", desc_desc);
+bench("down, up", desc_asc);
diff --git a/test/mjsunit/regress/regress-2185.js b/test/mjsunit/regress/regress-2185.js
new file mode 100644
index 0000000..9b91066
--- /dev/null
+++ b/test/mjsunit/regress/regress-2185.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noenable-slow-asserts
+
+var a = [];
+
+for (var i = 0; i < 2; i++) {
+ for (var j = 0; j < 30000; j++) {
+ a.push(j);
+ }
+}
+
+a.sort(function(a, b) { return a - b; } );
diff --git a/test/mjsunit/regress/regress-2193.js b/test/mjsunit/regress/regress-2193.js
new file mode 100644
index 0000000..50509bf
--- /dev/null
+++ b/test/mjsunit/regress/regress-2193.js
@@ -0,0 +1,58 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --cache-optimized-code
+
+function bozo() {};
+function MakeClosure() {
+ return function f(use_literals) {
+ if (use_literals) {
+ return [1,2,3,3,4,5,6,7,8,9,bozo];
+ } else {
+ return 0;
+ }
+ }
+}
+
+// Create two closures that share the same literal boilerplates.
+var closure1 = MakeClosure();
+var closure2 = MakeClosure();
+var expected = [1,2,3,3,4,5,6,7,8,9,bozo];
+
+// Make sure we generate optimized code for the first closure after
+// warming it up properly so that the literals boilerplate is generated
+// and the optimized code uses CreateArrayLiteralShallow runtime call.
+assertEquals(0, closure1(false));
+assertEquals(expected, closure1(true));
+%OptimizeFunctionOnNextCall(closure1);
+assertEquals(expected, closure1(true));
+
+// Optimize the second closure, which should reuse the optimized code
+// from the first closure with the same literal boilerplates.
+assertEquals(0, closure2(false));
+%OptimizeFunctionOnNextCall(closure2);
+assertEquals(expected, closure2(true));
diff --git a/test/mjsunit/regress/regress-2226.js b/test/mjsunit/regress/regress-2226.js
new file mode 100644
index 0000000..1ac3d30
--- /dev/null
+++ b/test/mjsunit/regress/regress-2226.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = function() { 0; /* foo function */ };
+var bar = function() { 1; /* bar function */ };
+var baz = function() { 2; /* baz function */ };
+
+var test = foo.test = bar.test = baz;
+
+assertEquals(baz, test);
+assertEquals(baz, foo.test);
+assertEquals(baz, bar.test);
diff --git a/test/mjsunit/regress/regress-2234.js b/test/mjsunit/regress/regress-2234.js
new file mode 100644
index 0000000..8da513e
--- /dev/null
+++ b/test/mjsunit/regress/regress-2234.js
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function test(i) {
+ // Overwrite random parts of the transcendental cache.
+ Math.sin(i / 1779 * Math.PI);
+ // Check whether the first cache line has been accidentally overwritten
+ // with incorrect key.
+ assertEquals(0, Math.sin(0));
+}
+
+for (i = 0; i < 10000; ++i) {
+ test(i);
+ if (i == 0) %OptimizeFunctionOnNextCall(test);
+}
diff --git a/test/mjsunit/regress/regress-2249.js b/test/mjsunit/regress/regress-2249.js
new file mode 100644
index 0000000..07d687d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2249.js
@@ -0,0 +1,33 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --gc-interval=10 --stress-compaction
+
+var o = {};
+o[Math.pow(2,30)-1] = 0;
+o[Math.pow(2,31)-1] = 0;
+o[1] = 0;
diff --git a/test/mjsunit/regress/regress-2250.js b/test/mjsunit/regress/regress-2250.js
new file mode 100644
index 0000000..88d4dd4
--- /dev/null
+++ b/test/mjsunit/regress/regress-2250.js
@@ -0,0 +1,67 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// The original problem from the bug: In the example below SMI check for b
+// generated for inlining of equals invocation (marked with (*)) will be hoisted
+// out of the loop across the typeof b === "object" condition and cause an
+// immediate deopt. Another problem here is that no matter how many time we
+// deopt and reopt we will continue to produce the wrong code.
+//
+// The fix is to notice when a deopt and subsequent reopt doesn't find
+// additional type information, indicating that optimistic LICM should be
+// disabled during compilation.
+
+function eq(a, b) {
+ if (typeof b === "object") {
+ return b.equals(a); // (*)
+ }
+ return a === b;
+}
+
+Object.prototype.equals = function (other) {
+ return (this === other);
+};
+
+function test() {
+ for (var i = 0; !eq(i, 10); i++)
+ ;
+}
+
+eq({}, {});
+eq({}, {});
+eq(1, 1);
+eq(1, 1);
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
+%OptimizeFunctionOnNextCall(test);
+// Second compilation should have noticed that LICM wasn't a good idea, and now
+// function should no longer deopt when called.
+test();
+assertOptimized(test);
diff --git a/test/mjsunit/regress/regress-2261.js b/test/mjsunit/regress/regress-2261.js
new file mode 100644
index 0000000..000e07d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2261.js
@@ -0,0 +1,113 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test materialization of the arguments object when deoptimizing a
+// strict mode closure after modifying an argument.
+
+(function () {
+ var forceDeopt = 0;
+ function inner(x) {
+ "use strict";
+ x = 2;
+ // Do not remove this %DebugPrint as it makes sure the deopt happens
+ // after the assignment and is not hoisted above the assignment.
+ %DebugPrint(arguments[0]);
+ forceDeopt + 1;
+ return arguments[0];
+ }
+
+ assertEquals(1, inner(1));
+ assertEquals(1, inner(1));
+ %OptimizeFunctionOnNextCall(inner);
+ assertEquals(1, inner(1));
+ forceDeopt = "not a number";
+ assertEquals(1, inner(1));
+})();
+
+
+// Test materialization of the arguments object when deoptimizing an
+// inlined strict mode closure after modifying an argument.
+
+(function () {
+ var forceDeopt = 0;
+ function inner(x) {
+ "use strict";
+ x = 2;
+ // Do not remove this %DebugPrint as it makes sure the deopt happens
+ // after the assignment and is not hoisted above the assignment.
+ %DebugPrint(arguments[0]);
+ forceDeopt + 1;
+ return arguments[0];
+ }
+
+ function outer(x) {
+ return inner(x);
+ }
+
+ assertEquals(1, outer(1));
+ assertEquals(1, outer(1));
+ %OptimizeFunctionOnNextCall(outer);
+ assertEquals(1, outer(1));
+ forceDeopt = "not a number";
+ assertEquals(1, outer(1));
+})();
+
+
+// Test materialization of the multiple arguments objects when
+// deoptimizing several inlined closure after modifying an argument.
+
+(function () {
+ var forceDeopt = 0;
+ function inner(x,y,z) {
+ "use strict";
+ x = 3;
+ // Do not remove this %DebugPrint as it makes sure the deopt happens
+ // after the assignment and is not hoisted above the assignment.
+ %DebugPrint(arguments[0]);
+ forceDeopt + 1;
+ return arguments[0];
+ }
+
+ function middle(x) {
+ "use strict";
+ x = 2;
+ return inner(10*x, 20*x, 30*x) + arguments[0];
+ }
+
+ function outer(x) {
+ return middle(x);
+ }
+
+ assertEquals(21, outer(1));
+ assertEquals(21, outer(1));
+ %OptimizeFunctionOnNextCall(outer);
+ assertEquals(21, outer(1));
+ forceDeopt = "not a number";
+ assertEquals(21, outer(1));
+})();
diff --git a/test/mjsunit/regress/regress-2263.js b/test/mjsunit/regress/regress-2263.js
new file mode 100644
index 0000000..9a9db58
--- /dev/null
+++ b/test/mjsunit/regress/regress-2263.js
@@ -0,0 +1,30 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var obj = { length: { valueOf: function(){ throw { type: "length" }}}};
+var sep = { toString: function(){ throw { type: "toString" }}};
+assertThrows("Array.prototype.join.call(obj, sep)", undefined, "length");
diff --git a/test/mjsunit/regress/regress-2273.js b/test/mjsunit/regress/regress-2273.js
new file mode 100644
index 0000000..76b5ab6
--- /dev/null
+++ b/test/mjsunit/regress/regress-2273.js
@@ -0,0 +1,103 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var CheckStringReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("string", typeof this);
+};
+
+var CheckNumberReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("number", typeof this);
+};
+
+var CheckUndefinedReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("undefined", String(this));
+};
+
+var CheckNullReceiver = function() {
+ "use strict";
+ // Receivers of strict functions are not coerced.
+ assertEquals("null", String(this));
+};
+
+var CheckCoersion = function() {
+ // Receivers of non-strict functions are coerced to objects.
+ assertEquals("object", typeof this);
+};
+
+
+function strict_mode() {
+ "use strict";
+ CheckStringReceiver.call("foo");
+ CheckNumberReceiver.call(42);
+ CheckUndefinedReceiver.call(undefined);
+ CheckNullReceiver.call(null);
+ [1].forEach(CheckStringReceiver, "foo");
+ [2].every(CheckStringReceiver, "foo");
+ [3].filter(CheckStringReceiver, "foo");
+ [4].some(CheckNumberReceiver, 42);
+ [5].map(CheckNumberReceiver, 42);
+
+ CheckCoersion.call("foo");
+ CheckCoersion.call(42);
+ CheckCoersion.call(undefined);
+ CheckCoersion.call(null);
+ [1].forEach(CheckCoersion, "foo");
+ [2].every(CheckCoersion, "foo");
+ [3].filter(CheckCoersion, "foo");
+ [4].some(CheckCoersion, 42);
+ [5].map(CheckCoersion, 42);
+};
+strict_mode();
+
+function sloppy_mode() {
+ CheckStringReceiver.call("foo");
+ CheckNumberReceiver.call(42);
+ CheckUndefinedReceiver.call(undefined);
+ CheckNullReceiver.call(null);
+ [1].forEach(CheckStringReceiver, "foo");
+ [2].every(CheckStringReceiver, "foo");
+ [3].filter(CheckStringReceiver, "foo");
+ [4].some(CheckNumberReceiver, 42);
+ [5].map(CheckNumberReceiver, 42);
+
+ CheckCoersion.call("foo");
+ CheckCoersion.call(42);
+ CheckCoersion.call(undefined);
+ CheckCoersion.call(null);
+ [1].forEach(CheckCoersion, "foo");
+ [2].every(CheckCoersion, "foo");
+ [3].filter(CheckCoersion, "foo");
+ [4].some(CheckCoersion, 42);
+ [5].map(CheckCoersion, 42);
+};
+sloppy_mode();
diff --git a/test/mjsunit/regress/regress-2284.js b/test/mjsunit/regress/regress-2284.js
new file mode 100644
index 0000000..24bf58e
--- /dev/null
+++ b/test/mjsunit/regress/regress-2284.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("%foobar();", Error);
+assertThrows("%constructor();", Error);
+assertThrows("%constructor(23);", Error);
diff --git a/test/mjsunit/regress/regress-2285.js b/test/mjsunit/regress/regress-2285.js
new file mode 100644
index 0000000..a0d628d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2285.js
@@ -0,0 +1,31 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+assertThrows(function() { %_CallFunction(null, 0, ""); });
+assertThrows(function() { %_CallFunction(null, 0, 1); });
diff --git a/test/mjsunit/regress/regress-2286.js b/test/mjsunit/regress/regress-2286.js
new file mode 100644
index 0000000..0264900
--- /dev/null
+++ b/test/mjsunit/regress/regress-2286.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+assertThrows("f()", ReferenceError);
+assertThrows("%f()", Error);
+assertThrows("%_f()", SyntaxError);
diff --git a/test/mjsunit/regress/regress-2289.js b/test/mjsunit/regress/regress-2289.js
new file mode 100644
index 0000000..d860bbb
--- /dev/null
+++ b/test/mjsunit/regress/regress-2289.js
@@ -0,0 +1,32 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = "a";
+for (var i = 0; i < 12; i++) foo += foo;
+foo = foo + 'b' + foo;
+
+foo.replace(/b/, "a");
diff --git a/test/mjsunit/regress/regress-2291.js b/test/mjsunit/regress/regress-2291.js
new file mode 100644
index 0000000..96627fc
--- /dev/null
+++ b/test/mjsunit/regress/regress-2291.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function StrictCompare(x) { return x === Object(x); }
+
+var obj = new Object();
+var obj2 = new Object();
+obj == obj; // Populate IC cache with non-strict comparison.
+
+StrictCompare(obj); // Set IC in StrictCompare from IC cache.
+
+assertFalse(StrictCompare('foo')); // Use == stub for === operation.
diff --git a/test/mjsunit/regress/regress-2294.js b/test/mjsunit/regress/regress-2294.js
new file mode 100644
index 0000000..43ba10d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2294.js
@@ -0,0 +1,70 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var clampedArray = new Uint8ClampedArray(10);
+
+function test() {
+ clampedArray[0] = 0.499;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = 0.5;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = 0.501;
+ assertEquals(1, clampedArray[0]);
+ clampedArray[0] = 1.499;
+ assertEquals(1, clampedArray[0]);
+ clampedArray[0] = 1.5;
+ assertEquals(2, clampedArray[0]);
+ clampedArray[0] = 1.501;
+ assertEquals(2, clampedArray[0]);
+ clampedArray[0] = 2.5;
+ assertEquals(2, clampedArray[0]);
+ clampedArray[0] = 3.5;
+ assertEquals(4, clampedArray[0]);
+ clampedArray[0] = 252.5;
+ assertEquals(252, clampedArray[0]);
+ clampedArray[0] = 253.5;
+ assertEquals(254, clampedArray[0]);
+ clampedArray[0] = 254.5;
+ assertEquals(254, clampedArray[0]);
+ clampedArray[0] = 256.5;
+ assertEquals(255, clampedArray[0]);
+ clampedArray[0] = -0.5;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = -1.5;
+ assertEquals(0, clampedArray[0]);
+ clampedArray[0] = 1000000000000;
+ assertEquals(255, clampedArray[0]);
+ clampedArray[0] = -1000000000000;
+ assertEquals(0, clampedArray[0]);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/test/mjsunit/regress/regress-2296.js b/test/mjsunit/regress/regress-2296.js
new file mode 100644
index 0000000..c00f14f
--- /dev/null
+++ b/test/mjsunit/regress/regress-2296.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug
+
+function listener(event, exec_state, event_data, data) {
+ event_data.script().setSource(1);
+};
+
+Debug.setListener(listener);
+
+eval('0');
+
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/regress-231.js b/test/mjsunit/regress/regress-231.js
index 0c6e5b3..bce0500 100644
--- a/test/mjsunit/regress/regress-231.js
+++ b/test/mjsunit/regress/regress-231.js
@@ -89,4 +89,4 @@
//Shouldn't crash.
var res = re.test(str);
-assertTrue(res);
\ No newline at end of file
+assertTrue(res);
diff --git a/test/mjsunit/regress/regress-2315.js b/test/mjsunit/regress/regress-2315.js
new file mode 100644
index 0000000..28c78ea
--- /dev/null
+++ b/test/mjsunit/regress/regress-2315.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var foo = (function() {
+ return eval("(function bar() { return 1; })");
+})();
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+
+assertOptimized(foo);
diff --git a/test/mjsunit/regress/regress-2318.js b/test/mjsunit/regress/regress-2318.js
new file mode 100644
index 0000000..e31e0f9
--- /dev/null
+++ b/test/mjsunit/regress/regress-2318.js
@@ -0,0 +1,66 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --nostack-trace-on-abort --stack-size=150
+
+function f() {
+ var i = 0;
+
+ // Stack-allocate to reach the end of stack quickly.
+ var _A0 = 00; var _A1 = 01; var _A2 = 02; var _A3 = 03; var _A4 = 04;
+ var _B0 = 05; var _B1 = 06; var _B2 = 07; var _B3 = 08; var _B4 = 09;
+ var _C0 = 10; var _C1 = 11; var _C2 = 12; var _C3 = 13; var _C4 = 14;
+ var _D0 = 15; var _D1 = 16; var _D2 = 17; var _D3 = 18; var _D4 = 19;
+ var _E0 = 20; var _E1 = 21; var _E2 = 22; var _E3 = 23; var _E4 = 24;
+ var _F0 = 25; var _F1 = 26; var _F2 = 27; var _F3 = 28; var _F4 = 29;
+ var _G0 = 30; var _G1 = 31; var _G2 = 32; var _G3 = 33; var _G4 = 34;
+ var _H0 = 35; var _H1 = 36; var _H2 = 37; var _H3 = 38; var _H4 = 39;
+ var _I0 = 40; var _I1 = 41; var _I2 = 42; var _I3 = 43; var _I4 = 44;
+ var _J0 = 45; var _J1 = 46; var _J2 = 47; var _J3 = 48; var _J4 = 49;
+ var _K0 = 50; var _K1 = 51; var _K2 = 52; var _K3 = 53; var _K4 = 54;
+ var _L0 = 55; var _L1 = 56; var _L2 = 57; var _L3 = 58; var _L4 = 59;
+ var _M0 = 60; var _M1 = 61; var _M2 = 62; var _M3 = 63; var _M4 = 64;
+ var _N0 = 65; var _N1 = 66; var _N2 = 67; var _N3 = 68; var _N4 = 69;
+ var _O0 = 70; var _O1 = 71; var _O2 = 72; var _O3 = 73; var _O4 = 74;
+ var _P0 = 75; var _P1 = 76; var _P2 = 77; var _P3 = 78; var _P4 = 79;
+ var _Q0 = 80; var _Q1 = 81; var _Q2 = 82; var _Q3 = 83; var _Q4 = 84;
+ var _R0 = 85; var _R1 = 86; var _R2 = 87; var _R3 = 88; var _R4 = 89;
+ var _S0 = 90; var _S1 = 91; var _S2 = 92; var _S3 = 93; var _S4 = 94;
+ var _T0 = 95; var _T1 = 96; var _T2 = 97; var _T3 = 98; var _T4 = 99;
+
+ f();
+};
+
+Debug = debug.Debug;
+var bp = Debug.setBreakPoint(f, 0);
+
+function listener(event, exec_state, event_data, data) {
+ result = exec_state.frame().evaluate("i").value();
+};
+
+Debug.setListener(listener);
+assertThrows(function() { f(); }, RangeError);
diff --git a/test/mjsunit/regress/regress-2326.js b/test/mjsunit/regress/regress-2326.js
new file mode 100644
index 0000000..d2edf2b
--- /dev/null
+++ b/test/mjsunit/regress/regress-2326.js
@@ -0,0 +1,54 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This tests that we do not share optimized code across closures that
+// were optimized using OSR (for a particular OSR entry AST id) even if
+// caching of optimized code kicks in.
+
+function makeClosure() {
+ function f(mode, iterations) {
+ var accumulator = 0;
+ if (mode == 1) {
+ while (--iterations > 0) accumulator = Math.ceil(accumulator);
+ return 1;
+ } else {
+ while (--iterations > 0) accumulator = Math.floor(accumulator);
+ return 2;
+ }
+ }
+ return f;
+}
+
+// Generate two closures sharing the same underlying function literal.
+var f1 = makeClosure();
+var f2 = makeClosure();
+
+// This function should be optimized via OSR in the first tight loop.
+assertSame(1, f1(1, 100000));
+
+// This function should be optimized via OSR in the second tight loop.
+assertSame(2, f2(2, 100000));
diff --git a/test/mjsunit/regress/regress-2339.js b/test/mjsunit/regress/regress-2339.js
new file mode 100644
index 0000000..8355446
--- /dev/null
+++ b/test/mjsunit/regress/regress-2339.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function simple() {
+ return simple_two_args(0, undefined);
+}
+
+function simple_two_args(always_zero, always_undefined) {
+ var always_five = always_undefined || 5;
+ return always_zero * always_five * .5;
+}
+
+
+simple();
+simple();
+%OptimizeFunctionOnNextCall(simple);
+simple();
+assertOptimized(simple);
+gc();
diff --git a/test/mjsunit/regress/regress-234101.js b/test/mjsunit/regress/regress-234101.js
new file mode 100644
index 0000000..74228df
--- /dev/null
+++ b/test/mjsunit/regress/regress-234101.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Currently, the gap resolver doesn't handle moves from a ConstantOperand to a
+// DoubleRegister, but these kind of moves appeared when HConstant::EmitAtUses
+// was changed to allow special double values (-0, NaN, hole). So we should
+// either enhance the gap resolver or make sure that such moves don't happen.
+
+function foo(x) {
+ return (x ? NaN : 0.2) + 0.1;
+}
+
+foo(false);
+foo(false);
+%OptimizeFunctionOnNextCall(foo);
+foo(false);
diff --git a/test/mjsunit/regress/regress-2346.js b/test/mjsunit/regress/regress-2346.js
new file mode 100644
index 0000000..4c88b3e
--- /dev/null
+++ b/test/mjsunit/regress/regress-2346.js
@@ -0,0 +1,123 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This file only tests very simple descriptors that always have
+// configurable, enumerable, and writable set to true.
+// A range of more elaborate tests are performed in
+// object-define-property.js
+
+// Flags: --stress-runs=5
+
+function get() { return x; }
+function set(x) { this.x = x; }
+
+var obj = {x: 1};
+obj.__defineGetter__("accessor", get);
+obj.__defineSetter__("accessor", set);
+var a = new Array();
+a[1] = 42;
+obj[1] = 42;
+
+var descIsData = Object.getOwnPropertyDescriptor(obj, 'x');
+assertTrue(descIsData.enumerable);
+assertTrue(descIsData.writable);
+assertTrue(descIsData.configurable);
+
+var descIsAccessor = Object.getOwnPropertyDescriptor(obj, 'accessor');
+assertTrue(descIsAccessor.enumerable);
+assertTrue(descIsAccessor.configurable);
+assertTrue(descIsAccessor.get == get);
+assertTrue(descIsAccessor.set == set);
+
+var descIsNotData = Object.getOwnPropertyDescriptor(obj, 'not-x');
+assertTrue(descIsNotData == undefined);
+
+var descIsNotAccessor = Object.getOwnPropertyDescriptor(obj, 'not-accessor');
+assertTrue(descIsNotAccessor == undefined);
+
+var descArray = Object.getOwnPropertyDescriptor(a, '1');
+assertTrue(descArray.enumerable);
+assertTrue(descArray.configurable);
+assertTrue(descArray.writable);
+assertEquals(descArray.value, 42);
+
+var descObjectElement = Object.getOwnPropertyDescriptor(obj, '1');
+assertTrue(descObjectElement.enumerable);
+assertTrue(descObjectElement.configurable);
+assertTrue(descObjectElement.writable);
+assertEquals(descObjectElement.value, 42);
+
+// String objects.
+var a = new String('foobar');
+for (var i = 0; i < a.length; i++) {
+ var descStringObject = Object.getOwnPropertyDescriptor(a, i);
+ assertTrue(descStringObject.enumerable);
+ assertFalse(descStringObject.configurable);
+ assertFalse(descStringObject.writable);
+ assertEquals(descStringObject.value, a.substring(i, i+1));
+}
+
+// Support for additional attributes on string objects.
+a.x = 42;
+a[10] = 'foo';
+var descStringProperty = Object.getOwnPropertyDescriptor(a, 'x');
+assertTrue(descStringProperty.enumerable);
+assertTrue(descStringProperty.configurable);
+assertTrue(descStringProperty.writable);
+assertEquals(descStringProperty.value, 42);
+
+var descStringElement = Object.getOwnPropertyDescriptor(a, '10');
+assertTrue(descStringElement.enumerable);
+assertTrue(descStringElement.configurable);
+assertTrue(descStringElement.writable);
+assertEquals(descStringElement.value, 'foo');
+
+// Test that elements in the prototype chain is not returned.
+var proto = {};
+proto[10] = 42;
+
+var objWithProto = new Array();
+objWithProto.prototype = proto;
+objWithProto[0] = 'bar';
+var descWithProto = Object.getOwnPropertyDescriptor(objWithProto, '10');
+assertEquals(undefined, descWithProto);
+
+// Test elements on global proxy object.
+var global = (function() { return this; })();
+
+global[42] = 42;
+
+function el_getter() { return 239; };
+function el_setter() {};
+Object.defineProperty(global, '239', {get: el_getter, set: el_setter});
+
+var descRegularElement = Object.getOwnPropertyDescriptor(global, '42');
+assertEquals(42, descRegularElement.value);
+
+var descAccessorElement = Object.getOwnPropertyDescriptor(global, '239');
+assertEquals(el_getter, descAccessorElement.get);
+assertEquals(el_setter, descAccessorElement.set);
diff --git a/test/mjsunit/regress/regress-235311.js b/test/mjsunit/regress/regress-235311.js
new file mode 100644
index 0000000..3007147
--- /dev/null
+++ b/test/mjsunit/regress/regress-235311.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var new_space_string = "";
+for (var i = 0; i < 12800; ++i) {
+ new_space_string +=
+ String.fromCharCode(Math.random() * 26 + (4294967295) | 0);
+}
diff --git a/test/mjsunit/regress/regress-2373.js b/test/mjsunit/regress/regress-2373.js
new file mode 100644
index 0000000..16a87ec
--- /dev/null
+++ b/test/mjsunit/regress/regress-2373.js
@@ -0,0 +1,29 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = JSON.parse('{"a":2600753951}');
+assertEquals(2600753951, o.a);
diff --git a/test/mjsunit/regress/regress-2374.js b/test/mjsunit/regress/regress-2374.js
new file mode 100644
index 0000000..f379cc5
--- /dev/null
+++ b/test/mjsunit/regress/regress-2374.js
@@ -0,0 +1,34 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var msg = '{"result":{"profile":{"head":{"functionName":"(root)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":0,"numberOfCalls":0,"visible":true,"callUID":2771605942,"children":[{"functionName":"(program)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":495.7243772462511,"numberOfCalls":0,"visible":true,"callUID":1902715303,"children":[]}]},"bottomUpHead":{"functionName":"(root)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":0,"numberOfCalls":0,"visible":true,"callUID":2771605942,"children":[{"functionName":"(program)","url":"","lineNumber":0,"totalTime":495.7243772462511,"selfTime":495.7243772462511,"numberOfCalls":0,"visible":true,"callUID":1902715303,"children":[]}]}}},"id":41}';
+
+var obj = JSON.parse(msg);
+var obj2 = JSON.parse(msg);
+
+assertEquals(JSON.stringify(obj), JSON.stringify(obj2));
+assertEquals(JSON.stringify(obj, null, 0), JSON.stringify(obj2));
diff --git a/test/mjsunit/regress/regress-237617.js b/test/mjsunit/regress/regress-237617.js
new file mode 100644
index 0000000..7b7e50f
--- /dev/null
+++ b/test/mjsunit/regress/regress-237617.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict"
+
+function f() {
+ throw new Error("test stack");
+}
+
+var error_stack = "";
+try {
+ f.call(null);
+} catch (e) {
+ error_stack = e.stack;
+}
+
+assertTrue(error_stack.indexOf("test stack") > 0);
+assertTrue(error_stack.indexOf("illegal") < 0);
diff --git a/test/mjsunit/regress/regress-2398.js b/test/mjsunit/regress/regress-2398.js
new file mode 100644
index 0000000..1c66e7f
--- /dev/null
+++ b/test/mjsunit/regress/regress-2398.js
@@ -0,0 +1,41 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict";
+
+var observed = false;
+
+var object = { get toString() { observed = true; } };
+Object.defineProperty(object, "ro", { value: 1 });
+
+try {
+ object.ro = 2; // TypeError caused by trying to write to read-only.
+} catch (e) {
+ e.message; // Forces formatting of the message object.
+}
+
+assertFalse(observed);
diff --git a/test/mjsunit/regress/regress-2410.js b/test/mjsunit/regress/regress-2410.js
new file mode 100644
index 0000000..c16fd14
--- /dev/null
+++ b/test/mjsunit/regress/regress-2410.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Object.prototype should be ignored in Object.getOwnPropertyNames
+//
+// See http://code.google.com/p/v8/issues/detail?id=2410 for details.
+
+Object.defineProperty(Object.prototype,
+ 'thrower',
+ { get: function() { throw Error('bug') } });
+var obj = { thrower: 'local' };
+assertEquals(['thrower'], Object.getOwnPropertyNames(obj));
diff --git a/test/mjsunit/regress/regress-241344.js b/test/mjsunit/regress/regress-241344.js
new file mode 100644
index 0000000..32a9dd3
--- /dev/null
+++ b/test/mjsunit/regress/regress-241344.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create a JSON string for an object with indexed properties.
+// Parsing that string creates a sparse array that grows dense.
+
+var jsonstring = '{"0":0.1, "10000":0.4, ';
+for (var i = 1; i < 9999; i++) {
+ jsonstring += '"' + i + '":0.2, ';
+}
+jsonstring += '"9999":0.3}';
+
+var jsonobject = JSON.parse(jsonstring);
+for (var i = 1; i < 9999; i++) {
+ assertEquals(0.2, jsonobject[i]);
+}
diff --git a/test/mjsunit/regress/regress-2416.js b/test/mjsunit/regress/regress-2416.js
new file mode 100644
index 0000000..02afeb9
--- /dev/null
+++ b/test/mjsunit/regress/regress-2416.js
@@ -0,0 +1,75 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertFalse(2147483647 < -2147483648)
+assertFalse(2147483647 <= -2147483648)
+assertFalse(2147483647 == -2147483648)
+assertTrue(2147483647 >= -2147483648)
+assertTrue(2147483647 > -2147483648)
+
+assertTrue(-2147483648 < 2147483647)
+assertTrue(-2147483648 <= 2147483647)
+assertFalse(-2147483648 == 2147483647)
+assertFalse(-2147483648 >= 2147483647)
+assertFalse(-2147483648 > 2147483647)
+
+assertFalse(2147483647 < 2147483647)
+assertTrue(2147483647 <= 2147483647)
+assertTrue(2147483647 == 2147483647)
+assertTrue(2147483647 >= 2147483647)
+assertFalse(2147483647 > 2147483647)
+
+assertFalse(-2147483648 < -2147483648)
+assertTrue(-2147483648 <= -2147483648)
+assertTrue(-2147483648 == -2147483648)
+assertTrue(-2147483648 >= -2147483648)
+assertFalse(-2147483648 > -2147483648)
+
+
+assertFalse(1073741823 < -1073741824)
+assertFalse(1073741823 <= -1073741824)
+assertFalse(1073741823 == -1073741824)
+assertTrue(1073741823 >= -1073741824)
+assertTrue(1073741823 > -1073741824)
+
+assertTrue(-1073741824 < 1073741823)
+assertTrue(-1073741824 <= 1073741823)
+assertFalse(-1073741824 == 1073741823)
+assertFalse(-1073741824 >= 1073741823)
+assertFalse(-1073741824 > 1073741823)
+
+assertFalse(1073741823 < 1073741823)
+assertTrue(1073741823 <= 1073741823)
+assertTrue(1073741823 == 1073741823)
+assertTrue(1073741823 >= 1073741823)
+assertFalse(1073741823 > 1073741823)
+
+assertFalse(-1073741824 < -1073741824)
+assertTrue(-1073741824 <= -1073741824)
+assertTrue(-1073741824 == -1073741824)
+assertTrue(-1073741824 >= -1073741824)
+assertFalse(-1073741824 > -1073741824)
diff --git a/test/mjsunit/regress/regress-2419.js b/test/mjsunit/regress/regress-2419.js
new file mode 100644
index 0000000..612e6db
--- /dev/null
+++ b/test/mjsunit/regress/regress-2419.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [5, 4, 3, 2, 1, 0];
+Object.freeze(a);
+assertThrows(function() { a.sort(); });
+assertArrayEquals([5, 4, 3, 2, 1, 0], a);
+
+var b = {0: 5, 1: 4, 2: 3, 3: 2, 4: 1, 5: 0, length: 6};
+Object.freeze(b);
+assertThrows(function() { Array.prototype.sort.call(b); });
+assertPropertiesEqual({0: 5, 1: 4, 2: 3, 3: 2, 4: 1, 5: 0, length: 6}, b);
diff --git a/test/mjsunit/regress/regress-2433.js b/test/mjsunit/regress/regress-2433.js
new file mode 100644
index 0000000..dfe7131
--- /dev/null
+++ b/test/mjsunit/regress/regress-2433.js
@@ -0,0 +1,36 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Transitioning from a PackedSmi to PackedDouble should fill the destination
+// with holes.
+//
+// See http://code.google.com/p/v8/issues/detail?id=2433 for details.
+
+arr = [];
+arr[0] = 0;
+arr[0] = 1.1;
+assertEquals(undefined, arr[1]);
diff --git a/test/mjsunit/regress/regress-2437.js b/test/mjsunit/regress/regress-2437.js
new file mode 100644
index 0000000..c82293a
--- /dev/null
+++ b/test/mjsunit/regress/regress-2437.js
@@ -0,0 +1,156 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Summary of the spec: lastIndex is reset to 0 if
+// - a regexp fails to match, regardless of global or non-global.
+// - a global regexp is used in a function that returns multiple results,
+// such as String.prototype.replace or String.prototype.match, since it
+// repeats the regexp until it fails to match.
+// Otherwise lastIndex is only set when a global regexp matches, to the index
+// after the match.
+
+// Test Regexp.prototype.exec
+r = /a/;
+r.lastIndex = 1;
+r.exec("zzzz");
+assertEquals(0, r.lastIndex);
+
+// Test Regexp.prototype.test
+r = /a/;
+r.lastIndex = 1;
+r.test("zzzz");
+assertEquals(0, r.lastIndex);
+
+// Test String.prototype.match
+r = /a/;
+r.lastIndex = 1;
+"zzzz".match(r);
+assertEquals(0, r.lastIndex);
+
+// Test String.prototype.replace with atomic regexp and empty string.
+r = /a/;
+r.lastIndex = 1;
+"zzzz".replace(r, "");
+assertEquals(0, r.lastIndex);
+
+// Test String.prototype.replace with non-atomic regexp and empty string.
+r = /\d/;
+r.lastIndex = 1;
+"zzzz".replace(r, "");
+assertEquals(0, r.lastIndex);
+
+// Test String.prototype.replace with atomic regexp and non-empty string.
+r = /a/;
+r.lastIndex = 1;
+"zzzz".replace(r, "a");
+assertEquals(0, r.lastIndex);
+
+// Test String.prototype.replace with non-atomic regexp and non-empty string.
+r = /\d/;
+r.lastIndex = 1;
+"zzzz".replace(r, "a");
+assertEquals(0, r.lastIndex);
+
+// Test String.prototype.replace with replacement function
+r = /a/;
+r.lastIndex = 1;
+"zzzz".replace(r, function() { return ""; });
+assertEquals(0, r.lastIndex);
+
+// Regexp functions that returns multiple results:
+// A global regexp always resets lastIndex regardless of whether it matches.
+r = /a/g;
+r.lastIndex = -1;
+"0123abcd".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"0123abcd".match(r);
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".match(r);
+assertEquals(0, r.lastIndex);
+
+// A non-global regexp resets lastIndex iff it does not match.
+r = /a/;
+r.lastIndex = -1;
+"0123abcd".replace(r, "x");
+assertEquals(-1, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".replace(r, "x");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = -1;
+"0123abcd".match(r);
+assertEquals(-1, r.lastIndex);
+
+r.lastIndex = -1;
+"01234567".match(r);
+assertEquals(0, r.lastIndex);
+
+// Also test RegExp.prototype.exec and RegExp.prototype.test
+r = /a/g;
+r.lastIndex = 1;
+r.exec("01234567");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = 1;
+r.exec("0123abcd");
+assertEquals(5, r.lastIndex);
+
+r = /a/;
+r.lastIndex = 1;
+r.exec("01234567");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = 1;
+r.exec("0123abcd");
+assertEquals(1, r.lastIndex);
+
+r = /a/g;
+r.lastIndex = 1;
+r.test("01234567");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = 1;
+r.test("0123abcd");
+assertEquals(5, r.lastIndex);
+
+r = /a/;
+r.lastIndex = 1;
+r.test("01234567");
+assertEquals(0, r.lastIndex);
+
+r.lastIndex = 1;
+r.test("0123abcd");
+assertEquals(1, r.lastIndex);
diff --git a/test/mjsunit/regress/regress-2438.js b/test/mjsunit/regress/regress-2438.js
new file mode 100644
index 0000000..7be7e71
--- /dev/null
+++ b/test/mjsunit/regress/regress-2438.js
@@ -0,0 +1,51 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function testSideEffects(subject, re) {
+ var counter = 0;
+ var side_effect_object = { valueOf: function() { return counter++; } };
+ re.lastIndex = side_effect_object;
+ re.exec(subject);
+ assertEquals(1, counter);
+
+ re.lastIndex = side_effect_object;
+ re.test(subject);
+ assertEquals(2, counter);
+
+ re.lastIndex = side_effect_object;
+ subject.match(re);
+ assertEquals(3, counter);
+
+ re.lastIndex = side_effect_object;
+ subject.replace(re, "");
+ assertEquals(4, counter);
+}
+
+testSideEffects("zzzz", /a/);
+testSideEffects("zzzz", /a/g);
+testSideEffects("xaxa", /a/);
+testSideEffects("xaxa", /a/g);
diff --git a/test/mjsunit/regress/regress-2441.js b/test/mjsunit/regress/regress-2441.js
new file mode 100644
index 0000000..72ce248
--- /dev/null
+++ b/test/mjsunit/regress/regress-2441.js
@@ -0,0 +1,31 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+Object.preventExtensions(o);
+assertThrows("Object.defineProperty(o, 'foobarloo', {value:{}});", TypeError);
+assertThrows("Object.defineProperty(o, '__proto__', {value:{}});", TypeError);
diff --git a/test/mjsunit/regress/regress-2443.js b/test/mjsunit/regress/regress-2443.js
new file mode 100644
index 0000000..0800c45
--- /dev/null
+++ b/test/mjsunit/regress/regress-2443.js
@@ -0,0 +1,129 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Number.prototype methods on non-Numbers.
+
+assertThrows(function() { Number.prototype.toExponential.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toPrecision.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toFixed.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toString.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.toLocaleString.call({}) },
+ TypeError);
+
+assertThrows(function() { Number.prototype.ValueOf.call({}) },
+ TypeError);
+
+
+// Call on Number objects with custom valueOf method.
+
+var x_obj = new Number(1);
+x_obj.valueOf = function() { assertUnreachable(); };
+
+assertEquals("1.00e+0",
+ Number.prototype.toExponential.call(x_obj, 2));
+
+assertEquals("1.0",
+ Number.prototype.toPrecision.call(x_obj, 2));
+
+assertEquals("1.00",
+ Number.prototype.toFixed.call(x_obj, 2));
+
+// Call on primitive numbers.
+assertEquals("1.00e+0",
+ Number.prototype.toExponential.call(1, 2));
+
+assertEquals("1.0",
+ Number.prototype.toPrecision.call(1, 2));
+
+assertEquals("1.00",
+ Number.prototype.toFixed.call(1, 2));
+
+
+// toExponential and toPrecision does following steps in order
+// 1) convert the argument using ToInteger
+// 2) check for non-finite receiver, on which it returns,
+// 3) check argument range and throw exception if out of range.
+// Note that the the last two steps are reversed for toFixed.
+// Luckily, the receiver is expected to be a number or number
+// wrapper, so that getting its value is not observable.
+
+var f_flag = false;
+var f_obj = { valueOf: function() { f_flag = true; return 1000; } };
+
+assertEquals("NaN",
+ Number.prototype.toExponential.call(NaN, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("Infinity",
+ Number.prototype.toExponential.call(1/0, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("-Infinity",
+ Number.prototype.toExponential.call(-1/0, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("NaN",
+ Number.prototype.toPrecision.call(NaN, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("Infinity",
+ Number.prototype.toPrecision.call(1/0, f_obj));
+assertTrue(f_flag);
+
+f_flag = false;
+assertEquals("-Infinity",
+ Number.prototype.toPrecision.call(-1/0, f_obj));
+assertTrue(f_flag);
+
+// The odd man out: toFixed.
+
+f_flag = false;
+assertThrows(function() { Number.prototype.toFixed.call(NaN, f_obj) },
+ RangeError);
+assertTrue(f_flag);
+
+f_flag = false;
+assertThrows(function() { Number.prototype.toFixed.call(1/0, f_obj) },
+ RangeError);
+assertTrue(f_flag);
+
+f_flag = false;
+assertThrows(function() { Number.prototype.toFixed.call(-1/0, f_obj) },
+ RangeError);
+assertTrue(f_flag);
diff --git a/test/mjsunit/regress/regress-2444.js b/test/mjsunit/regress/regress-2444.js
new file mode 100644
index 0000000..41b6a95
--- /dev/null
+++ b/test/mjsunit/regress/regress-2444.js
@@ -0,0 +1,118 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+var flags;
+
+function resetFlags(size) {
+ flags = Array(size);
+ while (size--) flags[size] = 0;
+}
+
+function assertFlags(array) {
+ assertArrayEquals(array, flags);
+}
+
+function object_factory(flag_index, value, expected_flags) {
+ var obj = {};
+ obj.valueOf = function() {
+ assertFlags(expected_flags);
+ flags[flag_index]++;
+ return value;
+ }
+ return obj;
+}
+
+
+assertEquals(-Infinity, Math.max());
+
+resetFlags(1);
+assertEquals(NaN,
+ Math.max(object_factory(0, NaN, [0])));
+assertFlags([1]);
+
+resetFlags(2);
+assertEquals(NaN,
+ Math.max(object_factory(0, NaN, [0, 0]),
+ object_factory(1, 0, [1, 0])));
+assertFlags([1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.max(object_factory(0, NaN, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.max(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, NaN, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(2,
+ Math.max(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+
+assertEquals(+Infinity, Math.min());
+
+resetFlags(1);
+assertEquals(NaN,
+ Math.min(object_factory(0, NaN, [0])));
+assertFlags([1]);
+
+resetFlags(2);
+assertEquals(NaN,
+ Math.min(object_factory(0, NaN, [0, 0]),
+ object_factory(1, 0, [1, 0])));
+assertFlags([1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.min(object_factory(0, NaN, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(NaN,
+ Math.min(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, NaN, [1, 1, 0])));
+assertFlags([1, 1, 1]);
+
+resetFlags(3);
+assertEquals(0,
+ Math.min(object_factory(0, 2, [0, 0, 0]),
+ object_factory(1, 0, [1, 0, 0]),
+ object_factory(2, 1, [1, 1, 0])));
+assertFlags([1, 1, 1]);
diff --git a/test/mjsunit/regress/regress-2451.js b/test/mjsunit/regress/regress-2451.js
new file mode 100644
index 0000000..c1749b1
--- /dev/null
+++ b/test/mjsunit/regress/regress-2451.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ assertEquals(-1.0, Math.round(-1.5));
+ assertEquals(-2.0, Math.round(-2.5));
+ assertEquals(-1.0, Math.round(-0.5000000000000001));
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertOptimized(f);
diff --git a/test/mjsunit/regress/regress-246.js b/test/mjsunit/regress/regress-246.js
index 09b746b..22e29fd 100644
--- a/test/mjsunit/regress/regress-246.js
+++ b/test/mjsunit/regress/regress-246.js
@@ -28,4 +28,4 @@
// See: http://code.google.com/p/v8/issues/detail?id=246
assertTrue(/(?:text)/.test("text"));
-assertEquals(["text"], /(?:text)/.exec("text"));
\ No newline at end of file
+assertEquals(["text"], /(?:text)/.exec("text"));
diff --git a/test/mjsunit/regress/regress-2470.js b/test/mjsunit/regress/regress-2470.js
new file mode 100644
index 0000000..29a0b25
--- /dev/null
+++ b/test/mjsunit/regress/regress-2470.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test whether the opening parenthesis can be eaten up by a comment.
+assertThrows('Function("/*", "*/){");', SyntaxError);
+
+// Test whether the function literal can be closed prematurely.
+assertThrows('Function("});(function(){");', SyntaxError);
+
+// Test whether block comments are handled correctly.
+assertDoesNotThrow('Function("/*", "*/", "/**/");');
+assertDoesNotThrow('Function("/*", "a", "*/", "/**/");');
+assertThrows('Function("a", "/*", "*/", "/**/");', SyntaxError);
+
+// Test whether line comments are handled correctly.
+assertDoesNotThrow('Function("//", "//")');
+assertDoesNotThrow('Function("//", "//", "//")');
+assertThrows('Function("a", "//", "//")', SyntaxError);
+
+// Some embedders rely on the string representation of the resulting
+// function in cases where no formal parameters are specified.
+var asString = Function("return 23").toString();
+assertSame("function anonymous() {\nreturn 23\n}", asString);
diff --git a/test/mjsunit/regress/regress-247688.js b/test/mjsunit/regress/regress-247688.js
new file mode 100644
index 0000000..80e2884
--- /dev/null
+++ b/test/mjsunit/regress/regress-247688.js
@@ -0,0 +1,80 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {};
+a.x = 1
+a.y = 1.5
+
+var b = {}
+b.x = 1.5;
+b.y = 1;
+
+var c = {}
+c.x = 1.5;
+
+var d = {}
+d.x = 1.5;
+
+var e = {}
+e.x = 1.5;
+
+var f = {}
+f.x = 1.5;
+
+var g = {}
+g.x = 1.5;
+
+var h = {}
+h.x = 1.5;
+
+var i = {}
+i.x = 1.5;
+
+var o = {}
+var p = {y : 10, z : 1}
+o.__proto__ = p;
+delete p.z
+
+function foo(v, w) {
+ // Make load via IC in optimized code. Its target will get overwritten by
+ // lazy deopt patch for the stack check.
+ v.y;
+ // Make store with transition to make this code dependent on the map.
+ w.y = 1;
+ return b.y;
+}
+
+foo(o, c);
+foo(o, d);
+foo(o, e);
+%OptimizeFunctionOnNextCall(foo);
+foo(b, f);
+foo(b, g);
+foo(b, h);
+foo(a, i);
diff --git a/test/mjsunit/regress/regress-2489.js b/test/mjsunit/regress/regress-2489.js
new file mode 100644
index 0000000..882c4f7
--- /dev/null
+++ b/test/mjsunit/regress/regress-2489.js
@@ -0,0 +1,50 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+function f(a, b) {
+ return g("c", "d");
+}
+
+function g(a, b) {
+ g.constructor.apply(this, arguments);
+}
+
+g.constructor = function(a, b) {
+ assertEquals("c", a);
+ assertEquals("d", b);
+}
+
+f("a", "b");
+f("a", "b");
+%OptimizeFunctionOnNextCall(f);
+f("a", "b");
+g.x = "deopt";
+f("a", "b");
diff --git a/test/mjsunit/regress/regress-2499.js b/test/mjsunit/regress/regress-2499.js
new file mode 100644
index 0000000..52aad87
--- /dev/null
+++ b/test/mjsunit/regress/regress-2499.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(word, nBits) {
+ return (word[1] >>> nBits) | (word[0] << (32 - nBits));
+}
+
+word = [0x1001, 0];
+
+var expected = foo(word, 1);
+foo(word, 1);
+%OptimizeFunctionOnNextCall(foo);
+var optimized = foo(word, 1);
+assertEquals(expected, optimized)
diff --git a/test/mjsunit/regress/regress-252797.js b/test/mjsunit/regress/regress-252797.js
new file mode 100644
index 0000000..379205f
--- /dev/null
+++ b/test/mjsunit/regress/regress-252797.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// The type feedback oracle had a bug when retrieving the map from an IC
+// starting with a negative lookup.
+
+// Create a holder in fast mode.
+var holder = Object.create(null, {
+ holderMethod: {value: function() {}}
+});
+assertTrue(%HasFastProperties(holder));
+
+// Create a receiver into dictionary mode.
+var receiver = Object.create(holder, {
+ killMe: {value: 0, configurable: true},
+});
+delete receiver.killMe;
+assertFalse(%HasFastProperties(receiver));
+
+// The actual function to test, triggering the retrieval of the wrong map.
+function callConstantFunctionOnPrototype(obj) {
+ obj.holderMethod();
+}
+
+callConstantFunctionOnPrototype(receiver);
+callConstantFunctionOnPrototype(receiver);
+%OptimizeFunctionOnNextCall(callConstantFunctionOnPrototype);
+callConstantFunctionOnPrototype(receiver);
+
+// Make sure that the function is still optimized.
+assertOptimized(callConstantFunctionOnPrototype);
diff --git a/test/mjsunit/regress/regress-2537.js b/test/mjsunit/regress/regress-2537.js
new file mode 100644
index 0000000..1a86000
--- /dev/null
+++ b/test/mjsunit/regress/regress-2537.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var large_int = 0x40000000;
+
+function foo(x, expected) {
+ assertEquals(expected, x); // This succeeds.
+ x += 0; // Force int32 representation so that
+ // CompareNumericAndBranch is used.
+ if (3 != x) {
+ x += 0; // Poor man's "iDef".
+ // Fails due to Smi-tagging without overflow check.
+ assertEquals(expected, x);
+ }
+}
+
+foo(1, 1);
+foo(3, 3);
+%OptimizeFunctionOnNextCall(foo);
+foo(large_int, large_int);
diff --git a/test/mjsunit/regress/regress-2539.js b/test/mjsunit/regress/regress-2539.js
new file mode 100644
index 0000000..5d263f8
--- /dev/null
+++ b/test/mjsunit/regress/regress-2539.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+var dispatcher = {};
+dispatcher.func = C;
+
+function A() {
+ B(10, 11);
+}
+
+function B(x,y) {
+ x = 0; y = 0;
+ dispatcher.func.apply(this, arguments);
+ assertSame(2, arguments.length);
+ assertSame(10, arguments[0]);
+ assertSame(11, arguments[1]);
+}
+
+function C(x,y) {
+ assertSame(2, arguments.length);
+ assertSame(10, arguments[0]);
+ assertSame(11, arguments[1]);
+}
+
+A();
+A();
+%OptimizeFunctionOnNextCall(A);
+A();
diff --git a/test/mjsunit/regress/regress-2564.js b/test/mjsunit/regress/regress-2564.js
new file mode 100644
index 0000000..21b40e0
--- /dev/null
+++ b/test/mjsunit/regress/regress-2564.js
@@ -0,0 +1,122 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = [ function f0() { throw new Error(); },
+ function f1() { o[0](); },
+ function f2() { o[1](); },
+ function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+ Error.prepareStackTrace = undefined; // Prevent recursion.
+ try {
+ assertEquals(5, frames.length);
+ // Don't check the last frame since that's the top-level code.
+ for (var i = 0; i < frames.length - 1; i++) {
+ assertEquals(o[i], frames[i].getFunction());
+ assertEquals(o, frames[i].getThis());
+ // Private fields are no longer accessible.
+ assertEquals(undefined, frames[i].receiver);
+ assertEquals(undefined, frames[i].fun);
+ assertEquals(undefined, frames[i].pos);
+ }
+ return "success";
+ } catch (e) {
+ return "fail";
+ }
+}
+
+try {
+ o[3]();
+} catch (e) {
+ assertEquals("success", e.stack);
+};
+
+
+var o = [ function f0() { throw new Error(); },
+ function f1() { o[0](); },
+ function f2() { "use strict"; o[1](); },
+ function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+ Error.prepareStackTrace = undefined; // Prevent recursion.
+ try {
+ assertEquals(5, frames.length);
+ for (var i = 0; i < 2; i++) {
+ // The first two frames are still sloppy mode.
+ assertEquals(o[i], frames[i].getFunction());
+ assertEquals(o, frames[i].getThis());
+ }
+ for (var i = 2; i < frames.length; i++) {
+ // The rest are poisoned by the first strict mode function.
+ assertEquals(undefined, frames[i].getFunction());
+ assertEquals(undefined, frames[i].getThis());
+ }
+ for (var i = 0; i < frames.length - 1; i++) {
+ // Function name remains accessible.
+ assertEquals("f"+i, frames[i].getFunctionName());
+ }
+ return "success";
+ } catch (e) {
+ return e;
+ }
+}
+
+try {
+ o[3]();
+} catch (e) {
+ assertEquals("success", e.stack);
+};
+
+
+var o = [ function f0() { "use strict"; throw new Error(); },
+ function f1() { o[0](); },
+ function f2() { o[1](); },
+ function f3() { o[2](); } ];
+
+Error.prepareStackTrace = function(error, frames) {
+ Error.prepareStackTrace = undefined; // Prevent recursion.
+ try {
+ assertEquals(5, frames.length);
+ for (var i = 0; i < frames.length; i++) {
+ // The rest are poisoned by the first strict mode function.
+ assertEquals(undefined, frames[i].getFunction());
+ assertEquals(undefined, frames[i].getThis());
+ if (i < frames.length - 1) { // Function name remains accessible.
+ assertEquals("f"+i, frames[i].getFunctionName());
+ }
+ }
+ return "success";
+ } catch (e) {
+ return e;
+ }
+}
+
+try {
+ o[3]();
+} catch (e) {
+ assertEquals("success", e.stack);
+};
diff --git a/test/mjsunit/regress/regress-2565.js b/test/mjsunit/regress/regress-2565.js
new file mode 100644
index 0000000..a77806a
--- /dev/null
+++ b/test/mjsunit/regress/regress-2565.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+Object.freeze(Object.prototype);
+var p = {};
+var o = Object.create(p);
+assertSame(p, o.__proto__);
+assertSame(p, Object.getPrototypeOf(o));
diff --git a/test/mjsunit/regress/regress-2566.js b/test/mjsunit/regress/regress-2566.js
new file mode 100644
index 0000000..582bad9
--- /dev/null
+++ b/test/mjsunit/regress/regress-2566.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function setProp(obj, prop, val) {
+ obj[prop] = val;
+}
+var obj = [];
+setProp(obj, 'length', 1);
+setProp(obj, 0, 5);
+assertEquals(1, obj.length);
diff --git a/test/mjsunit/regress/regress-2568.js b/test/mjsunit/regress/regress-2568.js
new file mode 100644
index 0000000..7918e14
--- /dev/null
+++ b/test/mjsunit/regress/regress-2568.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function pluck1(a, key) {
+ return a.map(function(item) { return item[key]; });
+};
+assertArrayEquals([2, 2], pluck1([[0, 0], [0, 0]], 'length'));
+assertArrayEquals([1, 3], pluck1([[1, 2], [3, 4]], '0'));
+
+function pluck2(a, key) {
+ return a.map(function(item) { return item[key]; });
+};
+assertArrayEquals([2, 2], pluck2(["ab", "cd"], 'length'));
+assertArrayEquals(["a", "c"], pluck2(["ab", "cd"], '0'));
+
+function pluck3(a, key) {
+ return a.map(function(item) { return item[key]; });
+};
+f = function() { 1 };
+f.prototype = g = function() { 2 };
+assertArrayEquals([g, g], pluck3([f, f], 'prototype'));
+assertArrayEquals([undefined, undefined], pluck3([f, f], '0'));
diff --git a/test/mjsunit/regress/regress-2570.js b/test/mjsunit/regress/regress-2570.js
new file mode 100644
index 0000000..f1331e8
--- /dev/null
+++ b/test/mjsunit/regress/regress-2570.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = ["\u56e7", // Switch JSON stringifier to two-byte mode.
+ "\u00e6"]; // Latin-1 character.
+
+assertEquals('["\u56e7","\u00e6"]', JSON.stringify(o));
+assertEquals('["\u56e7","\u00e6"]', JSON.stringify(o, null, 0));
diff --git a/test/mjsunit/regress/regress-2593.js b/test/mjsunit/regress/regress-2593.js
new file mode 100644
index 0000000..b51b41c
--- /dev/null
+++ b/test/mjsunit/regress/regress-2593.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose_gc
+
+p1 = { };
+p2 = { };
+p3 = { x : 1 };
+p2.__proto__ = p3
+p1.__proto__ = p2
+
+// Normalize p1.
+p1.z = 1
+delete p1.z
+
+// Make sure all objects are in old space.
+for (var i = 0; i < 10; i++) gc();
+
+function f2() {
+ p2.x;
+}
+
+function f1() {
+ return p1.x;
+}
+
+// Create load stub in p2.
+for (var i = 0; i < 10; i++) f2();
+
+// Create load stub in p2 for p1.
+for (var i = 0; i < 10; i++) f1();
+
+assertEquals(1, f1());
+
+p2.x = 2;
+
+assertEquals(2, f1());
diff --git a/test/mjsunit/regress/regress-2594.js b/test/mjsunit/regress/regress-2594.js
new file mode 100644
index 0000000..60720cb
--- /dev/null
+++ b/test/mjsunit/regress/regress-2594.js
@@ -0,0 +1,104 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// In the assertions but the first, the ES5 spec actually requires 0, but
+// that is arguably a spec bug, and other browsers return 1 like us.
+// In ES6, all of those will presumably result in a ReferenceError.
+// Our main concern with this test is that we do not crash, though.
+
+function f1() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("var h = function() { return XXX }")
+ }
+ return h()
+}
+assertEquals(1, f1())
+
+function f2() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("function h(){ return XXX }")
+ }
+ return h()
+}
+assertEquals(1, f2())
+
+function f3() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ try { throw 2 } catch (y) {
+ eval("function h(){ return XXX }")
+ }
+ }
+ return h()
+}
+assertEquals(1, f3())
+
+function f4() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ with ({}) {
+ eval("function h(){ return XXX }")
+ }
+ }
+ return h()
+}
+assertEquals(1, f4())
+
+function f5() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval('eval("function h(){ return XXX }")')
+ }
+ return h()
+}
+assertEquals(1, f5())
+
+function f6() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("var h = (function() { function g(){ return XXX } return g })()")
+ }
+ return h()
+}
+assertEquals(1, f6())
+
+function f7() {
+ var XXX = 0
+ try { throw 1 } catch (XXX) {
+ eval("function h() { var XXX=2; function g(){ return XXX } return g }")
+ }
+ return h()()
+}
+assertEquals(2, f7()) // !
+
+var XXX = 0
+try { throw 1 } catch (XXX) {
+ eval("function h(){ return XXX }")
+}
+assertEquals(1, h())
diff --git a/test/mjsunit/regress/regress-2595.js b/test/mjsunit/regress/regress-2595.js
new file mode 100644
index 0000000..5bb5f6d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2595.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var p = { f: function () { return "p"; } };
+var o = Object.create(p);
+o.x = true;
+delete o.x; // slow case object
+
+var u = { x: 0, f: function () { return "u"; } }; // object with some other map
+
+function F(x) {
+ return x.f();
+}
+
+// First make CALL IC in F go MEGAMORPHIC and ensure that we put the stub
+// that calls p.f (guarded by a negative dictionary lookup on the reciever)
+// into the stub cache
+assertEquals("p", F(o));
+assertEquals("p", F(o));
+assertEquals("u", F(u));
+assertEquals("p", F(o));
+assertEquals("u", F(u));
+
+// Optimize F. We will inline p.f into F guarded by map checked against
+// receiver which does not work for slow case objects.
+%OptimizeFunctionOnNextCall(F);
+assertEquals("p", F(o));
+
+// Add f to o. o's map will *not* change.
+o.f = function () { return "o"; };
+assertEquals("o", F(o));
diff --git a/test/mjsunit/regress/regress-2596.js b/test/mjsunit/regress/regress-2596.js
new file mode 100644
index 0000000..e700608
--- /dev/null
+++ b/test/mjsunit/regress/regress-2596.js
@@ -0,0 +1,53 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var bytes = new Uint8Array([
+ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0xff, 0x7f]); // kHoleNaN
+var doubles = new Float64Array(bytes.buffer);
+assertTrue(isNaN(doubles[0]));
+
+var prototype = [2.5, 2.5];
+var array = [3.5, 3.5];
+array.__proto__ = prototype;
+assertTrue(%HasFastDoubleElements(array));
+
+function boom(index) {
+ array[index] = doubles[0];
+ return array[index];
+}
+
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+
+// Test hydrogen
+%OptimizeFunctionOnNextCall(boom);
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
+assertTrue(isNaN(boom(0)));
diff --git a/test/mjsunit/regress/regress-2606.js b/test/mjsunit/regress/regress-2606.js
new file mode 100644
index 0000000..b704f7d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2606.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check baseline for __proto__.
+var desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertEquals("function", typeof desc.get);
+assertEquals("function", typeof desc.set);
+
+// Check redefining getter for __proto__.
+function replaced_get() {};
+Object.defineProperty(Object.prototype, "__proto__", { get:replaced_get });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertSame(replaced_get, desc.get);
+
+// Check redefining setter for __proto__.
+function replaced_set(x) {};
+Object.defineProperty(Object.prototype, "__proto__", { set:replaced_set });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertTrue(desc.configurable);
+assertSame(replaced_set, desc.set);
+
+// Check changing configurability of __proto__.
+Object.defineProperty(Object.prototype, "__proto__", { configurable:false });
+desc = Object.getOwnPropertyDescriptor(Object.prototype, "__proto__");
+assertFalse(desc.enumerable);
+assertFalse(desc.configurable);
+assertSame(replaced_get, desc.get);
+assertSame(replaced_set, desc.set);
+
+// Check freezing Object.prototype completely.
+Object.freeze(Object.prototype);
+assertTrue(Object.isFrozen(Object.prototype));
diff --git a/test/mjsunit/regress/regress-2612.js b/test/mjsunit/regress/regress-2612.js
new file mode 100644
index 0000000..ac6028f
--- /dev/null
+++ b/test/mjsunit/regress/regress-2612.js
@@ -0,0 +1,75 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --nodead-code-elimination
+// Flags: --nofold-constants --nouse-gvn
+
+// Create a function to get a long series of removable simulates.
+// f() {
+// var _0 = <random>, _1 = <random>, ... _1000 = <random>,
+// _1001 = <random var> + <random var>,
+// _1002 = <random var> + <random var>,
+// ...
+// _99999 = <random var> + <random var>,
+// x = 1;
+// return _0;
+// }
+
+var seed = 1;
+
+function rand() {
+ seed = seed * 171 % 1337 + 17;
+ return (seed % 1000) / 1000;
+}
+
+function randi(max) {
+ seed = seed * 131 % 1773 + 13;
+ return seed % max;
+}
+
+function varname(i) {
+ return "_" + i;
+}
+
+var source = "var ";
+
+for (var i = 0; i < 750; i++) {
+ source += [varname(i), "=", rand(), ","].join("");
+}
+
+for (var i = 750; i < 3000; i++) {
+ source += [varname(i), "=",
+ varname(randi(i)), "+",
+ varname(randi(i)), ","].join("");
+}
+
+source += "x=1; return _0;"
+var f = new Function(source);
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-2618.js b/test/mjsunit/regress/regress-2618.js
new file mode 100644
index 0000000..363557b
--- /dev/null
+++ b/test/mjsunit/regress/regress-2618.js
@@ -0,0 +1,72 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr --allow-natives-syntax --no-concurrent-osr
+
+function f() {
+ do {
+ do {
+ for (var i = 0; i < 10000000; i++) {
+ // This should run long enough to trigger OSR.
+ }
+ } while (false);
+ } while (false);
+}
+
+f();
+assertTrue(%GetOptimizationCount(f) > 0 || %GetOptimizationStatus(f) == 4);
+
+function g() {
+ for (var i = 0; i < 1; i++) { }
+
+ do {
+ do {
+ for (var i = 0; i < 1; i++) { }
+ } while (false);
+ } while (false);
+
+ do {
+ do {
+ do {
+ do {
+ do {
+ do {
+ do {
+ do {
+ for (var i = 0; i < 10000000; i++) { }
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+ } while (false);
+}
+
+g();
+assertTrue(%GetOptimizationCount(g) > 0 || %GetOptimizationStatus(g) == 4);
diff --git a/test/mjsunit/regress/regress-2624.js b/test/mjsunit/regress/regress-2624.js
new file mode 100644
index 0000000..fe94a10
--- /dev/null
+++ b/test/mjsunit/regress/regress-2624.js
@@ -0,0 +1,35 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --print-code
+
+var source = '"snowmen invasion " + "';
+for(var i = 0; i < 800; i++) {
+ source += '\u2603';
+}
+source += '"';
+eval(source);
diff --git a/test/mjsunit/regress/regress-264203.js b/test/mjsunit/regress/regress-264203.js
new file mode 100644
index 0000000..fa00756
--- /dev/null
+++ b/test/mjsunit/regress/regress-264203.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var a = [1, 2, 3, 4, 5, 6, 7, 8];
+ a[x + 5];
+ var result;
+ for (var i = 0; i < 3; i++) {
+ result = a[0 - x];
+ }
+ return result;
+}
+
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(foo);
+var r = foo(-2);
+assertEquals(3, r);
diff --git a/test/mjsunit/regress/regress-2646.js b/test/mjsunit/regress/regress-2646.js
new file mode 100644
index 0000000..c51a280
--- /dev/null
+++ b/test/mjsunit/regress/regress-2646.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --heap-stats
+
+var expectedItemsCount = 10000,
+ itemSize = 5,
+ heap = new ArrayBuffer(expectedItemsCount * itemSize * 8),
+ storage = [];
+
+for (var i = 0; i < expectedItemsCount; i++) {
+ storage.push(new Float64Array(heap, 0, itemSize));
+}
diff --git a/test/mjsunit/regress/regress-2653.js b/test/mjsunit/regress/regress-2653.js
new file mode 100644
index 0000000..eb0c631
--- /dev/null
+++ b/test/mjsunit/regress/regress-2653.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --deopt_every_n_garbage_collections=1
+
+function foo(a, b) {
+ var l = a.length;
+ var array = new Array(l);
+ for (var k = 0; k < l; k++) {
+ array[k] = 120;
+ }
+ var result = new Array(l);
+ for (var i = 0; i < l; i++) {
+ result[i] = array[i];
+ }
+ return result;
+}
+
+a = "xxxxxxxxxxxxxxxxxxxxxxxxx";
+while (a.length < 100000) a = a + a;
+foo(a, []);
+%OptimizeFunctionOnNextCall(foo)
+foo(a, []);
diff --git a/test/mjsunit/regress/regress-2671-1.js b/test/mjsunit/regress/regress-2671-1.js
new file mode 100644
index 0000000..7937d6a
--- /dev/null
+++ b/test/mjsunit/regress/regress-2671-1.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var y;
+function f() {
+ var a = [];
+ a[20] = 0;
+ y = 3;
+ var i = 7 * (y + -0);
+ a[i]++;
+ assertTrue(isNaN(a[i]));
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-2671.js b/test/mjsunit/regress/regress-2671.js
new file mode 100644
index 0000000..73a3098
--- /dev/null
+++ b/test/mjsunit/regress/regress-2671.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var y;
+function f() {
+ var a = [];
+ a[20] = 0;
+ y = 3;
+ var i = 7 * (y + -0);
+ a[i] = 1/y;
+ assertFalse(isNaN(a[i]));
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-2686.js b/test/mjsunit/regress/regress-2686.js
new file mode 100644
index 0000000..bd6106f
--- /dev/null
+++ b/test/mjsunit/regress/regress-2686.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check Function doesn't use String.prototype.indexOf.
+
+assertThrows(function() { Function('){ function foo(', '}') }, SyntaxError);
+String.prototype.indexOf = function () { return -1; }
+assertThrows(function() { Function('){ function foo(', '}') }, SyntaxError);
diff --git a/test/mjsunit/regress/regress-2690.js b/test/mjsunit/regress/regress-2690.js
new file mode 100644
index 0000000..0ed4c5c
--- /dev/null
+++ b/test/mjsunit/regress/regress-2690.js
@@ -0,0 +1,28 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertTrue(/\1[a]/.test("\1a"));
diff --git a/test/mjsunit/regress/regress-270142.js b/test/mjsunit/regress/regress-270142.js
new file mode 100644
index 0000000..6e0865c
--- /dev/null
+++ b/test/mjsunit/regress/regress-270142.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Check that "name"'s property descriptor for non-strict and strict
+// functions correspond.
+
+function f(x) {
+ return x;
+}
+
+function g(x) {
+ "use strict";
+ return x;
+}
+
+function checkNameDescriptor(f) {
+ var descriptor = Object.getOwnPropertyDescriptor(f, "name");
+ assertFalse(descriptor.configurable);
+ assertFalse(descriptor.enumerable);
+ assertFalse(descriptor.writable);
+}
+
+checkNameDescriptor(f);
+checkNameDescriptor(g);
diff --git a/test/mjsunit/regress/regress-2711.js b/test/mjsunit/regress/regress-2711.js
new file mode 100644
index 0000000..d5ac2ba
--- /dev/null
+++ b/test/mjsunit/regress/regress-2711.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that frozen arrays don't let their length change
+var a = Object.freeze([1]);
+assertThrows(function() { a.push(2); }, TypeError);
+assertEquals(1, a.length);
+assertThrows(function() { a.push(2); }, TypeError);
+assertEquals(1, a.length);
diff --git a/test/mjsunit/regress/regress-2717.js b/test/mjsunit/regress/regress-2717.js
new file mode 100644
index 0000000..4f8f791
--- /dev/null
+++ b/test/mjsunit/regress/regress-2717.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test re-initializing existing field which is already being tracked as
+// having double representation.
+(function() {
+ function test1(a) {
+ return { x: 1.5, x: a };
+ };
+
+ assertEquals({}, test1({}).x);
+})();
+
+// Test initializing new field which follows an existing transition to a
+// map that tracks it as having double representation.
+(function() {
+ function test1(a) {
+ return { y: a };
+ };
+
+ function test2(a) {
+ return { y: a };
+ };
+
+ assertEquals(1.5, test1(1.5).y);
+ assertEquals({}, test2({}).y);
+})();
diff --git a/test/mjsunit/regress/regress-2758.js b/test/mjsunit/regress/regress-2758.js
new file mode 100644
index 0000000..ee78844
--- /dev/null
+++ b/test/mjsunit/regress/regress-2758.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var functions = [
+ function() { var f = [].concat; f() },
+ function() { var f = [].push; f() },
+ function() { var f = [].shift; f() },
+ function() { (0, [].concat)() },
+ function() { (0, [].push)() },
+ function() { (0, [].shift)() }
+]
+
+for (var i = 0; i < 5; ++i) {
+ for (var j in functions) {
+ print(functions[i])
+ assertThrows(functions[j], TypeError)
+ }
+
+ if (i === 3) {
+ for (var j in functions)
+ %OptimizeFunctionOnNextCall(functions[j]);
+ }
+}
diff --git a/test/mjsunit/regress/regress-2790.js b/test/mjsunit/regress/regress-2790.js
new file mode 100644
index 0000000..ac79e64
--- /dev/null
+++ b/test/mjsunit/regress/regress-2790.js
@@ -0,0 +1,31 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we can create arrays of any size.
+for (var i = 1000; i < 1000000; i += 19703) {
+ new Array(i);
+}
diff --git a/test/mjsunit/regress/regress-280531.js b/test/mjsunit/regress/regress-280531.js
new file mode 100644
index 0000000..6799574
--- /dev/null
+++ b/test/mjsunit/regress/regress-280531.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var contextA = Realm.create();
+var date1 = Realm.eval(contextA, "new Date('Thu, 29 Aug 2013 00:00:00 UTC')");
+new Date('Thu, 29 Aug 2013 00:00:01 UTC');
+var date2 = Realm.eval(contextA, "new Date('Thu, 29 Aug 2013 00:00:00 UTC')");
+assertEquals(date1, date2);
diff --git a/test/mjsunit/regress/regress-2813.js b/test/mjsunit/regress/regress-2813.js
new file mode 100644
index 0000000..97ae43b
--- /dev/null
+++ b/test/mjsunit/regress/regress-2813.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var a = x + 1;
+ var b = x + 2;
+ if (x != 0) {
+ if (x > 0 & x < 100) {
+ return a;
+ }
+ }
+ return 0;
+}
+
+assertEquals(0, foo(0));
+assertEquals(0, foo(0));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(3, foo(2));
diff --git a/test/mjsunit/regress/regress-2836.js b/test/mjsunit/regress/regress-2836.js
new file mode 100644
index 0000000..682cc5e
--- /dev/null
+++ b/test/mjsunit/regress/regress-2836.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var end = 1073741823; // 2^30 - 1
+ var start = end - 100000; // Run long enough to trigger OSR.
+ for (var i = start; i <= end; ++i) {
+ assertTrue(i >= start); // No overflow allowed!
+ }
+}
+
+f();
diff --git a/test/mjsunit/regress/regress-2843.js b/test/mjsunit/regress/regress-2843.js
new file mode 100644
index 0000000..5b28c2d
--- /dev/null
+++ b/test/mjsunit/regress/regress-2843.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bailout() { throw "bailout"; }
+var global;
+
+function foo(x, fun) {
+ var a = x + 1;
+ var b = x + 2; // Need another Simulate to fold the first one into.
+ global = true; // Need a side effect to deopt to.
+ fun();
+ return a;
+}
+
+assertThrows("foo(1, bailout)");
+assertThrows("foo(1, bailout)");
+%OptimizeFunctionOnNextCall(foo);
+assertThrows("foo(1, bailout)");
+assertEquals(2, foo(1, function() {}));
diff --git a/test/mjsunit/regress/regress-2855.js b/test/mjsunit/regress/regress-2855.js
new file mode 100644
index 0000000..24ec452
--- /dev/null
+++ b/test/mjsunit/regress/regress-2855.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function foo(a) {
+ for (var i = 0; i < 100; ++i)
+ a = new String(a);
+ return a;
+}
+
+var expected = "hello";
+for (var i = 0; i < 4; ++i) {
+ if (i == 2) {
+ String.prototype.valueOf = function() { return 42; }
+ expected = "42";
+ }
+ assertEquals(expected, "" + foo("hello"));
+}
+
+// Make sure we look up "valueOf" only once.
+var count = 0;
+var x = new String("foo");
+Object.defineProperty(x, "valueOf",
+ { get: function() {
+ count++;
+ return function() {
+ return 11;
+ }
+ }
+ });
+for (var i = 0; i < 3; i++) {
+ assertEquals("11", "" + x);
+ assertEquals(i + 1, count);
+}
diff --git a/test/mjsunit/regress/regress-2931.js b/test/mjsunit/regress/regress-2931.js
new file mode 100644
index 0000000..a2ea912
--- /dev/null
+++ b/test/mjsunit/regress/regress-2931.js
@@ -0,0 +1,34 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Typed array constructors should be immune from changes to
+// value of ArrayBuffer on global object.
+// See http://code.google.com/p/v8/issues/detail?id=294
+
+this.ArrayBuffer = function() { throw Error('BAM'); };
+var u8 = new Uint8Array(100);
+assertSame(100, u8.byteLength);
diff --git a/test/mjsunit/regress/regress-2980.js b/test/mjsunit/regress/regress-2980.js
new file mode 100644
index 0000000..071a733
--- /dev/null
+++ b/test/mjsunit/regress/regress-2980.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+function test(expected, holder) {
+ assertEquals(expected, holder.property);
+}
+
+var holder = {}
+holder.__proto__ = null;
+holder.property = "foo";
+delete holder.property;
+test(undefined, holder);
+test(undefined, holder);
+test(undefined, holder);
+holder.property = "bar";
+test("bar", holder);
+test("bar", holder);
+
+// Now the same thing with a nontrivial prototype chain.
+
+function test2(expected, holder) {
+ assertEquals(expected, holder.prop2);
+}
+
+var holder2 = {}
+holder2.prop2 = "foo";
+holder2.__proto__ = null;
+function Receiver() {}
+Receiver.prototype = holder2;
+
+var rec2 = new Receiver();
+delete holder2.prop2;
+
+test2(undefined, rec2);
+test2(undefined, rec2);
+test2(undefined, rec2);
+holder2.prop2 = "bar";
+test2("bar", rec2);
+test2("bar", rec2);
diff --git a/test/mjsunit/regress/regress-298269.js b/test/mjsunit/regress/regress-298269.js
new file mode 100644
index 0000000..f6604df
--- /dev/null
+++ b/test/mjsunit/regress/regress-298269.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function Cb(a) {
+ var f, g;
+ for(f = a.length; f--;) {
+ g = a.charCodeAt(f);
+ // This will fail after OSR if Runtime_StringCharCodeAt is modified
+ // to iterates optimized frames and visit safepoint pointers.
+ }
+ return g;
+}
+
+var s1 = "long string to make cons string 1";
+var s2 = "long string to make cons string 2";
+Cb(s1 + s2);
+Cb(s1);
+var s3 = "string for triggering osr in Cb";
+for (var i = 0; i < 16; i++) s3 = s3 + s3;
+Cb(s3);
+Cb(s1 + s2);
diff --git a/test/mjsunit/regress/regress-2984.js b/test/mjsunit/regress/regress-2984.js
new file mode 100644
index 0000000..914409c
--- /dev/null
+++ b/test/mjsunit/regress/regress-2984.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("\u0178", "\xff".toUpperCase());
+assertEquals("abcdefghijklmn\xffopq",
+ ("ABCDEFGHIJKL" + "MN\u0178OPQ").toLowerCase());
+assertEquals("\xff", "\u0178".toLowerCase());
+assertEquals("ABCDEFGHIJKLMN\u0178OPQ",
+ ("abcdefghijk" + "lmn\xffopq").toUpperCase());
diff --git a/test/mjsunit/regress/regress-2987.js b/test/mjsunit/regress/regress-2987.js
new file mode 100644
index 0000000..7dd727e
--- /dev/null
+++ b/test/mjsunit/regress/regress-2987.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --dead-code-elimination
+
+// This tests that stores on captured objects are correctly tracked even
+// when DCE is enabled. We cannot delete simulations of captured objects
+// that are still needed to replay the environment correctly.
+
+function constructor() {
+ this.x = 0;
+}
+
+var deopt = { deopt:false };
+function boogeyman(mode, value) {
+ var object = new constructor();
+ if (mode) {
+ object.x = 1;
+ } else {
+ object.x = 2;
+ }
+ deopt.deopt;
+ assertEquals(value, object.x);
+}
+
+boogeyman(true, 1);
+boogeyman(true, 1);
+boogeyman(false, 2);
+boogeyman(false, 2);
+%OptimizeFunctionOnNextCall(boogeyman);
+boogeyman(false, 2);
+delete deopt.deopt;
+boogeyman(false, 2);
diff --git a/test/mjsunit/regress/regress-2988.js b/test/mjsunit/regress/regress-2988.js
new file mode 100644
index 0000000..0311d2b
--- /dev/null
+++ b/test/mjsunit/regress/regress-2988.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --gc-global --throws
+
+var f = eval("(function f() { throw 'kaboom'; })");
+
+// Prepare that next MessageHandler::MakeMessageObject will result in
+// reclamation of existing script wrapper while weak handle is used.
+%FunctionGetScript(f);
+%SetAllocationTimeout(1000, 2);
+
+// This call throws to the console but the --throws flag passed to this
+// test will make sure we don't count it as an actual failure.
+f();
diff --git a/test/mjsunit/regress/regress-2989.js b/test/mjsunit/regress/regress-2989.js
new file mode 100644
index 0000000..49c4a1c
--- /dev/null
+++ b/test/mjsunit/regress/regress-2989.js
@@ -0,0 +1,35 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Copyright (C) 2005, 2006, 2007, 2008, 2009 Apple Inc. All rights reserved.
+//
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions
+// are met:
+// 1. Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// 2. Redistributions in binary form must reproduce the above copyright
+// notice, this list of conditions and the following disclaimer in the
+// documentation and/or other materials provided with the distribution.
+//
+// THIS SOFTWARE IS PROVIDED BY APPLE INC. AND ITS CONTRIBUTORS ``AS IS'' AND ANY
+// EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
+// WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE
+// DISCLAIMED. IN NO EVENT SHALL APPLE INC. OR ITS CONTRIBUTORS BE LIABLE FOR ANY
+// DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
+// (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;
+// LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON
+// ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
+// SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function ArgumentsObjectChange() {
+ function f(x) {
+ x = 42;
+ return f.arguments[0];
+ }
+
+ f(0);
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(42, f(0));
+})();
diff --git a/test/mjsunit/regress/regress-299979.js b/test/mjsunit/regress/regress-299979.js
new file mode 100644
index 0000000..0afbcb3
--- /dev/null
+++ b/test/mjsunit/regress/regress-299979.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+
+(function(){
+ "use strict";
+ var list = Object.freeze([1, 2, 3]);
+ assertThrows(function() { list.unshift(4); }, TypeError);
+ assertThrows(function() { list.shift(); }, TypeError);
+})();
diff --git a/test/mjsunit/regress/regress-3010.js b/test/mjsunit/regress/regress-3010.js
new file mode 100644
index 0000000..7aeec64
--- /dev/null
+++ b/test/mjsunit/regress/regress-3010.js
@@ -0,0 +1,65 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+(function() {
+ function testOneSize(current_size) {
+ var eval_string = 'obj = {';
+ for (var current = 0; current <= current_size; ++current) {
+ eval_string += 'k' + current + ':' + current + ','
+ }
+ eval_string += '};';
+ eval(eval_string);
+ for (var i = 0; i <= current_size; i++) {
+ assertEquals(i, obj['k'+i]);
+ }
+ var current_number = 0;
+ for (var x in obj) {
+ assertEquals(current_number, obj[x]);
+ current_number++;
+ }
+ }
+
+ testOneSize(127);
+ testOneSize(128);
+ testOneSize(129);
+
+ testOneSize(255);
+ testOneSize(256);
+ testOneSize(257);
+
+ testOneSize(511);
+ testOneSize(512);
+ testOneSize(513);
+
+ testOneSize(1023);
+ testOneSize(1024);
+ testOneSize(1025);
+
+ testOneSize(2047);
+ testOneSize(2048);
+ testOneSize(2049);
+}())
diff --git a/test/mjsunit/regress/regress-3025.js b/test/mjsunit/regress/regress-3025.js
new file mode 100644
index 0000000..ccb3830
--- /dev/null
+++ b/test/mjsunit/regress/regress-3025.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var n = 0x8000000000000800;
+assertEquals(n, 9223372036854778000);
+var s = n.toString(5);
+var v = parseInt(s, 5);
+assertEquals(n, v);
diff --git a/test/mjsunit/regress/regress-3026.js b/test/mjsunit/regress/regress-3026.js
new file mode 100644
index 0000000..d25c88d
--- /dev/null
+++ b/test/mjsunit/regress/regress-3026.js
@@ -0,0 +1,28 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals([], "abc".split(undefined, 0));
diff --git a/test/mjsunit/regress/regress-3027.js b/test/mjsunit/regress/regress-3027.js
new file mode 100644
index 0000000..6336594
--- /dev/null
+++ b/test/mjsunit/regress/regress-3027.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test to exceed the Page::MaxRegularHeapObjectSize with an array
+// constructor call taking many arguments.
+
+function boom() {
+ var args = [];
+ for (var i = 0; i < 125000; i++) {
+ args.push(i);
+ }
+ return Array.apply(Array, args);
+}
+
+var array = boom();
+
+assertEquals(125000, array.length);
+assertEquals(124999, array[124999]);
diff --git a/test/mjsunit/regress/regress-3029.js b/test/mjsunit/regress/regress-3029.js
new file mode 100644
index 0000000..ae412df
--- /dev/null
+++ b/test/mjsunit/regress/regress-3029.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function c(x) {
+ undefined.boom();
+}
+
+function f() {
+ return new c();
+}
+
+function g() {
+ f();
+}
+
+assertThrows("g()", TypeError);
+assertThrows("g()", TypeError);
+%OptimizeFunctionOnNextCall(g);
+assertThrows("g()", TypeError);
diff --git a/test/mjsunit/regress/regress-3032.js b/test/mjsunit/regress/regress-3032.js
new file mode 100644
index 0000000..ae54543
--- /dev/null
+++ b/test/mjsunit/regress/regress-3032.js
@@ -0,0 +1,30 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+for (var i = 0; i < 1000000; i++) { }
+var xl = 4096;
+var z = i % xl;
diff --git a/test/mjsunit/regress/regress-3039.js b/test/mjsunit/regress/regress-3039.js
new file mode 100644
index 0000000..3c7f62c
--- /dev/null
+++ b/test/mjsunit/regress/regress-3039.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function do_div(x, y) {
+ return (x / y) | 0;
+}
+
+// Preparation.
+assertEquals(17, do_div(51, 3));
+assertEquals(13, do_div(65, 5));
+%OptimizeFunctionOnNextCall(do_div);
+assertEquals(11, do_div(77, 7));
+
+// The actual test. We should not trigger a floating point exception.
+assertEquals(-2147483648, do_div(-2147483648, -1));
diff --git a/test/mjsunit/regress/regress-3116.js b/test/mjsunit/regress/regress-3116.js
new file mode 100644
index 0000000..ca55ccc
--- /dev/null
+++ b/test/mjsunit/regress/regress-3116.js
@@ -0,0 +1,314 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function timezone(tz) {
+ var str = (new Date(2014, 0, 10)).toString();
+ if (tz == "CET") {
+ return str == "Fri Jan 10 2014 00:00:00 GMT+0100 (CET)";
+ }
+ if (tz == "BRT") {
+ return str == "Fri Jan 10 2014 00:00:00 GMT-0200 (BRST)";
+ }
+ if (tz == "PST") {
+ return str == "Fri Jan 10 2014 00:00:00 GMT-0800 (PST)";
+ }
+ return false;
+}
+
+if (timezone("CET")) {
+ assertEquals("Sat Mar 29 2014 22:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 29, 22, 59)).toString());
+ assertEquals("Sat, 29 Mar 2014 21:59:00 GMT",
+ (new Date(2014, 2, 29, 22, 59)).toUTCString());
+ assertEquals("Sat Mar 29 2014 23:00:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 29, 23, 0)).toString());
+ assertEquals("Sat, 29 Mar 2014 22:00:00 GMT",
+ (new Date(2014, 2, 29, 23, 0)).toUTCString());
+ assertEquals("Sat Mar 29 2014 23:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 29, 23, 59)).toString());
+ assertEquals("Sat, 29 Mar 2014 22:59:00 GMT",
+ (new Date(2014, 2, 29, 23, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 00:00:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 0, 0)).toString());
+ assertEquals("Sat, 29 Mar 2014 23:00:00 GMT",
+ (new Date(2014, 2, 30, 0, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 00:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 0, 59)).toString());
+ assertEquals("Sat, 29 Mar 2014 23:59:00 GMT",
+ (new Date(2014, 2, 30, 0, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 01:00:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 1, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 00:00:00 GMT",
+ (new Date(2014, 2, 30, 1, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 01:59:00 GMT+0100 (CET)",
+ (new Date(2014, 2, 30, 1, 59)).toString());
+ assertEquals("Sun, 30 Mar 2014 00:59:00 GMT",
+ (new Date(2014, 2, 30, 1, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 2, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:00:00 GMT",
+ (new Date(2014, 2, 30, 2, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 2, 59)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:59:00 GMT",
+ (new Date(2014, 2, 30, 2, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 3, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:00:00 GMT",
+ (new Date(2014, 2, 30, 3, 0)).toUTCString());
+ assertEquals("Sun Mar 30 2014 03:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 3, 59)).toString());
+ assertEquals("Sun, 30 Mar 2014 01:59:00 GMT",
+ (new Date(2014, 2, 30, 3, 59)).toUTCString());
+ assertEquals("Sun Mar 30 2014 04:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 2, 30, 4, 0)).toString());
+ assertEquals("Sun, 30 Mar 2014 02:00:00 GMT",
+ (new Date(2014, 2, 30, 4, 0)).toUTCString());
+ assertEquals("Sat Oct 25 2014 22:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 25, 22, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 20:59:00 GMT",
+ (new Date(2014, 9, 25, 22, 59)).toUTCString());
+ assertEquals("Sat Oct 25 2014 23:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 25, 23, 0)).toString());
+ assertEquals("Sat, 25 Oct 2014 21:00:00 GMT",
+ (new Date(2014, 9, 25, 23, 0)).toUTCString());
+ assertEquals("Sat Oct 25 2014 23:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 25, 23, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 21:59:00 GMT",
+ (new Date(2014, 9, 25, 23, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 00:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 0, 0)).toString());
+ assertEquals("Sat, 25 Oct 2014 22:00:00 GMT",
+ (new Date(2014, 9, 26, 0, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 00:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 0, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 22:59:00 GMT",
+ (new Date(2014, 9, 26, 0, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 01:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 1, 0)).toString());
+ assertEquals("Sat, 25 Oct 2014 23:00:00 GMT",
+ (new Date(2014, 9, 26, 1, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 01:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 1, 59)).toString());
+ assertEquals("Sat, 25 Oct 2014 23:59:00 GMT",
+ (new Date(2014, 9, 26, 1, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 02:00:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 2, 0)).toString());
+ assertEquals("Sun, 26 Oct 2014 00:00:00 GMT",
+ (new Date(2014, 9, 26, 2, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 02:59:00 GMT+0200 (CEST)",
+ (new Date(2014, 9, 26, 2, 59)).toString());
+ assertEquals("Sun, 26 Oct 2014 00:59:00 GMT",
+ (new Date(2014, 9, 26, 2, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 03:00:00 GMT+0100 (CET)",
+ (new Date(2014, 9, 26, 3, 0)).toString());
+ assertEquals("Sun, 26 Oct 2014 02:00:00 GMT",
+ (new Date(2014, 9, 26, 3, 0)).toUTCString());
+ assertEquals("Sun Oct 26 2014 03:59:00 GMT+0100 (CET)",
+ (new Date(2014, 9, 26, 3, 59)).toString());
+ assertEquals("Sun, 26 Oct 2014 02:59:00 GMT",
+ (new Date(2014, 9, 26, 3, 59)).toUTCString());
+ assertEquals("Sun Oct 26 2014 04:00:00 GMT+0100 (CET)",
+ (new Date(2014, 9, 26, 4, 0)).toString());
+ assertEquals("Sun, 26 Oct 2014 03:00:00 GMT",
+ (new Date(2014, 9, 26, 4, 0)).toUTCString());
+}
+
+if (timezone("BRT")) {
+ assertEquals("Sat Oct 18 2014 22:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 9, 18, 22, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 01:59:00 GMT",
+ (new Date(2014, 9, 18, 22, 59)).toUTCString());
+ assertEquals("Sat Oct 18 2014 23:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 9, 18, 23, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 02:00:00 GMT",
+ (new Date(2014, 9, 18, 23, 0)).toUTCString());
+ assertEquals("Sat Oct 18 2014 23:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 9, 18, 23, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 02:59:00 GMT",
+ (new Date(2014, 9, 18, 23, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 0, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:00:00 GMT",
+ (new Date(2014, 9, 19, 0, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 0, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:59:00 GMT",
+ (new Date(2014, 9, 19, 0, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 1, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:00:00 GMT",
+ (new Date(2014, 9, 19, 1, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 01:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 1, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 03:59:00 GMT",
+ (new Date(2014, 9, 19, 1, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 02:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 2, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 04:00:00 GMT",
+ (new Date(2014, 9, 19, 2, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 02:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 2, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 04:59:00 GMT",
+ (new Date(2014, 9, 19, 2, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 03:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 3, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 05:00:00 GMT",
+ (new Date(2014, 9, 19, 3, 0)).toUTCString());
+ assertEquals("Sun Oct 19 2014 03:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 3, 59)).toString());
+ assertEquals("Sun, 19 Oct 2014 05:59:00 GMT",
+ (new Date(2014, 9, 19, 3, 59)).toUTCString());
+ assertEquals("Sun Oct 19 2014 04:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 9, 19, 4, 0)).toString());
+ assertEquals("Sun, 19 Oct 2014 06:00:00 GMT",
+ (new Date(2014, 9, 19, 4, 0)).toUTCString());
+ assertEquals("Sat Feb 15 2014 22:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 1, 15, 22, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 00:59:00 GMT",
+ (new Date(2014, 1, 15, 22, 59)).toUTCString());
+ assertEquals("Sat Feb 15 2014 23:00:00 GMT-0200 (BRST)",
+ (new Date(2014, 1, 15, 23, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 01:00:00 GMT",
+ (new Date(2014, 1, 15, 23, 0)).toUTCString());
+ assertEquals("Sat Feb 15 2014 23:59:00 GMT-0200 (BRST)",
+ (new Date(2014, 1, 15, 23, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 01:59:00 GMT",
+ (new Date(2014, 1, 15, 23, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 00:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 0, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 03:00:00 GMT",
+ (new Date(2014, 1, 16, 0, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 00:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 0, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 03:59:00 GMT",
+ (new Date(2014, 1, 16, 0, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 01:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 1, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 04:00:00 GMT",
+ (new Date(2014, 1, 16, 1, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 01:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 1, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 04:59:00 GMT",
+ (new Date(2014, 1, 16, 1, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 02:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 2, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 05:00:00 GMT",
+ (new Date(2014, 1, 16, 2, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 02:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 2, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 05:59:00 GMT",
+ (new Date(2014, 1, 16, 2, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 03:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 3, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 06:00:00 GMT",
+ (new Date(2014, 1, 16, 3, 0)).toUTCString());
+ assertEquals("Sun Feb 16 2014 03:59:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 3, 59)).toString());
+ assertEquals("Sun, 16 Feb 2014 06:59:00 GMT",
+ (new Date(2014, 1, 16, 3, 59)).toUTCString());
+ assertEquals("Sun Feb 16 2014 04:00:00 GMT-0300 (BRT)",
+ (new Date(2014, 1, 16, 4, 0)).toString());
+ assertEquals("Sun, 16 Feb 2014 07:00:00 GMT",
+ (new Date(2014, 1, 16, 4, 0)).toUTCString());
+}
+
+if (timezone("PST")) {
+ assertEquals("Sat Mar 08 2014 22:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 8, 22, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 06:59:00 GMT",
+ (new Date(2014, 2, 8, 22, 59)).toUTCString());
+ assertEquals("Sat Mar 08 2014 23:00:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 8, 23, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 07:00:00 GMT",
+ (new Date(2014, 2, 8, 23, 0)).toUTCString());
+ assertEquals("Sat Mar 08 2014 23:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 8, 23, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 07:59:00 GMT",
+ (new Date(2014, 2, 8, 23, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 00:00:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 0, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 08:00:00 GMT",
+ (new Date(2014, 2, 9, 0, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 00:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 0, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 08:59:00 GMT",
+ (new Date(2014, 2, 9, 0, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 01:00:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 1, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 09:00:00 GMT",
+ (new Date(2014, 2, 9, 1, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 01:59:00 GMT-0800 (PST)",
+ (new Date(2014, 2, 9, 1, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 09:59:00 GMT",
+ (new Date(2014, 2, 9, 1, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 2, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:00:00 GMT",
+ (new Date(2014, 2, 9, 2, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 2, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:59:00 GMT",
+ (new Date(2014, 2, 9, 2, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 3, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:00:00 GMT",
+ (new Date(2014, 2, 9, 3, 0)).toUTCString());
+ assertEquals("Sun Mar 09 2014 03:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 3, 59)).toString());
+ assertEquals("Sun, 09 Mar 2014 10:59:00 GMT",
+ (new Date(2014, 2, 9, 3, 59)).toUTCString());
+ assertEquals("Sun Mar 09 2014 04:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 2, 9, 4, 0)).toString());
+ assertEquals("Sun, 09 Mar 2014 11:00:00 GMT",
+ (new Date(2014, 2, 9, 4, 0)).toUTCString());
+ assertEquals("Sat Nov 01 2014 22:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 1, 22, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 05:59:00 GMT",
+ (new Date(2014, 10, 1, 22, 59)).toUTCString());
+ assertEquals("Sat Nov 01 2014 23:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 1, 23, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 06:00:00 GMT",
+ (new Date(2014, 10, 1, 23, 0)).toUTCString());
+ assertEquals("Sat Nov 01 2014 23:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 1, 23, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 06:59:00 GMT",
+ (new Date(2014, 10, 1, 23, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 00:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 0, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 07:00:00 GMT",
+ (new Date(2014, 10, 2, 0, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 00:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 0, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 07:59:00 GMT",
+ (new Date(2014, 10, 2, 0, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 01:00:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 1, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 08:00:00 GMT",
+ (new Date(2014, 10, 2, 1, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 01:59:00 GMT-0700 (PDT)",
+ (new Date(2014, 10, 2, 1, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 08:59:00 GMT",
+ (new Date(2014, 10, 2, 1, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 02:00:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 2, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 10:00:00 GMT",
+ (new Date(2014, 10, 2, 2, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 02:59:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 2, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 10:59:00 GMT",
+ (new Date(2014, 10, 2, 2, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 03:00:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 3, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 11:00:00 GMT",
+ (new Date(2014, 10, 2, 3, 0)).toUTCString());
+ assertEquals("Sun Nov 02 2014 03:59:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 3, 59)).toString());
+ assertEquals("Sun, 02 Nov 2014 11:59:00 GMT",
+ (new Date(2014, 10, 2, 3, 59)).toUTCString());
+ assertEquals("Sun Nov 02 2014 04:00:00 GMT-0800 (PST)",
+ (new Date(2014, 10, 2, 4, 0)).toString());
+ assertEquals("Sun, 02 Nov 2014 12:00:00 GMT",
+ (new Date(2014, 10, 2, 4, 0)).toUTCString());
+}
diff --git a/test/mjsunit/regress/regress-3135.js b/test/mjsunit/regress/regress-3135.js
new file mode 100644
index 0000000..f15c9a8
--- /dev/null
+++ b/test/mjsunit/regress/regress-3135.js
@@ -0,0 +1,73 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Properties are serialized once.
+assertEquals('{"x":1}', JSON.stringify({ x : 1 }, ["x", 1, "x", 1]));
+assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, ["x", 1, "x", 1]));
+assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, ["1", 1, "1", 1]));
+assertEquals('{"1":1}', JSON.stringify({ 1 : 1 }, [1, "1", 1, "1"]));
+
+// Properties are visited at most once.
+var fired = 0;
+var getter_obj = { get x() { fired++; return 2; } };
+assertEquals('{"x":2}', JSON.stringify(getter_obj, ["x", "y", "x"]));
+assertEquals(1, fired);
+
+// Order of the replacer array is followed.
+assertEquals('{"y":4,"x":3}', JSON.stringify({ x : 3, y : 4}, ["y", "x"]));
+assertEquals('{"y":4,"1":2,"x":3}',
+ JSON.stringify({ x : 3, y : 4, 1 : 2 }, ["y", 1, "x"]));
+
+// With a replacer array the value of the property is retrieved using [[Get]]
+// ignoring own and enumerability.
+var a = { x : 8 };
+assertEquals('{"__proto__":{"__proto__":null},"x":8}',
+ JSON.stringify(a, ["__proto__", "x", "__proto__"]));
+a.__proto__ = { x : 7 };
+assertEquals('{"__proto__":{"__proto__":{"__proto__":null},"x":7},"x":8}',
+ JSON.stringify(a, ["__proto__", "x"]));
+var b = { __proto__: { x: 9 } };
+assertEquals('{}', JSON.stringify(b));
+assertEquals('{"x":9}', JSON.stringify(b, ["x"]));
+var c = {x: 10};
+Object.defineProperty(c, 'x', { enumerable: false });
+assertEquals('{}', JSON.stringify(c));
+assertEquals('{"x":10}', JSON.stringify(c, ["x"]));
+
+// Arrays are not affected by the replacer array.
+assertEquals("[9,8,7]", JSON.stringify([9, 8, 7], [1, 1]));
+var mixed_arr = [11,12,13];
+mixed_arr.x = 10;
+assertEquals('[11,12,13]', JSON.stringify(mixed_arr, [1, 0, 1]));
+
+// Array elements of objects are affected.
+var mixed_obj = { x : 3 };
+mixed_obj[0] = 6;
+mixed_obj[1] = 5;
+assertEquals('{"1":5,"0":6}', JSON.stringify(mixed_obj, [1, 0, 1]));
+
+// Nested object.
+assertEquals('{"z":{"x":3},"x":1}',
+ JSON.stringify({ x: 1, y:2, z: {x:3, b:4}}, ["z","x"]));
+
+// Objects in the replacer array are ignored.
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 }, [{}]));
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 }, [true, undefined, null]));
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 },
+ [{ toString: function() { return "x";} }]));
+assertEquals('{}',
+ JSON.stringify({ x : 1, "1": 1 },
+ [{ valueOf: function() { return 1;} }]));
+
+// Make sure that property names that clash with the names of Object.prototype
+// still works.
+assertEquals('{"toString":42}', JSON.stringify({ toString: 42 }, ["toString"]));
+
+// Number wrappers and String wrappers should be unwrapped.
+assertEquals('{"1":1,"s":"s"}',
+ JSON.stringify({ 1: 1, s: "s" },
+ [new Number(1), new String("s")]));
diff --git a/test/mjsunit/regress/regress-3138.js b/test/mjsunit/regress/regress-3138.js
new file mode 100644
index 0000000..acb121d
--- /dev/null
+++ b/test/mjsunit/regress/regress-3138.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+(function f(){
+ assertEquals("function", typeof f);
+})();
+
+(function f(){
+ var f; // Variable shadows function name.
+ assertEquals("undefined", typeof f);
+})();
+
+(function f(){
+ var f;
+ assertEquals("undefined", typeof f);
+ with ({}); // Force context allocation of both variable and function name.
+})();
+
+assertEquals("undefined", typeof f);
+
+// var initialization is intercepted by with scope.
+(function() {
+ var o = { a: 1 };
+ with (o) {
+ var a = 2;
+ }
+ assertEquals("undefined", typeof a);
+ assertEquals(2, o.a);
+})();
+
+// const initialization is not intercepted by with scope.
+(function() {
+ var o = { a: 1 };
+ with (o) {
+ const a = 2;
+ }
+ assertEquals(2, a);
+ assertEquals(1, o.a);
+})();
diff --git a/test/mjsunit/regress/regress-3158.js b/test/mjsunit/regress/regress-3158.js
new file mode 100644
index 0000000..c691273
--- /dev/null
+++ b/test/mjsunit/regress/regress-3158.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+Array.prototype[0] = 'a';
+delete Array.prototype[0];
+
+function foo(a, i) {
+ return a[i];
+}
+
+var a = new Array(100000);
+a[3] = 'x';
+
+foo(a, 3);
+foo(a, 3);
+foo(a, 3);
+%OptimizeFunctionOnNextCall(foo);
+foo(a, 3);
+Array.prototype[0] = 'a';
+var z = foo(a, 0);
+assertEquals('a', z);
diff --git a/test/mjsunit/regress/regress-3159.js b/test/mjsunit/regress/regress-3159.js
new file mode 100644
index 0000000..cfc8a39
--- /dev/null
+++ b/test/mjsunit/regress/regress-3159.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+try {
+ new Uint32Array(new ArrayBuffer(1), 2, 3);
+} catch (e) {
+ assertEquals("start offset of Uint32Array should be a multiple of 4",
+ e.message);
+}
diff --git a/test/mjsunit/regress/regress-317.js b/test/mjsunit/regress/regress-317.js
index b742fa1..85f408b 100644
--- a/test/mjsunit/regress/regress-317.js
+++ b/test/mjsunit/regress/regress-317.js
@@ -28,4 +28,3 @@
// Ensure replacement with string allows $ in replacement string.
assertEquals("a$ec", "abc".replace("b", "$e"), "$e isn't meaningful");
-
diff --git a/test/mjsunit/regress/regress-3176.js b/test/mjsunit/regress/regress-3176.js
new file mode 100644
index 0000000..e2563c0
--- /dev/null
+++ b/test/mjsunit/regress/regress-3176.js
@@ -0,0 +1,28 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ var sum = 0;
+ for (var i = 0; i < 10; i++) {
+ sum += a[i];
+
+ if (i > 6) {
+ sum -= a[i - 4];
+ sum -= a[i - 5];
+ }
+ }
+ return sum;
+}
+
+var a = new Int32Array(10);
+
+foo(a);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+%OptimizeFunctionOnNextCall(foo);
+foo(a);
+assertOptimized(foo);
diff --git a/test/mjsunit/regress/regress-3183.js b/test/mjsunit/regress/regress-3183.js
new file mode 100644
index 0000000..0c915b0
--- /dev/null
+++ b/test/mjsunit/regress/regress-3183.js
@@ -0,0 +1,96 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function DeoptimizeArgCallFunctionGeneric() {
+ var a = [];
+
+ function f1(method, array, elem, deopt) {
+ assertEquals('push', method);
+ }
+
+ function f2() { }
+
+ function bar(x, deopt, f) {
+ f('push', a, [x], deopt + 0);
+ }
+
+ function foo() { return bar(arguments[0], arguments[1], arguments[2]); }
+ function baz(f, deopt) { return foo("x", deopt, f); }
+
+ baz(f1, 0);
+ baz(f2, 0);
+ %OptimizeFunctionOnNextCall(baz);
+ baz(f1, "deopt");
+})();
+
+
+(function DeoptimizeArgGlobalFunctionGeneric() {
+ var a = [];
+
+ var f1;
+
+ f1 = function(method, array, elem, deopt) {
+ assertEquals('push', method);
+ }
+
+ function bar(x, deopt, f) {
+ f1('push', a, [x], deopt + 0);
+ }
+
+ function foo() { return bar(arguments[0], arguments[1]); }
+ function baz(deopt) { return foo("x", deopt); }
+
+ baz(0);
+ baz(0);
+ %OptimizeFunctionOnNextCall(baz);
+ baz("deopt");
+})();
+
+
+(function DeoptimizeArgCallFunctionRuntime() {
+ var a = [];
+
+ var f1;
+
+ f1 = function(method, array, elem, deopt) {
+ assertEquals('push', method);
+ }
+
+ function bar(x, deopt) {
+ %_CallFunction(null, 'push', [x][0], ((deopt + 0), 1), f1);
+ }
+
+ function foo() { return bar(arguments[0], arguments[1]); }
+ function baz(deopt) { return foo(0, deopt); }
+
+ baz(0);
+ baz(0);
+ %OptimizeFunctionOnNextCall(baz);
+ baz("deopt");
+})();
diff --git a/test/mjsunit/regress/regress-318420.js b/test/mjsunit/regress/regress-318420.js
new file mode 100644
index 0000000..77bef10
--- /dev/null
+++ b/test/mjsunit/regress/regress-318420.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bar(a, b) { with(a) {return a + b;} }
+
+var obj = {
+ functions: [bar, bar, bar, bar],
+ receivers: [bar, bar, undefined, null],
+ foo: function () {
+ for (var a = this.functions, e = this.receivers, c = a.length,
+ d = 0; d < c ; d++) {
+ a[d].apply(e[d], arguments)
+ }
+ }
+}
+
+obj.foo(1, 2, 3, 4);
+obj.foo(1, 2, 3, 4);
+%OptimizeFunctionOnNextCall(obj.foo);
+obj.foo(1, 2, 3, 4);
diff --git a/test/mjsunit/regress/regress-319120.js b/test/mjsunit/regress/regress-319120.js
new file mode 100644
index 0000000..2899da2
--- /dev/null
+++ b/test/mjsunit/regress/regress-319120.js
@@ -0,0 +1,28 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertThrows('x = new Float64Array({length: 0x24924925})');
diff --git a/test/mjsunit/regress/regress-319722-ArrayBuffer.js b/test/mjsunit/regress/regress-319722-ArrayBuffer.js
new file mode 100644
index 0000000..9a24fc5
--- /dev/null
+++ b/test/mjsunit/regress/regress-319722-ArrayBuffer.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nostress-opt --allow-natives-syntax --mock-arraybuffer-allocator
+var maxSize = %_MaxSmi() + 1;
+var ab;
+
+// Allocate the largest ArrayBuffer we can on this architecture.
+for (k = 8; k >= 1 && ab == null; k = k/2) {
+ try {
+ ab = new ArrayBuffer(maxSize * k);
+ } catch (e) {
+ ab = null;
+ }
+}
+
+assertTrue(ab != null);
+
+function TestArray(constr) {
+ assertThrows(function() {
+ new constr(ab, 0, maxSize);
+ }, RangeError);
+}
+
+TestArray(Uint8Array);
+TestArray(Int8Array);
+TestArray(Uint16Array);
+TestArray(Int16Array);
+TestArray(Uint32Array);
+TestArray(Int32Array);
+TestArray(Float32Array);
+TestArray(Float64Array);
+TestArray(Uint8ClampedArray);
diff --git a/test/mjsunit/regress/regress-319722-TypedArrays.js b/test/mjsunit/regress/regress-319722-TypedArrays.js
new file mode 100644
index 0000000..e497aec
--- /dev/null
+++ b/test/mjsunit/regress/regress-319722-TypedArrays.js
@@ -0,0 +1,45 @@
+
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nostress-opt --allow-natives-syntax
+var maxSize = %_MaxSmi() + 1;
+function TestArray(constr) {
+ assertThrows(function() {
+ new constr(maxSize);
+ }, RangeError);
+}
+
+TestArray(Uint8Array);
+TestArray(Int8Array);
+TestArray(Uint16Array);
+TestArray(Int16Array);
+TestArray(Uint32Array);
+TestArray(Int32Array);
+TestArray(Float32Array);
+TestArray(Float64Array);
+TestArray(Uint8ClampedArray);
diff --git a/test/mjsunit/regress/regress-3204.js b/test/mjsunit/regress/regress-3204.js
new file mode 100644
index 0000000..b3161be
--- /dev/null
+++ b/test/mjsunit/regress/regress-3204.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// -----------------------------------------------------------------------------
+
+function SmiTaggingCanOverflow(x) {
+ x = x | 0;
+ if (x == 0) return;
+ return x;
+}
+
+SmiTaggingCanOverflow(2147483647);
+SmiTaggingCanOverflow(2147483647);
+%OptimizeFunctionOnNextCall(SmiTaggingCanOverflow);
+assertEquals(2147483647, SmiTaggingCanOverflow(2147483647));
+
+// -----------------------------------------------------------------------------
+
+function ModILeftCanBeNegative() {
+ var x = 0;
+ for (var i = -1; i < 0; ++i) x = i % 2;
+ return x;
+}
+
+ModILeftCanBeNegative();
+%OptimizeFunctionOnNextCall(ModILeftCanBeNegative);
+assertEquals(-1, ModILeftCanBeNegative());
+
+// -----------------------------------------------------------------------------
+
+function ModIRightCanBeZero() {
+ var x = 0;
+ for (var i = -1; i <= 0; ++i) x = (2 % i) | 0;
+ return x;
+}
+
+ModIRightCanBeZero();
+%OptimizeFunctionOnNextCall(ModIRightCanBeZero);
+ModIRightCanBeZero();
diff --git a/test/mjsunit/regress/regress-320532.js b/test/mjsunit/regress/regress-320532.js
new file mode 100644
index 0000000..0c3198f
--- /dev/null
+++ b/test/mjsunit/regress/regress-320532.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax --expose-gc
+// Flags: --noalways-opt
+// Flags: --stress-runs=8 --send-idle-notification --gc-global
+
+
+function bar() { return new Array(); }
+bar();
+bar();
+%OptimizeFunctionOnNextCall(bar);
+a = bar();
+function foo(len) { return new Array(len); }
+foo(0);
+foo(0);
+%OptimizeFunctionOnNextCall(bar);
+foo(0);
diff --git a/test/mjsunit/regress/regress-3220.js b/test/mjsunit/regress/regress-3220.js
new file mode 100644
index 0000000..6f8e8c8
--- /dev/null
+++ b/test/mjsunit/regress/regress-3220.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-strict
+
+String(new Date());
diff --git a/test/mjsunit/regress/regress-323845.js b/test/mjsunit/regress/regress-323845.js
new file mode 100644
index 0000000..4e81657
--- /dev/null
+++ b/test/mjsunit/regress/regress-323845.js
@@ -0,0 +1,47 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Regression test that breaks escape analysis because objects escape over
+// the arguments object.
+
+// Flags: --allow-natives-syntax
+
+function h() {
+ g.arguments;
+}
+
+function g(x) {
+ h();
+}
+
+function f() {
+ g({});
+}
+
+f(); f(); f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-324028.js b/test/mjsunit/regress/regress-324028.js
new file mode 100644
index 0000000..7fe0fcd
--- /dev/null
+++ b/test/mjsunit/regress/regress-324028.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var badObj = { length : 1e40 };
+
+assertThrows(function() { new Uint8Array(badObj); }, RangeError);
+assertThrows(function() { new Uint8ClampedArray(badObj); }, RangeError);
+assertThrows(function() { new Int8Array(badObj); }, RangeError);
+assertThrows(function() { new Uint16Array(badObj); }, RangeError);
+assertThrows(function() { new Int16Array(badObj); }, RangeError);
+assertThrows(function() { new Uint32Array(badObj); }, RangeError);
+assertThrows(function() { new Int32Array(badObj); }, RangeError);
+assertThrows(function() { new Float32Array(badObj); }, RangeError);
+assertThrows(function() { new Float64Array(badObj); }, RangeError);
diff --git a/test/mjsunit/regress/regress-3255.js b/test/mjsunit/regress/regress-3255.js
new file mode 100644
index 0000000..0e77435
--- /dev/null
+++ b/test/mjsunit/regress/regress-3255.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+var arr = [];
+var str = new String('x');
+
+function f(a,b) {
+ a[b] = 1;
+}
+
+f(arr, 0);
+f(str, 0);
+f(str, 0);
+
+// This is just to trigger elements validation, object already broken.
+%SetProperty(str, 1, 'y', 0);
diff --git a/test/mjsunit/regress/regress-325676.js b/test/mjsunit/regress/regress-325676.js
new file mode 100644
index 0000000..7450a6d
--- /dev/null
+++ b/test/mjsunit/regress/regress-325676.js
@@ -0,0 +1,70 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
+// If a function parameter is forced to be context allocated,
+// debug evaluate need to resolve it to a context slot instead of
+// parameter slot on the stack.
+
+var Debug = debug.Debug;
+
+var expected;
+var exception = null;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ try {
+ assertEquals(expected, exec_state.frame(0).evaluate('arg').value());
+ exec_state.frame(0).evaluate('arg = "evaluated";');
+ } catch (e) {
+ exception = e;
+ }
+}
+
+Debug.setListener(listener);
+
+function f(arg) {
+ expected = arg;
+ debugger;
+ assertEquals("evaluated", arg);
+
+ arg = "value";
+ expected = arg;
+ debugger;
+ assertEquals("evaluated", arg);
+
+ // Forces arg to be context allocated even though a parameter.
+ function g() { arg; }
+}
+
+f();
+f(1);
+f(1, 2);
+
+assertNull(exception);
diff --git a/test/mjsunit/regress/regress-3281.js b/test/mjsunit/regress/regress-3281.js
new file mode 100644
index 0000000..7d42c02
--- /dev/null
+++ b/test/mjsunit/regress/regress-3281.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-natives-as=builtins
+// Should not crash or raise an exception.
+
+var s = new Set();
+var setIterator = new builtins.SetIterator(s, 2);
+
+var m = new Map();
+var mapIterator = new builtins.MapIterator(m, 2);
diff --git a/test/mjsunit/regress/regress-3294.js b/test/mjsunit/regress/regress-3294.js
new file mode 100644
index 0000000..400e6b6
--- /dev/null
+++ b/test/mjsunit/regress/regress-3294.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var e = new Error('message');
+var keys = Object.keys(e);
+e.stack;
+assertEquals(keys, Object.keys(e));
diff --git a/test/mjsunit/regress/regress-330046.js b/test/mjsunit/regress/regress-330046.js
new file mode 100644
index 0000000..d94b804
--- /dev/null
+++ b/test/mjsunit/regress/regress-330046.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --use-osr --allow-natives-syntax --crankshaft
+
+var o1 = {a : 10};
+var o2 = { };
+o2.__proto__ = o1;
+var o3 = { };
+o3.__proto__ = o2;
+
+function f(n, x, b) {
+ var sum = x.a;
+ for (var i = 0; i < n; i++) {
+ sum = 1.0 / i;
+ }
+ return sum;
+}
+
+f(10, o3);
+f(20, o3);
+f(30, o3);
+%OptimizeFunctionOnNextCall(f, "concurrent");
+f(100000, o3);
+// At this point OSR replaces already optimized code.
+// Check that it evicts old code from cache.
+
+// This causes all code for f to be lazily deopted.
+o2.a = 5;
+
+// If OSR did not evict the old code, it will be installed in f here.
+%OptimizeFunctionOnNextCall(f);
+f(10, o3);
+
+// The old code is already deoptimized, but f still points to it.
+// Disassembling it will crash.
+%DebugDisassembleFunction(f);
diff --git a/test/mjsunit/regress/regress-3307.js b/test/mjsunit/regress/regress-3307.js
new file mode 100644
index 0000000..1fc770d
--- /dev/null
+++ b/test/mjsunit/regress/regress-3307.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function p(x) {
+ this.x = x;
+}
+
+function f() {
+ var a = new p(1), b = new p(2);
+ for (var i = 0; i < 1; i++) {
+ a.x += b.x;
+ }
+ return a.x;
+}
+
+new p(0.1); // make 'x' mutable box double field in p.
+
+assertEquals(3, f());
+assertEquals(3, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
diff --git a/test/mjsunit/regress/regress-331416.js b/test/mjsunit/regress/regress-331416.js
new file mode 100644
index 0000000..0c60fce
--- /dev/null
+++ b/test/mjsunit/regress/regress-331416.js
@@ -0,0 +1,52 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function load(a, i) {
+ return a[i];
+}
+load([1, 2, 3], "length");
+load(3);
+load([1, 2, 3], 3);
+load(0, 0);
+%OptimizeFunctionOnNextCall(load);
+assertEquals(2, load([1, 2, 3], 1));
+assertEquals(undefined, load(0, 0));
+
+function store(a, i, x) {
+ a[i] = x;
+}
+store([1, 2, 3], "length", 3);
+store(3);
+store([1, 2, 3], 3, 3);
+store(0, 0, 1);
+%OptimizeFunctionOnNextCall(store);
+var a = [1, 2, 3];
+store(a, 1, 1);
+assertEquals(1, a[1]);
+store(0, 0, 1);
diff --git a/test/mjsunit/regress/regress-331444.js b/test/mjsunit/regress/regress-331444.js
new file mode 100644
index 0000000..c78d6fb
--- /dev/null
+++ b/test/mjsunit/regress/regress-331444.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+function boom() {
+ var args = [];
+ for (var i = 0; i < 125000; i++)
+ args.push(i);
+ return Array.apply(Array, args);
+}
+var array = boom();
+function fib(n) {
+ var f0 = 0, f1 = 1;
+ for (; n > 0; n = n - 1) {
+ f0 + f1;
+ f0 = array;
+ }
+}
+fib(12);
diff --git a/test/mjsunit/regress/regress-3315.js b/test/mjsunit/regress/regress-3315.js
new file mode 100644
index 0000000..a1105e2
--- /dev/null
+++ b/test/mjsunit/regress/regress-3315.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var indexZeroCallCount = 0;
+var indexOneCallCount = 0;
+var lengthCallCount = 0;
+var acceptList = {
+ get 0() {
+ indexZeroCallCount++;
+ return 'foo';
+ },
+ get 1() {
+ indexOneCallCount++;
+ return 'bar';
+ },
+ get length() {
+ lengthCallCount++;
+ return 1;
+ }
+};
+
+Object.observe({}, function(){}, acceptList);
+assertEquals(1, lengthCallCount);
+assertEquals(1, indexZeroCallCount);
+assertEquals(0, indexOneCallCount);
diff --git a/test/mjsunit/regress/regress-3334.js b/test/mjsunit/regress/regress-3334.js
new file mode 100644
index 0000000..301155d
--- /dev/null
+++ b/test/mjsunit/regress/regress-3334.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo(){}
+Object.defineProperty(foo, "prototype", { value: 2 });
+assertEquals(2, foo.prototype);
+
+function bar(){}
+Object.defineProperty(bar, "prototype", { value: 2, writable: false });
+assertEquals(2, bar.prototype);
+assertThrows(function() { "use strict"; bar.prototype = 10; }, TypeError);
+assertEquals(false, Object.getOwnPropertyDescriptor(bar,"prototype").writable);
diff --git a/test/mjsunit/regress/regress-333594.js b/test/mjsunit/regress/regress-333594.js
new file mode 100644
index 0000000..6f6dbaa
--- /dev/null
+++ b/test/mjsunit/regress/regress-333594.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = { x: 1.1 };
+a.x = 0;
+var G = a.x;
+var o = { x: {} };
+
+function func() {
+ return {x: G};
+}
+
+func();
+func();
+%OptimizeFunctionOnNextCall(func);
+assertEquals(0, func().x);
diff --git a/test/mjsunit/regress/regress-334.js b/test/mjsunit/regress/regress-334.js
index 024fc9e..c52c72a 100644
--- a/test/mjsunit/regress/regress-334.js
+++ b/test/mjsunit/regress/regress-334.js
@@ -37,10 +37,10 @@
function func2(){}
var object = {__proto__:{}};
-%SetProperty(object, "foo", func1, DONT_ENUM | DONT_DELETE);
-%SetProperty(object, "bar", func1, DONT_ENUM | READ_ONLY);
-%SetProperty(object, "baz", func1, DONT_DELETE | READ_ONLY);
-%SetProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE | READ_ONLY);
+%AddNamedProperty(object, "foo", func1, DONT_ENUM | DONT_DELETE);
+%AddNamedProperty(object, "bar", func1, DONT_ENUM | READ_ONLY);
+%AddNamedProperty(object, "baz", func1, DONT_DELETE | READ_ONLY);
+%AddNamedProperty(object.__proto__, "bif", func1, DONT_ENUM | DONT_DELETE);
object.bif = func2;
function enumerable(obj) {
diff --git a/test/mjsunit/regress/regress-334708.js b/test/mjsunit/regress/regress-334708.js
new file mode 100644
index 0000000..f0291bb
--- /dev/null
+++ b/test/mjsunit/regress/regress-334708.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function foo(x, y) {
+ return Math.floor(x / y);
+}
+
+function bar(x, y) {
+ return foo(x + 1, y + 1);
+}
+
+foo(16, "4");
+
+bar(64, 2);
+%OptimizeFunctionOnNextCall(bar);
+bar(64, 2);
diff --git a/test/mjsunit/regress/regress-3359.js b/test/mjsunit/regress/regress-3359.js
new file mode 100644
index 0000000..0973797
--- /dev/null
+++ b/test/mjsunit/regress/regress-3359.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return 1 >> Boolean.constructor + 1;
+}
+assertEquals(1, f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f());
diff --git a/test/mjsunit/regress/regress-336820.js b/test/mjsunit/regress/regress-336820.js
new file mode 100644
index 0000000..9b46629
--- /dev/null
+++ b/test/mjsunit/regress/regress-336820.js
@@ -0,0 +1,36 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertThrows((function() {
+ s = "Hello World!\n";
+ while (true) {
+ x = new Array();
+ x[0] = s;
+ x[1000] = s;
+ x[1000000] = s;
+ s = x.join("::");
+ }}), RangeError);
diff --git a/test/mjsunit/regress/regress-3380.js b/test/mjsunit/regress/regress-3380.js
new file mode 100644
index 0000000..2fae459
--- /dev/null
+++ b/test/mjsunit/regress/regress-3380.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a) {
+ return (a[0] >>> 0) > 0;
+}
+
+var a = new Uint32Array([4]);
+var b = new Uint32Array([0x80000000]);
+assertTrue(foo(a));
+assertTrue(foo(a));
+%OptimizeFunctionOnNextCall(foo);
+assertTrue(foo(b))
diff --git a/test/mjsunit/regress/regress-3392.js b/test/mjsunit/regress/regress-3392.js
new file mode 100644
index 0000000..375f302
--- /dev/null
+++ b/test/mjsunit/regress/regress-3392.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var a = {b: -1.5};
+ for (var i = 0; i < 1; i++) {
+ a.b = 1;
+ }
+ assertTrue(0 <= a.b);
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/regress/regress-340125.js b/test/mjsunit/regress/regress-340125.js
new file mode 100644
index 0000000..a3e40a8
--- /dev/null
+++ b/test/mjsunit/regress/regress-340125.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+var a = new Int8Array(2);
+var b = a.subarray(2, 4);
+assertThrows(function () { a.set(b, 1e10); }, RangeError);
diff --git a/test/mjsunit/regress/regress-3404.js b/test/mjsunit/regress/regress-3404.js
new file mode 100644
index 0000000..c4d280e
--- /dev/null
+++ b/test/mjsunit/regress/regress-3404.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function testError(error) {
+ // Reconfigure e.stack to be non-configurable
+ var desc1 = Object.getOwnPropertyDescriptor(error, "stack");
+ Object.defineProperty(error, "stack",
+ {get: desc1.get, set: desc1.set, configurable: false});
+
+ var desc2 = Object.getOwnPropertyDescriptor(error, "stack");
+ assertFalse(desc2.configurable);
+ assertEquals(desc1.get, desc2.get);
+ assertEquals(desc2.get, desc2.get);
+}
+
+function stackOverflow() {
+ function f() { f(); }
+ try { f() } catch (e) { return e; }
+}
+
+function referenceError() {
+ try { g() } catch (e) { return e; }
+}
+
+testError(referenceError());
+testError(stackOverflow());
diff --git a/test/mjsunit/regress/regress-343609.js b/test/mjsunit/regress/regress-343609.js
new file mode 100644
index 0000000..5205ca1
--- /dev/null
+++ b/test/mjsunit/regress/regress-343609.js
@@ -0,0 +1,66 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --block-concurrent-recompilation
+// Flags: --no-concurrent-osr --expose-gc
+
+function Ctor() {
+ this.a = 1;
+}
+
+function get_closure() {
+ return function add_field(obj) {
+ obj.c = 3;
+ obj.a = obj.a + obj.c;
+ return obj.a;
+ }
+}
+function get_closure2() {
+ return function cc(obj) {
+ obj.c = 3;
+ obj.a = obj.a + obj.c;
+ }
+}
+
+function dummy() {
+ (function () {
+ var o = {c: 10};
+ var f1 = get_closure2();
+ f1(o);
+ f1(o);
+ %OptimizeFunctionOnNextCall(f1);
+ f1(o);
+ })();
+}
+
+var o = new Ctor();
+function opt() {
+ (function () {
+ var f1 = get_closure();
+ f1(new Ctor());
+ f1(new Ctor());
+ %OptimizeFunctionOnNextCall(f1);
+ f1(o);
+ })();
+}
+
+// Optimize add_field and install its code in optimized code cache.
+opt();
+opt();
+opt();
+
+// Optimize dummy function to remove the add_field from head of optimized
+// function list in the context.
+dummy();
+dummy();
+
+// Kill add_field in new space GC.
+for(var i = 0; i < 3; i++) gc(true);
+
+// Trigger deopt.
+o.c = 2.2;
+
+// Fetch optimized code of add_field from cache and crash.
+var f2 = get_closure();
+f2(new Ctor());
diff --git a/test/mjsunit/regress/regress-3462.js b/test/mjsunit/regress/regress-3462.js
new file mode 100644
index 0000000..5a33559
--- /dev/null
+++ b/test/mjsunit/regress/regress-3462.js
@@ -0,0 +1,48 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+
+function TestFunctionPrototypeSetter() {
+ var f = function() {};
+ var o = {__proto__: f};
+ o.prototype = 42;
+ assertEquals(42, o.prototype);
+ assertTrue(o.hasOwnProperty('prototype'));
+}
+TestFunctionPrototypeSetter();
+
+
+function TestFunctionPrototypeSetterOnValue() {
+ var f = function() {};
+ var fp = f.prototype;
+ Number.prototype.__proto__ = f;
+ var n = 42;
+ var o = {};
+ n.prototype = o;
+ assertEquals(fp, n.prototype);
+ assertEquals(fp, f.prototype);
+ assertFalse(Number.prototype.hasOwnProperty('prototype'));
+}
+TestFunctionPrototypeSetterOnValue();
+
+
+function TestArrayLengthSetter() {
+ var a = [1];
+ var o = {__proto__: a};
+ o.length = 2;
+ assertEquals(2, o.length);
+ assertEquals(1, a.length);
+ assertTrue(o.hasOwnProperty('length'));
+}
+TestArrayLengthSetter();
+
+
+function TestArrayLengthSetterOnValue() {
+ Number.prototype.__proto__ = [1];
+ var n = 42;
+ n.length = 2;
+ assertEquals(1, n.length);
+ assertFalse(Number.prototype.hasOwnProperty('length'));
+}
+TestArrayLengthSetterOnValue();
diff --git a/test/mjsunit/regress/regress-346343.js b/test/mjsunit/regress/regress-346343.js
new file mode 100644
index 0000000..e4c1066
--- /dev/null
+++ b/test/mjsunit/regress/regress-346343.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ for (var i = 1; i < 2; ++i) {
+ var y = o.y;
+ }
+}
+f({y:1.1});
+f({y:1.1});
+
+function g(x) { f({z:x}); }
+g(1);
+g(2);
+%OptimizeFunctionOnNextCall(g);
+g(1);
diff --git a/test/mjsunit/regress/regress-346587.js b/test/mjsunit/regress/regress-346587.js
new file mode 100644
index 0000000..40e3ac1
--- /dev/null
+++ b/test/mjsunit/regress/regress-346587.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --fold-constants --allow-natives-syntax
+
+function bar(obj) {
+ assertTrue(obj.x === 'baz');
+}
+
+function foo() {
+ bar({ x : 'baz' });
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/regress/regress-347262.js b/test/mjsunit/regress/regress-347262.js
new file mode 100644
index 0000000..76bc34a
--- /dev/null
+++ b/test/mjsunit/regress/regress-347262.js
@@ -0,0 +1,62 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+(function ArgumentsObjectWithOtherArgumentsInFrame() {
+ function g() {
+ return g.arguments;
+ }
+
+ function f(x) {
+ g();
+ return arguments[0];
+ }
+ f();
+ f();
+ %OptimizeFunctionOnNextCall(f);
+ f();
+})();
+
+
+(function ArgumentsObjectWithOtherArgumentsDeopt() {
+ function g(y) {
+ y.o2 = 2;
+ return g.arguments;
+ }
+
+ function f(x) {
+ var o1 = { o2 : 1 };
+ var a = g(o1);
+ o1.o2 = 3;
+ return arguments[0] + a[0].o2;
+ }
+ f(0);
+ f(0);
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals(3, f(0));
+})();
diff --git a/test/mjsunit/regress/regress-347530.js b/test/mjsunit/regress/regress-347530.js
new file mode 100644
index 0000000..330fda3
--- /dev/null
+++ b/test/mjsunit/regress/regress-347530.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+a = [];
+a[1000] = .1;
+a.length = 0;
+gc();
+gc();
+a[1000] = .1;
+assertEquals(.1, a[1000]);
diff --git a/test/mjsunit/regress/regress-347542.js b/test/mjsunit/regress/regress-347542.js
new file mode 100644
index 0000000..901d798
--- /dev/null
+++ b/test/mjsunit/regress/regress-347542.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
+%NeverOptimizeFunction(foo);
diff --git a/test/mjsunit/regress/regress-347543.js b/test/mjsunit/regress/regress-347543.js
new file mode 100644
index 0000000..aceddb5
--- /dev/null
+++ b/test/mjsunit/regress/regress-347543.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code --fold-constants
+
+function f(a) {
+ a[5000000] = 256;
+ assertEquals(256, a[5000000]);
+}
+
+var v1 = new Array(5000001);
+var v2 = new Array(10);
+f(v1);
+f(v2);
+f(v2);
+%OptimizeFunctionOnNextCall(f);
+f(v2);
+f(v1);
diff --git a/test/mjsunit/regress/regress-3476.js b/test/mjsunit/regress/regress-3476.js
new file mode 100644
index 0000000..f4333db
--- /dev/null
+++ b/test/mjsunit/regress/regress-3476.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MyWrapper(v) {
+ return { valueOf: function() { return v } };
+}
+
+function f() {
+ assertEquals("truex", true + "x");
+ assertEquals("truey", true + new String("y"));
+ assertEquals("truez", true + new MyWrapper("z"));
+
+ assertEquals("xtrue", "x" + true);
+ assertEquals("ytrue", new String("y") + true);
+ assertEquals("ztrue", new MyWrapper("z") + true);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-347904.js b/test/mjsunit/regress/regress-347904.js
new file mode 100644
index 0000000..1a27b05
--- /dev/null
+++ b/test/mjsunit/regress/regress-347904.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-runs=2
+
+var v = /abc/;
+function f() {
+ v = 1578221999;
+};
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-347906.js b/test/mjsunit/regress/regress-347906.js
new file mode 100644
index 0000000..c751618
--- /dev/null
+++ b/test/mjsunit/regress/regress-347906.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony
+
+function foo() {
+ return Math.clz32(12.34);
+}
+
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/regress/regress-347909.js b/test/mjsunit/regress/regress-347909.js
new file mode 100644
index 0000000..90a8e6a
--- /dev/null
+++ b/test/mjsunit/regress/regress-347909.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = {y:1.5};
+a.y = 0;
+var b = a.y;
+a.y = {};
+var d = 1;
+function f() {
+ d = 0;
+ return {y: b};
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-347912.js b/test/mjsunit/regress/regress-347912.js
new file mode 100644
index 0000000..b609e36
--- /dev/null
+++ b/test/mjsunit/regress/regress-347912.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var __v_4 = {};
+__v_2 = {};
+__v_2[1024] = 0;
+%DebugPrint(__v_4);
diff --git a/test/mjsunit/regress/regress-347914.js b/test/mjsunit/regress/regress-347914.js
new file mode 100644
index 0000000..bc4dcd7
--- /dev/null
+++ b/test/mjsunit/regress/regress-347914.js
@@ -0,0 +1,89 @@
+ // Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code --gc-interval=201 --verify-heap --max-inlined-source-size=999999 --max-inlined-nodes=999999 --max-inlined-nodes-cumulative=999999
+
+// Begin stripped down and modified version of mjsunit.js for easy minimization in CF.
+function MjsUnitAssertionError(message) {}
+MjsUnitAssertionError.prototype.toString = function () { return this.message; };
+var assertSame;
+var assertEquals;
+var assertEqualsDelta;
+var assertArrayEquals;
+var assertPropertiesEqual;
+var assertToStringEquals;
+var assertTrue;
+var assertFalse;
+var triggerAssertFalse;
+var assertNull;
+var assertNotNull;
+var assertThrows;
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); }; assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+as1sertThrows = function assertThrows(code, type_opt, cause_opt) { var threwException = true; try { if (typeof code == 'function') { code(); } else { eval(code); } threwException = false; } catch (e) { if (typeof type_opt == 'function') { assertInstanceof(e, type_opt); } if (arguments.length >= 3) { assertEquals(e.type, cause_opt); } return; } };
+assertInstanceof = function assertInstanceof(obj, type) { if (!(obj instanceof type)) { var actualTypeName = null; var actualConstructor = Object.getPrototypeOf(obj).constructor; if (typeof actualConstructor == "function") { actualTypeName = actualConstructor.name || String(actualConstructor); } fail("Object <" + PrettyPrint(obj) + "> is not an instance of <" + (type.name || type) + ">" + (actualTypeName ? " but of < " + actualTypeName + ">" : "")); } };
+assertDoesNotThrow = function assertDoesNotThrow(code, name_opt) { try { if (typeof code == 'function') { code(); } else { eval(code); } } catch (e) { fail("threw an exception: ", e.message || e, name_opt); } };
+assertUnreachable = function assertUnreachable(name_opt) { var message = "Fail" + "ure: unreachable"; if (name_opt) { message += " - " + name_opt; } };
+var OptimizationStatus;
+try { OptimizationStatus = new Function("fun", "sync", "return %GetOptimizationStatus(fun, sync);"); } catch (e) { OptimizationStatus = function() { } }
+assertUnoptimized = function assertUnoptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 1, name_opt); }
+assertOptimized = function assertOptimized(fun, sync_opt, name_opt) { if (sync_opt === undefined) sync_opt = ""; assertTrue(OptimizationStatus(fun, sync_opt) != 2, name_opt); }
+triggerAssertFalse = function() { }
+// End stripped down and modified version of mjsunit.js.
+
+var __v_1 = {};
+var __v_2 = {};
+var __v_3 = {};
+var __v_4 = {};
+var __v_5 = {};
+var __v_6 = {};
+var __v_7 = {};
+var __v_8 = {};
+var __v_9 = {};
+var __v_10 = {};
+var __v_0 = 'fisk';
+assertEquals('fisk', __v_0);
+var __v_0;
+assertEquals('fisk', __v_0);
+var __v_6 = 'hest';
+assertEquals('hest', __v_0);
+this.bar = 'fisk';
+assertEquals('fisk', __v_1);
+__v_1;
+assertEquals('fisk', __v_1);
+__v_1 = 'hest';
+assertEquals('hest', __v_1);
+
+function __f_0(o) {
+ o.g();
+ if (!o.g()) {
+ assertTrue(false);
+ }
+}
+__v_4 = {};
+__v_4.size = function() { return 42; }
+__v_4.g = function() { return this.size(); };
+__f_0({g: __v_4.g, size:__v_4.size});
+for (var __v_0 = 0; __v_0 < 5; __v_0++) __f_0(__v_4);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_4);
+__f_0({g: __v_4.g, size:__v_4.size});
diff --git a/test/mjsunit/regress/regress-348280.js b/test/mjsunit/regress/regress-348280.js
new file mode 100644
index 0000000..319c270
--- /dev/null
+++ b/test/mjsunit/regress/regress-348280.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function baz(f) { f(); }
+function goo() {}
+baz(goo);
+baz(goo);
+
+function bar(p) { if (p == 0) baz(1); }
+bar(1);
+bar(1);
+%OptimizeFunctionOnNextCall(bar);
+bar(1);
diff --git a/test/mjsunit/regress/regress-348512.js b/test/mjsunit/regress/regress-348512.js
new file mode 100644
index 0000000..7d89666
--- /dev/null
+++ b/test/mjsunit/regress/regress-348512.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function h(y) { assertEquals(42, y.u); }
+function g() { h.apply(0, arguments); }
+function f(x) { g({ u : x }); }
+
+f(42);
+f(42);
+%OptimizeFunctionOnNextCall(f);
+f(42);
diff --git a/test/mjsunit/regress/regress-349870.js b/test/mjsunit/regress/regress-349870.js
new file mode 100644
index 0000000..72df055
--- /dev/null
+++ b/test/mjsunit/regress/regress-349870.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var r = /x/;
+Object.freeze(r);
+r.compile("x");
diff --git a/test/mjsunit/regress/regress-349885.js b/test/mjsunit/regress/regress-349885.js
new file mode 100644
index 0000000..dd3e795
--- /dev/null
+++ b/test/mjsunit/regress/regress-349885.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// The bug 349885
+
+function foo(a) {
+ a[292755462] = new Object();
+}
+foo(new Array(5));
+foo(new Array(5));
+%OptimizeFunctionOnNextCall(foo);
+foo(new Array(10));
diff --git a/test/mjsunit/regress/regress-350863.js b/test/mjsunit/regress/regress-350863.js
new file mode 100644
index 0000000..616792b
--- /dev/null
+++ b/test/mjsunit/regress/regress-350863.js
@@ -0,0 +1,45 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax
+
+var __v_7 = { };
+function __f_8(base, condition) {
+ __v_7[base + 3] = 0;
+ __v_7[base + 4] = 0;
+ if (condition) {
+ __v_7[base + 0] = 0;
+ __v_7[base + 5] = 0;
+ } else {
+ __v_7[base + 0] = 0;
+ __v_7[base + 18] = 0;
+ }
+}
+__f_8(1, true);
+__f_8(1, false);
+%OptimizeFunctionOnNextCall(__f_8);
+__f_8(5, false);
diff --git a/test/mjsunit/regress/regress-350865.js b/test/mjsunit/regress/regress-350865.js
new file mode 100644
index 0000000..74234db
--- /dev/null
+++ b/test/mjsunit/regress/regress-350865.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stress-compaction --stack-size=150
+
+/\2/.test("1");
+
+function rec() {
+ try {
+ rec();
+ } catch(e) {
+ /\2/.test("1");
+ }
+}
+
+rec();
diff --git a/test/mjsunit/regress/regress-350884.js b/test/mjsunit/regress/regress-350884.js
new file mode 100644
index 0000000..8656853
--- /dev/null
+++ b/test/mjsunit/regress/regress-350884.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var obj = new Array(1);
+obj[0] = 0;
+obj[1] = 0;
+function foo(flag_index) {
+ obj[flag_index]++;
+}
+
+// Force dictionary properties on obj.
+obj[-8] = 3;
+foo(1);
+foo(2);
diff --git a/test/mjsunit/regress/regress-350887.js b/test/mjsunit/regress/regress-350887.js
new file mode 100644
index 0000000..638aa30
--- /dev/null
+++ b/test/mjsunit/regress/regress-350887.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var arr = [];
+assertSame(0, arr.length);
+assertSame(undefined, arr[0]);
+Object.defineProperty(arr, '2501866687', { value: 4, configurable: false });
+// 2501866688 is out of smi range.
+assertSame(2501866688, arr.length);
+assertSame(undefined, arr[0]);
+arr.length = 0;
diff --git a/test/mjsunit/regress/regress-351261.js b/test/mjsunit/regress/regress-351261.js
new file mode 100644
index 0000000..48af544
--- /dev/null
+++ b/test/mjsunit/regress/regress-351261.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --fold-constants
+
+function store(a) {
+ a[5000000] = 1;
+}
+
+function foo() {
+ var __v_8 = new Object;
+ var __v_7 = new Array(4999990);
+ store(__v_8);
+ store(__v_7);
+}
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/regress/regress-351263.js b/test/mjsunit/regress/regress-351263.js
new file mode 100644
index 0000000..28edbcd
--- /dev/null
+++ b/test/mjsunit/regress/regress-351263.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var __v_12 = {};
+function __f_30(x, sa) {
+ return (x >>> sa) | (x << (__v_12 - sa));
+}
+__f_30(1.4, 1);
+__f_30(1.4, 1);
+%OptimizeFunctionOnNextCall(__f_30);
+__f_30(1.4, 1);
diff --git a/test/mjsunit/regress/regress-351315.js b/test/mjsunit/regress/regress-351315.js
new file mode 100644
index 0000000..e2580fc
--- /dev/null
+++ b/test/mjsunit/regress/regress-351315.js
@@ -0,0 +1,49 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f_13(x, y, z) { }
+
+v_5 = f_13.bind({}, -7);
+
+function f_0(z) {
+ return %NewObjectFromBound(v_5);
+}
+
+function f_8(z2, y2) {
+ var v_0 = { f1 : 0.5, f2 : 0.25 };
+ return f_0(v_0);
+}
+
+function f_12(f, args) {
+ f.apply(this, args);
+ %OptimizeFunctionOnNextCall(f);
+ f.apply(this, args);
+}
+
+f_12(f_8, [6, 4]);
diff --git a/test/mjsunit/regress/regress-351319.js b/test/mjsunit/regress/regress-351319.js
new file mode 100644
index 0000000..a2afbb6
--- /dev/null
+++ b/test/mjsunit/regress/regress-351319.js
@@ -0,0 +1,39 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function __f_0(a, base) {
+ a[base] = 1;
+ a[base] = -1749557862;
+}
+var __v_0 = new Array(1024);
+var __v_1 = new Array(128);
+__f_0(__v_0, 1);
+__f_0(__v_1, -2);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_0, -2);
diff --git a/test/mjsunit/regress/regress-351624.js b/test/mjsunit/regress/regress-351624.js
new file mode 100644
index 0000000..fc3715b
--- /dev/null
+++ b/test/mjsunit/regress/regress-351624.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var big = 1e10;
+var backup = new Float64Array(1);
+
+function mult0(val){
+ var prod = val * big;
+ backup[0] = prod;
+ var rounded = Math.round(prod);
+ assertEquals(prod, backup[0]);
+ return rounded;
+}
+
+var count = 5;
+for (var i = 0; i < count; i++) {
+ if (i == count - 1) %OptimizeFunctionOnNextCall(mult0);
+ var result = mult0(-1);
+ assertEquals(result, -big);
+}
diff --git a/test/mjsunit/regress/regress-352059.js b/test/mjsunit/regress/regress-352059.js
new file mode 100644
index 0000000..cd1a4c2
--- /dev/null
+++ b/test/mjsunit/regress/regress-352059.js
@@ -0,0 +1,35 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var foo = false;
+
+function bar() {
+ foo = 2;
+ return 4 % foo;
+}
+
+bar();
diff --git a/test/mjsunit/regress/regress-352982.js b/test/mjsunit/regress/regress-352982.js
new file mode 100644
index 0000000..5d3ce1c
--- /dev/null
+++ b/test/mjsunit/regress/regress-352982.js
@@ -0,0 +1,51 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+function __f_4(i1) {
+ return __v_3[i1] * __v_3[0];
+}
+function __f_3(i1) {
+ __f_4(i1);
+ __f_4(i1 + 16);
+ __f_4(i1 + 32);
+ %OptimizeFunctionOnNextCall(__f_4);
+ var x = __f_4(i1 + 993);
+ return x;
+}
+function __f_5() {
+ __v_3[0] = +__v_3[0];
+ gc();
+ __f_3(0) | 0;
+ __v_3 = /\u23a1|x/;
+ return 0;
+}
+var __v_3 = new Float32Array(1000);
+__f_5();
+__f_5();
+__f_5();
diff --git a/test/mjsunit/regress/regress-353004.js b/test/mjsunit/regress/regress-353004.js
new file mode 100644
index 0000000..658fd6d
--- /dev/null
+++ b/test/mjsunit/regress/regress-353004.js
@@ -0,0 +1,74 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var buffer1 = new ArrayBuffer(100 * 1024);
+
+var array1 = new Uint8Array(buffer1, {valueOf : function() {
+ %ArrayBufferNeuter(buffer1);
+ return 0;
+}});
+
+assertEquals(0, array1.length);
+
+var buffer2 = new ArrayBuffer(100 * 1024);
+
+assertThrows(function() {
+ var array2 = new Uint8Array(buffer2, 0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer2);
+ return 100 * 1024;
+ }});
+}, RangeError);
+
+
+var buffer3 = new ArrayBuffer(100 * 1024 * 1024);
+var dataView1 = new DataView(buffer3, {valueOf : function() {
+ %ArrayBufferNeuter(buffer3);
+ return 0;
+}});
+
+assertEquals(0, dataView1.byteLength);
+
+var buffer4 = new ArrayBuffer(100 * 1024);
+assertThrows(function() {
+ var dataView2 = new DataView(buffer4, 0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer4);
+ return 100 * 1024 * 1024;
+ }});
+}, RangeError);
+
+
+var buffer5 = new ArrayBuffer(100 * 1024);
+var buffer6 = buffer5.slice({valueOf : function() {
+ %ArrayBufferNeuter(buffer5);
+ return 0;
+}}, 100 * 1024 * 1024);
+assertEquals(0, buffer6.byteLength);
+
+
+var buffer7 = new ArrayBuffer(100 * 1024 * 1024);
+var buffer8 = buffer7.slice(0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer7);
+ return 100 * 1024 * 1024;
+}});
+assertEquals(0, buffer8.byteLength);
+
+var buffer9 = new ArrayBuffer(1024);
+var array9 = new Uint8Array(buffer9);
+var array10 = array9.subarray({valueOf : function() {
+ %ArrayBufferNeuter(buffer9);
+ return 0;
+ }}, 1024);
+assertEquals(0, array9.length);
+assertEquals(0, array10.length);
+
+var buffer11 = new ArrayBuffer(1024);
+var array11 = new Uint8Array(buffer11);
+var array12 = array11.subarray(0, {valueOf : function() {
+ %ArrayBufferNeuter(buffer11);
+ return 1024;
+ }});
+assertEquals(0, array11.length);
+assertEquals(0, array12.length);
diff --git a/test/mjsunit/regress/regress-353058.js b/test/mjsunit/regress/regress-353058.js
new file mode 100644
index 0000000..0fef246
--- /dev/null
+++ b/test/mjsunit/regress/regress-353058.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=150
+// Requries ASAN.
+
+function runNearStackLimit(f) { function t() { try { t(); } catch(e) { f(); } }; try { t(); } catch(e) {} }
+function __f_0(
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x
+) { }
+runNearStackLimit(__f_0);
diff --git a/test/mjsunit/regress/regress-353551.js b/test/mjsunit/regress/regress-353551.js
new file mode 100644
index 0000000..c6e7856
--- /dev/null
+++ b/test/mjsunit/regress/regress-353551.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var depth = 0;
+function __f_3(x) {
+ var __v_1 = arguments;
+ __v_1[1000] = 123;
+ depth++;
+ if (depth > 3000) return;
+ function __f_4() {
+ ++__v_1[0];
+ __f_3(0.5);
+ };
+ __f_4();
+}
+__f_3(0.5);
diff --git a/test/mjsunit/regress/regress-354357.js b/test/mjsunit/regress/regress-354357.js
new file mode 100644
index 0000000..84b7ebd
--- /dev/null
+++ b/test/mjsunit/regress/regress-354357.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --always-opt
+
+var v = {};
+function inlined() {
+ return !(v.bar++);
+}
+function outer() {
+ inlined();
+};
+
+outer();
diff --git a/test/mjsunit/regress/regress-354433.js b/test/mjsunit/regress/regress-354433.js
new file mode 100644
index 0000000..80ea286
--- /dev/null
+++ b/test/mjsunit/regress/regress-354433.js
@@ -0,0 +1,54 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var __v_0 = {};
+var __v_5 = {};
+function __f_2() {
+ this.__defineGetter__('str', function() { return __f_2(this); });
+ this.str = "1";
+ this.toString = function() {
+ return this.str;
+ };
+};
+
+__v_5 = new __f_2();
+__v_0 = new __f_2();
+
+function __f_5(fun,a,b) {
+ __v_5.str = a;
+ __v_0.str = b;
+ fun(__v_5, __v_0);
+}
+
+function __f_8(a,b) { return a%b };
+
+__f_5(__f_8, 1 << 30, 1);
+__f_5(__f_8, 1, 1 << 30);
+%OptimizeFunctionOnNextCall(__f_8);
+__f_5(__f_8, 1, 1 << 30);
diff --git a/test/mjsunit/regress/regress-355485.js b/test/mjsunit/regress/regress-355485.js
new file mode 100644
index 0000000..3c66884
--- /dev/null
+++ b/test/mjsunit/regress/regress-355485.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+assertEquals("\u039c", "\u00b5".toUpperCase());
diff --git a/test/mjsunit/regress/regress-355486.js b/test/mjsunit/regress/regress-355486.js
new file mode 100644
index 0000000..55362a1
--- /dev/null
+++ b/test/mjsunit/regress/regress-355486.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { var v = arguments[0]; }
+function g() { f(); }
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/test/mjsunit/regress/regress-355523.js b/test/mjsunit/regress/regress-355523.js
new file mode 100644
index 0000000..d61fe84
--- /dev/null
+++ b/test/mjsunit/regress/regress-355523.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+// This test requires ASAN.
+
+function __f_4(a, b) { }
+function __f_8(n) { return __f_4(arguments[13], arguments[-10]); }
+function __f_6(a) { return __f_8(0, a); }
+__f_8(0);
+__f_8(0);
+%OptimizeFunctionOnNextCall(__f_8);
+__f_8(0);
diff --git a/test/mjsunit/regress/regress-356053.js b/test/mjsunit/regress/regress-356053.js
new file mode 100644
index 0000000..8f0dbdd
--- /dev/null
+++ b/test/mjsunit/regress/regress-356053.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --noconcurrent-recompilation --expose-gc --allow-natives-syntax
+
+%SetFlags("--concurrent-recompilation --block-concurrent-recompilation");
+gc();
+try { %UnblockConcurrentRecompilation(); } catch (e) { }
diff --git a/test/mjsunit/regress/regress-3564.js b/test/mjsunit/regress/regress-3564.js
new file mode 100644
index 0000000..a0b9eb2
--- /dev/null
+++ b/test/mjsunit/regress/regress-3564.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function MyWrapper(v) {
+ return { valueOf: function() { return v } };
+}
+
+function f() {
+ assertTrue("a" < "x");
+ assertTrue("a" < new String("y"));
+ assertTrue("a" < new MyWrapper("z"));
+
+ assertFalse("a" > "x");
+ assertFalse("a" > new String("y"));
+ assertFalse("a" > new MyWrapper("z"));
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-356589.js b/test/mjsunit/regress/regress-356589.js
new file mode 100644
index 0000000..f93c545
--- /dev/null
+++ b/test/mjsunit/regress/regress-356589.js
@@ -0,0 +1,34 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This test passes if it does not crash in debug mode
+
+arr = ['a', 'b', 'c', 'd'];
+Object.defineProperty(arr.__proto__, '0', { get: function(){} });
+Object.defineProperty(arr, '2', {get: function(){} });
+Object.observe(arr, function() {});
+arr.length = 2;
diff --git a/test/mjsunit/regress/regress-357054.js b/test/mjsunit/regress/regress-357054.js
new file mode 100644
index 0000000..92a066e
--- /dev/null
+++ b/test/mjsunit/regress/regress-357054.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+[].__defineSetter__(0, function() { });
+function f(a,i,v) { a[i] = v; }
+a = [0,0,0];
+f(a,0,5);
+a = new Float32Array(5);
+f(a,2,5.5);
diff --git a/test/mjsunit/regress/regress-357103.js b/test/mjsunit/regress/regress-357103.js
new file mode 100644
index 0000000..692729d
--- /dev/null
+++ b/test/mjsunit/regress/regress-357103.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%SetFlags("--gc-interval=1");
+
+var key = "Huckleberry Finn" + "Tom Sawyer";
+var o = {};
+function f() { o[key] = "Adventures"; }
+
+f();
+f();
diff --git a/test/mjsunit/regress/regress-357105.js b/test/mjsunit/regress/regress-357105.js
new file mode 100644
index 0000000..d3eefd0
--- /dev/null
+++ b/test/mjsunit/regress/regress-357105.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var global = { };
+
+function do_nothing() { }
+
+function f(opt_gc) {
+ var x = new Array(3);
+ x[0] = 10;
+ opt_gc();
+ global[1] = 15.5;
+ return x;
+}
+
+gc();
+global = f(gc);
+global = f(do_nothing);
+%OptimizeFunctionOnNextCall(f);
+global = f(do_nothing);
diff --git a/test/mjsunit/regress/regress-357108.js b/test/mjsunit/regress/regress-357108.js
new file mode 100644
index 0000000..b20975b
--- /dev/null
+++ b/test/mjsunit/regress/regress-357108.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --typed-array-max-size-in-heap=64
+
+function TestArray(constructor) {
+ function Check(a) {
+ a[0] = "";
+ assertEquals(0, a[0]);
+ a[0] = {};
+ assertEquals(0, a[0]);
+ a[0] = { valueOf : function() { return 27; } };
+ assertEquals(27, a[0]);
+ }
+ Check(new constructor(1));
+ Check(new constructor(100));
+}
+
+TestArray(Uint8Array);
diff --git a/test/mjsunit/regress/regress-358057.js b/test/mjsunit/regress/regress-358057.js
new file mode 100644
index 0000000..c5fe73a
--- /dev/null
+++ b/test/mjsunit/regress/regress-358057.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+__v_0 = new Uint8ClampedArray(10);
+for (var i = 0; i < 10; i++) {
+ __v_0[i] = 0xAA;
+}
+function __f_12(__v_6) {
+ if (__v_6 < 0) {
+ __v_1 = __v_0[__v_6 + 10];
+ return __v_1;
+ }
+}
+
+assertEquals(0xAA, __f_12(-1));
+%OptimizeFunctionOnNextCall(__f_12);
+assertEquals(0xAA, __f_12(-1));
diff --git a/test/mjsunit/regress/regress-358059.js b/test/mjsunit/regress/regress-358059.js
new file mode 100644
index 0000000..30738f9
--- /dev/null
+++ b/test/mjsunit/regress/regress-358059.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b) { return b + (a.x++); }
+var o = {};
+o.__defineGetter__('x', function() { return 1; });
+assertEquals(4, f(o, 3));
+assertEquals(4, f(o, 3));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(4, f(o, 3));
diff --git a/test/mjsunit/regress/regress-358088.js b/test/mjsunit/regress/regress-358088.js
new file mode 100644
index 0000000..222bba6
--- /dev/null
+++ b/test/mjsunit/regress/regress-358088.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+ a[a.length] = 1;
+}
+
+function g(a, i, v) {
+ a[i] = v;
+}
+
+f([]); // f KeyedStoreIC goes to 1.GROW
+o = {};
+g(o); // We've added property "undefined" to o
+
+o = {}; // A transition on property "undefined" exists from {}
+f(o); // Store should go generic.
diff --git a/test/mjsunit/regress/regress-358090.js b/test/mjsunit/regress/regress-358090.js
new file mode 100644
index 0000000..d9c07e8
--- /dev/null
+++ b/test/mjsunit/regress/regress-358090.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var x = Array(100000);
+y = Array.apply(Array, x);
+y.unshift(4);
+y.shift();
diff --git a/test/mjsunit/regress/regress-359441.js b/test/mjsunit/regress/regress-359441.js
new file mode 100644
index 0000000..d96468c
--- /dev/null
+++ b/test/mjsunit/regress/regress-359441.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+ this.x = {};
+}
+
+function f() {
+ new g();
+}
+
+function deopt(x) {
+ %DeoptimizeFunction(f);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+Object.prototype.__defineSetter__('x', deopt);
+f();
diff --git a/test/mjsunit/regress/regress-359491.js b/test/mjsunit/regress/regress-359491.js
new file mode 100644
index 0000000..d72875a
--- /dev/null
+++ b/test/mjsunit/regress/regress-359491.js
@@ -0,0 +1,61 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+(function () {
+ function f(a, b, mode) {
+ if (mode) {
+ return a === b;
+ } else {
+ return a === b;
+ }
+ }
+
+ // Gather type feedback for both branches.
+ f("a", "b", 1);
+ f("c", "d", 1);
+ f("a", "b", 0);
+ f("c", "d", 0);
+
+ function g(mode) {
+ var x = 1e10 | 0;
+ f(x, x, mode);
+ }
+
+ // Gather type feedback for g, but only on one branch for f.
+ g(1);
+ g(1);
+ %OptimizeFunctionOnNextCall(g);
+ // Optimize g, which inlines f. Both branches in f will see the constant.
+ g(0);
+})();
+
+(function () {
+ function f(a, b, mode) {
+ if (mode) {
+ return a === b;
+ } else {
+ return a === b;
+ }
+ }
+
+ // Gather type feedback for both branches.
+ f({ a : 1}, {b : 1}, 1);
+ f({ c : 1}, {d : 1}, 1);
+ f({ a : 1}, {c : 1}, 0);
+ f({ b : 1}, {d : 1}, 0);
+
+ function g(mode) {
+ var x = 1e10 | 0;
+ f(x, x, mode);
+ }
+
+ // Gather type feedback for g, but only on one branch for f.
+ g(1);
+ g(1);
+ %OptimizeFunctionOnNextCall(g);
+ // Optimize g, which inlines f. Both branches in f will see the constant.
+ g(0);
+})();
diff --git a/test/mjsunit/regress/regress-359525.js b/test/mjsunit/regress/regress-359525.js
new file mode 100644
index 0000000..6a82a38
--- /dev/null
+++ b/test/mjsunit/regress/regress-359525.js
@@ -0,0 +1,44 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test BinaryOpICStub substract
+var a;
+for (var i = 0; i < 2; i++) {
+ var x = 42 + a - {};
+ print(x);
+ a = "";
+}
+
+// Test BinaryOpICStub add
+var b = 1.4;
+var val = 0;
+var o = {valueOf:function() { val++; return 10; }};
+for (var i = 0; i < 2; i++) {
+ var x = (b + i) + o;
+ b = "";
+}
+assertEquals(val, 2);
diff --git a/test/mjsunit/regress/regress-360733.js b/test/mjsunit/regress/regress-360733.js
new file mode 100644
index 0000000..28f73ea
--- /dev/null
+++ b/test/mjsunit/regress/regress-360733.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack_size=150
+
+function f(a) {
+ f(a + 1);
+}
+
+Error.__defineGetter__('stackTraceLimit', function() { });
+try {
+ f(0);
+} catch (e) { }
diff --git a/test/mjsunit/regress/regress-361025.js b/test/mjsunit/regress/regress-361025.js
new file mode 100644
index 0000000..74f50d8
--- /dev/null
+++ b/test/mjsunit/regress/regress-361025.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+var x = new Object();
+x.__defineGetter__('a', function() { return 7 });
+JSON.parse('{"a":2600753951}');
+gc();
diff --git a/test/mjsunit/regress/regress-361608.js b/test/mjsunit/regress/regress-361608.js
new file mode 100644
index 0000000..b3cc90c
--- /dev/null
+++ b/test/mjsunit/regress/regress-361608.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {};
+int_array = [1];
+
+function foo() {
+ var x;
+ for (var i = -1; i < 0; i++) {
+ x = int_array[i + 1];
+ f(function() { x = i; });
+ }
+}
+
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/regress/regress-362128.js b/test/mjsunit/regress/regress-362128.js
new file mode 100644
index 0000000..18ac5db
--- /dev/null
+++ b/test/mjsunit/regress/regress-362128.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax
+
+function genM() {
+ "use strict";
+ return function () {
+ return this.field;
+ };
+}
+
+function genR() {
+ var x = {
+ field: 10
+ }
+ return x;
+}
+
+method = {};
+receiver = {};
+
+method = genM("A");
+receiver = genR("A");
+
+var foo = (function () {
+ return function suspect (name) {
+ "use strict";
+ return method.apply(receiver, arguments);
+ }
+})();
+
+foo("a", "b", "c");
+foo("a", "b", "c");
+foo("a", "b", "c");
+%OptimizeFunctionOnNextCall(foo);
+foo("a", "b", "c");
diff --git a/test/mjsunit/regress/regress-362870.js b/test/mjsunit/regress/regress-362870.js
new file mode 100644
index 0000000..c8d3fe7
--- /dev/null
+++ b/test/mjsunit/regress/regress-362870.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Adding a property via Object.defineProperty should not be taken as hint that
+// we construct a dictionary, quite the opposite.
+var obj = {};
+
+for (var i = 0; i < 100; i++) {
+ Object.defineProperty(obj, "x" + i, { value: 31415 });
+ Object.defineProperty(obj, "y" + i, {
+ get: function() { return 42; },
+ set: function(value) { }
+ });
+ assertTrue(%HasFastProperties(obj));
+}
diff --git a/test/mjsunit/regress/regress-363956.js b/test/mjsunit/regress/regress-363956.js
new file mode 100644
index 0000000..76d6728
--- /dev/null
+++ b/test/mjsunit/regress/regress-363956.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function Fuu() { this.x = this.x.x; }
+Fuu.prototype.x = {x: 1}
+new Fuu();
+new Fuu();
+%OptimizeFunctionOnNextCall(Fuu);
+new Fuu();
diff --git a/test/mjsunit/regress/regress-365172-1.js b/test/mjsunit/regress/regress-365172-1.js
new file mode 100644
index 0000000..ea68285
--- /dev/null
+++ b/test/mjsunit/regress/regress-365172-1.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --track-field-types
+
+var b1 = {d: 1}; var b2 = {d: 2};
+var f1 = {x: 1}; var f2 = {x: 2};
+f1.b = b1;
+f2.x = {};
+b2.d = 4.2;
+f2.b = b2;
+var x = f1.x;
diff --git a/test/mjsunit/regress/regress-365172-2.js b/test/mjsunit/regress/regress-365172-2.js
new file mode 100644
index 0000000..265901c
--- /dev/null
+++ b/test/mjsunit/regress/regress-365172-2.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types
+
+var b1 = {d: 1}; var b2 = {d: 2};
+var f1 = {x: 1}; var f2 = {x: 2};
+f1.b = b1;
+f2.x = {};
+b2.d = 4.2;
+f2.b = b2;
+%TryMigrateInstance(f1);
diff --git a/test/mjsunit/regress/regress-365172-3.js b/test/mjsunit/regress/regress-365172-3.js
new file mode 100644
index 0000000..103d3d0
--- /dev/null
+++ b/test/mjsunit/regress/regress-365172-3.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc --track-field-types
+
+function f1(a) { return {x:a, v:''}; }
+function f2(a) { return {x:{v:a}, v:''}; }
+function f3(a) { return {x:[], v:{v:''}}; }
+f3([0]);
+a = f1(1);
+a.__defineGetter__('v', function() { gc(); return f2(this); });
+a.v;
+f3(1);
diff --git a/test/mjsunit/regress/regress-368243.js b/test/mjsunit/regress/regress-368243.js
new file mode 100644
index 0000000..6647d12
--- /dev/null
+++ b/test/mjsunit/regress/regress-368243.js
@@ -0,0 +1,25 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a, c){
+ for(var f in c) {
+ if ("object" === typeof c[f]) {
+ a[f] = c[f];
+ foo(a[f], c[f]);
+ }
+ }
+};
+
+c = {
+ "one" : { x : 1},
+ "two" : { x : 2},
+ "thr" : { x : 3, z : 4},
+};
+
+foo({}, c);
+foo({}, c);
+%OptimizeFunctionOnNextCall(foo);
+foo({}, c);
diff --git a/test/mjsunit/regress/regress-369450.js b/test/mjsunit/regress/regress-369450.js
new file mode 100644
index 0000000..e452361
--- /dev/null
+++ b/test/mjsunit/regress/regress-369450.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+var v = [1.3];
+v.length = 0;
+
+var json = JSON.stringify(v);
+assertEquals("[]", json);
+
+Array.prototype[0] = 5.5;
+var arr = [].concat(v, [{}], [2.3]);
+assertEquals([{}, 2.3], arr);
diff --git a/test/mjsunit/regress/regress-370384.js b/test/mjsunit/regress/regress-370384.js
new file mode 100644
index 0000000..28aea69
--- /dev/null
+++ b/test/mjsunit/regress/regress-370384.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --deopt-every-n-times=1 --no-enable_sse4_1
+
+function g(f, x, name) {
+ var v2 = f(x);
+ for (var i = 0; i < 13000; i++) {
+ f(i);
+ }
+ var v1 = f(x);
+ assertEquals(v1, v2);
+}
+
+g(Math.sin, 6.283185307179586, "Math.sin");
diff --git a/test/mjsunit/regress/regress-370827.js b/test/mjsunit/regress/regress-370827.js
new file mode 100644
index 0000000..5536d51
--- /dev/null
+++ b/test/mjsunit/regress/regress-370827.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --heap-stats
+
+function g(dummy, x) {
+ var start = "";
+ if (x) { start = x + " - "; }
+ start = start + "array length";
+};
+
+function f() {
+ gc();
+ g([0.1]);
+}
+
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+f();
diff --git a/test/mjsunit/regress/regress-373283.js b/test/mjsunit/regress/regress-373283.js
new file mode 100644
index 0000000..20cee4d
--- /dev/null
+++ b/test/mjsunit/regress/regress-373283.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --deopt-every-n-times=1
+
+function __f_0() {
+ var x = [];
+ x[21] = 1;
+ x[21] + 0;
+}
+
+for (var i = 0; i < 3; i++) __f_0();
+%OptimizeFunctionOnNextCall(__f_0);
+for (var i = 0; i < 10; i++) __f_0();
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0();
+%GetScript("foo");
diff --git a/test/mjsunit/regress/regress-377290.js b/test/mjsunit/regress/regress-377290.js
new file mode 100644
index 0000000..23e31e7
--- /dev/null
+++ b/test/mjsunit/regress/regress-377290.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-gc
+
+Object.prototype.__defineGetter__('constructor', function() { throw 42; });
+__v_7 = [
+ function() { [].push() },
+];
+for (var __v_6 = 0; __v_6 < 5; ++__v_6) {
+ for (var __v_8 in __v_7) {
+ print(__v_8, " -> ", __v_7[__v_8]);
+ gc();
+ try { __v_7[__v_8](); } catch (e) {};
+ }
+}
diff --git a/test/mjsunit/regress/regress-379770.js b/test/mjsunit/regress/regress-379770.js
new file mode 100644
index 0000000..a6653c2
--- /dev/null
+++ b/test/mjsunit/regress/regress-379770.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+// Flags: --allow-natives-syntax --nostress-opt
+// Flags: --nouse-osr
+
+function foo(obj) {
+ var counter = 1;
+ for (var i = 0; i < obj.length; i++) {
+ %OptimizeFunctionOnNextCall(foo, "osr");
+ }
+ counter += obj;
+ return counter;
+}
+
+function bar() {
+ var a = [1, 2, 3, 4, 5, 6, 7, 8, 9, 10, 11, 12];
+ for (var i = 0; i < 100; i++ ) {
+ foo(a);
+ }
+}
+
+try {
+ bar();
+} catch (e) {
+}
diff --git a/test/mjsunit/regress/regress-380049.js b/test/mjsunit/regress/regress-380049.js
new file mode 100644
index 0000000..a78626c
--- /dev/null
+++ b/test/mjsunit/regress/regress-380049.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(a,b,c) { return arguments; }
+var f = foo(false, null, 40);
+assertThrows(function() { %ObjectFreeze(f); });
diff --git a/test/mjsunit/regress/regress-380092.js b/test/mjsunit/regress/regress-380092.js
new file mode 100644
index 0000000..fe6b0b7
--- /dev/null
+++ b/test/mjsunit/regress/regress-380092.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function many_hoist(o, index) {
+ return o[index + 33554427];
+}
+
+var obj = {};
+many_hoist(obj, 0);
+%OptimizeFunctionOnNextCall(many_hoist);
+many_hoist(obj, 5);
+
+function constant_too_large(o, index) {
+ return o[index + 1033554433];
+}
+
+constant_too_large(obj, 0);
+%OptimizeFunctionOnNextCall(constant_too_large);
+constant_too_large(obj, 5);
diff --git a/test/mjsunit/regress/regress-381313.js b/test/mjsunit/regress/regress-381313.js
new file mode 100644
index 0000000..d2b9d7c
--- /dev/null
+++ b/test/mjsunit/regress/regress-381313.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var g = 0;
+
+function f(x, deopt) {
+ var a0 = x;
+ var a1 = 2 * x;
+ var a2 = 3 * x;
+ var a3 = 4 * x;
+ var a4 = 5 * x;
+ var a5 = 6 * x;
+ var a6 = 7 * x;
+ var a7 = 8 * x;
+ var a8 = 9 * x;
+ var a9 = 10 * x;
+ var a10 = 11 * x;
+ var a11 = 12 * x;
+ var a12 = 13 * x;
+ var a13 = 14 * x;
+ var a14 = 15 * x;
+ var a15 = 16 * x;
+ var a16 = 17 * x;
+ var a17 = 18 * x;
+ var a18 = 19 * x;
+ var a19 = 20 * x;
+
+ g = 1;
+
+ deopt + 0;
+
+ return a0 + a1 + a2 + a3 + a4 + a5 + a6 + a7 + a8 + a9 +
+ a10 + a11 + a12 + a13 + a14 + a15 + a16 + a17 + a18 + a19;
+}
+
+f(0.5, 0);
+f(0.5, 0);
+%OptimizeFunctionOnNextCall(f);
+print(f(0.5, ""));
diff --git a/test/mjsunit/regress/regress-385054.js b/test/mjsunit/regress/regress-385054.js
new file mode 100644
index 0000000..115bca0
--- /dev/null
+++ b/test/mjsunit/regress/regress-385054.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ var a = [1, 2];
+ a[x];
+ return a[0 - x];
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(1));
diff --git a/test/mjsunit/regress/regress-386034.js b/test/mjsunit/regress/regress-386034.js
new file mode 100644
index 0000000..d770ce9
--- /dev/null
+++ b/test/mjsunit/regress/regress-386034.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ var v = x;
+ for (i = 0; i < 1; i++) {
+ v.apply(this, arguments);
+ }
+}
+
+function g() {}
+
+f(g);
+f(g);
+%OptimizeFunctionOnNextCall(f);
+assertThrows(function() { f('----'); }, TypeError);
diff --git a/test/mjsunit/regress/regress-392114.js b/test/mjsunit/regress/regress-392114.js
new file mode 100644
index 0000000..e5cf1cd
--- /dev/null
+++ b/test/mjsunit/regress/regress-392114.js
@@ -0,0 +1,66 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+
+Debug = debug.Debug;
+
+function dummy(x) {
+ return x + 100;
+}
+
+function create_closure() {
+ var f = function(arg) {
+ if (arg) { %DeoptimizeFunction(f); }
+ var a = Array(10);
+ for (var i = 0; i < a.length; i++) {
+ a[i] = i;
+ }
+ }
+ return f;
+}
+
+var c = create_closure();
+c();
+
+// c CallIC state now has custom Array handler installed.
+
+// Turn on the debugger.
+Debug.setListener(function () {});
+
+var d = create_closure();
+%OptimizeFunctionOnNextCall(d);
+// Thanks to the debugger, we recreate the full code too. We deopt and run
+// it, stomping on the unexpected AllocationSite in the type vector slot.
+d(true);
+
+// CallIC in c misinterprets type vector slot contents as an AllocationSite,
+// corrupting the heap.
+c();
+
+// CallIC MISS - crash due to corruption.
+dummy();
diff --git a/test/mjsunit/regress/regress-403292.js b/test/mjsunit/regress/regress-403292.js
new file mode 100644
index 0000000..4e7ba28
--- /dev/null
+++ b/test/mjsunit/regress/regress-403292.js
@@ -0,0 +1,53 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-natives-as=builtins --expose-gc
+
+var __v_7 = [];
+var __v_8 = {};
+var __v_10 = {};
+var __v_11 = this;
+var __v_12 = {};
+var __v_13 = {};
+var __v_14 = "";
+var __v_15 = {};
+try {
+__v_1 = {x:0};
+%OptimizeFunctionOnNextCall(__f_1);
+assertEquals("good", __f_1());
+delete __v_1.x;
+assertEquals("good", __f_1());
+} catch(e) { print("Caught: " + e); }
+try {
+__v_3 = new Set();
+__v_5 = new builtins.SetIterator(__v_3, -12);
+__v_4 = new Map();
+__v_6 = new builtins.MapIterator(__v_4, 2);
+__f_3(Array);
+} catch(e) { print("Caught: " + e); }
+function __f_4(__v_8, filter) {
+ function __f_6(v) {
+ for (var __v_4 in v) {
+ for (var __v_4 in v) {}
+ }
+ %OptimizeFunctionOnNextCall(filter);
+ return filter(v);
+ }
+ var __v_7 = eval(__v_8);
+ gc();
+ return __f_6(__v_7);
+}
+function __f_5(__v_6) {
+ var __v_5 = new Array(__v_6);
+ for (var __v_4 = 0; __v_4 < __v_6; __v_4++) __v_5.push('{}');
+ return __v_5;
+}
+try {
+try {
+ __v_8.test("\x80");
+ assertUnreachable();
+} catch (e) {
+}
+gc();
+} catch(e) { print("Caught: " + e); }
diff --git a/test/mjsunit/regress/regress-404981.js b/test/mjsunit/regress/regress-404981.js
new file mode 100644
index 0000000..5508d6f
--- /dev/null
+++ b/test/mjsunit/regress/regress-404981.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var large_object = new Array(5000001);
+large_object.length = 23;
diff --git a/test/mjsunit/regress/regress-408036.js b/test/mjsunit/regress/regress-408036.js
new file mode 100644
index 0000000..a4dfade
--- /dev/null
+++ b/test/mjsunit/regress/regress-408036.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-natives-as 1
diff --git a/test/mjsunit/regress/regress-409533.js b/test/mjsunit/regress/regress-409533.js
new file mode 100644
index 0000000..e51065e
--- /dev/null
+++ b/test/mjsunit/regress/regress-409533.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ %_RegExpConstructResult(0, {}, {});
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-410912.js b/test/mjsunit/regress/regress-410912.js
new file mode 100644
index 0000000..98367bd
--- /dev/null
+++ b/test/mjsunit/regress/regress-410912.js
@@ -0,0 +1,206 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var assertDoesNotThrow;
+var assertInstanceof;
+var assertUnreachable;
+var assertOptimized;
+var assertUnoptimized;
+function classOf(object) { var string = Object.prototype.toString.call(object); return string.substring(8, string.length - 1); }
+function PrettyPrint(value) { return ""; }
+function PrettyPrintArrayElement(value, index, array) { return ""; }
+function fail(expectedText, found, name_opt) { }
+function deepObjectEquals(a, b) { var aProps = Object.keys(a); aProps.sort(); var bProps = Object.keys(b); bProps.sort(); if (!deepEquals(aProps, bProps)) { return false; } for (var i = 0; i < aProps.length; i++) { if (!deepEquals(a[aProps[i]], b[aProps[i]])) { return false; } } return true; }
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); };
+assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertPropertiesEqual = function assertPropertiesEqual(expected, found, name_opt) { if (!deepObjectEquals(expected, found)) { fail(expected, found, name_opt); } };
+assertToStringEquals = function assertToStringEquals(expected, found, name_opt) { if (expected != String(found)) { fail(expected, found, name_opt); } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+assertNull = function assertNull(value, name_opt) { if (value !== null) { fail("null", value, name_opt); } };
+assertNotNull = function assertNotNull(value, name_opt) { if (value === null) { fail("not null", value, name_opt); } };
+var __v_39 = {};
+var __v_40 = {};
+var __v_41 = {};
+var __v_42 = {};
+var __v_43 = {};
+var __v_44 = {};
+try {
+__v_0 = [1.5,,1.7];
+__v_1 = {__v_0:1.8};
+} catch(e) { print("Caught: " + e); }
+function __f_0(__v_1,__v_0,i) {
+ __v_1.a = __v_0[i];
+ gc();
+}
+try {
+__f_0(__v_1,__v_0,0);
+__f_0(__v_1,__v_0,0);
+%OptimizeFunctionOnNextCall(__f_0);
+__f_0(__v_1,__v_0,1);
+assertEquals(undefined, __v_1.a);
+__v_0 = [1,,3];
+__v_1 = {ab:5};
+} catch(e) { print("Caught: " + e); }
+function __f_1(__v_1,__v_0,i) {
+ __v_1.ab = __v_0[i];
+}
+try {
+__f_1(__v_1,__v_0,1);
+} catch(e) { print("Caught: " + e); }
+function __f_5(x) {
+ return ~x;
+}
+try {
+__f_5(42);
+assertEquals(~12, __f_5(12.45));
+assertEquals(~46, __f_5(42.87));
+__v_2 = 1, __v_4 = 2, __v_3 = 4, __v_6 = 8;
+} catch(e) { print("Caught: " + e); }
+function __f_4() {
+ return __v_2 | (__v_4 | (__v_3 | __v_6));
+}
+try {
+__f_4();
+__v_3 = "16";
+assertEquals(17 | -13 | 0 | -5, __f_4());
+} catch(e) { print("Caught: " + e); }
+function __f_6() {
+ return __f_4();
+}
+try {
+assertEquals(1 | 2 | 16 | 8, __f_6());
+__f_4 = function() { return 42; };
+assertEquals(42, __f_6());
+__v_5 = {};
+__v_5.__f_4 = __f_4;
+} catch(e) { print("Caught: " + e); }
+function __f_7(o) {
+ return o.__f_4();
+}
+try {
+for (var __v_7 = 0; __v_7 < 5; __v_7++) __f_7(__v_5);
+%OptimizeFunctionOnNextCall(__f_7);
+__f_7(__v_5);
+assertEquals(42, __f_7(__v_5));
+assertEquals(87, __f_7({__f_4: function() { return 87; }}));
+} catch(e) { print("Caught: " + e); }
+function __f_8(x,y) {
+ x = 42;
+ y = 1;
+ y = y << "0";
+ return x | y;
+}
+try {
+assertEquals(43, __f_8(0,0));
+} catch(e) { print("Caught: " + e); }
+function __f_2(x) {
+ return 'lit[' + (x + ']');
+}
+try {
+assertEquals('lit[-87]', __f_2(-87));
+assertEquals('lit[0]', __f_2(0));
+assertEquals('lit[42]', __f_2(42));
+__v_9 = "abc";
+gc();
+var __v_8;
+} catch(e) { print("Caught: " + e); }
+function __f_9(n) { return __v_9.charAt(n); }
+try {
+for (var __v_7 = 0; __v_7 < 5; __v_7++) {
+ __v_8 = __f_9(0);
+}
+%OptimizeFunctionOnNextCall(__f_9);
+__v_8 = __f_9(0);
+} catch(e) { print("Caught: " + e); }
+function __f_3(__v_2,__v_4,__v_3,__v_6) {
+ return __v_2+__v_4+__v_3+__v_6;
+}
+try {
+assertEquals(0x40000003, __f_3(1,1,2,0x3fffffff));
+} catch(e) { print("Caught: " + e); }
+try {
+__v_19 = {
+ fast_smi_only : 'fast smi only elements',
+ fast : 'fast elements',
+ fast_double : 'fast double elements',
+ dictionary : 'dictionary elements',
+ external_int32 : 'external int8 elements',
+ external_uint8 : 'external uint8 elements',
+ external_int16 : 'external int16 elements',
+ external_uint16 : 'external uint16 elements',
+ external_int32 : 'external int32 elements',
+ external_uint32 : 'external uint32 elements',
+ external_float32 : 'external float32 elements',
+ external_float64 : 'external float64 elements',
+ external_uint8_clamped : 'external uint8_clamped elements',
+ fixed_int32 : 'fixed int8 elements',
+ fixed_uint8 : 'fixed uint8 elements',
+ fixed_int16 : 'fixed int16 elements',
+ fixed_uint16 : 'fixed uint16 elements',
+ fixed_int32 : 'fixed int32 elements',
+ fixed_uint32 : 'fixed uint32 elements',
+ fixed_float32 : 'fixed float32 elements',
+ fixed_float64 : 'fixed float64 elements',
+ fixed_uint8_clamped : 'fixed uint8_clamped elements'
+}
+} catch(e) { print("Caught: " + e); }
+function __f_12() {
+}
+__v_10 = {};
+__v_10.dance = 0xD15C0;
+__v_10.drink = 0xC0C0A;
+__f_12(__v_19.fast, __v_10);
+__v_24 = [1,2,3];
+__f_12(__v_19.fast_smi_only, __v_24);
+__v_24.dance = 0xD15C0;
+__v_24.drink = 0xC0C0A;
+__f_12(__v_19.fast_smi_only, __v_24);
+function __f_18() {
+ var __v_27 = new Array();
+ __f_12(__v_19.fast_smi_only, __v_27);
+ for (var __v_18 = 0; __v_18 < 1337; __v_18++) {
+ var __v_16 = __v_18;
+ if (__v_18 == 1336) {
+ __f_12(__v_19.fast_smi_only, __v_27);
+ __v_16 = new Object();
+ }
+ __v_27[__v_18] = __v_16;
+ }
+ __f_12(__v_19.fast, __v_27);
+ var __v_15 = [];
+ __v_15[912570] = 7;
+ __f_12(__v_19.dictionary, __v_15);
+ var __v_26 = new Array(912561);
+ %SetAllocationTimeout(100000000, 10000000);
+ for (var __v_18 = 0; __v_18 < 0x20000; __v_18++) {
+ __v_26[0] = __v_18 / 2;
+ }
+ __f_12(__v_19.fixed_int8, new Int8Array(007));
+ __f_12(__v_19.fixed_uint8, new Uint8Array(007));
+ __f_12(__v_19.fixed_int16, new Int16Array(666));
+ __f_12(__v_19.fixed_uint16, new Uint16Array(42));
+ __f_12(__v_19.fixed_int32, new Int32Array(0xF));
+ __f_12(__v_19.fixed_uint32, new Uint32Array(23));
+ __f_12(__v_19.fixed_float32, new Float32Array(7));
+ __f_12(__v_19.fixed_float64, new Float64Array(0));
+ __f_12(__v_19.fixed_uint8_clamped, new Uint8ClampedArray(512));
+ var __v_13 = new ArrayBuffer(128);
+ __f_12(__v_19.external_int8, new Int8Array(__v_13));
+ __f_12(__v_37.external_uint8, new Uint8Array(__v_13));
+ __f_12(__v_19.external_int16, new Int16Array(__v_13));
+ __f_12(__v_19.external_uint16, new Uint16Array(__v_13));
+ __f_12(__v_19.external_int32, new Int32Array(__v_13));
+ __f_12(__v_19.external_uint32, new Uint32Array(__v_13));
+ __f_12(__v_19.external_float32, new Float32Array(__v_13));
+ __f_12(__v_19.external_float64, new Float64Array(__v_13));
+ __f_12(__v_19.external_uint8_clamped, new Uint8ClampedArray(__v_13));
+}
+try {
+__f_18();
+} catch(e) { }
diff --git a/test/mjsunit/regress/regress-411210.js b/test/mjsunit/regress/regress-411210.js
new file mode 100644
index 0000000..2dbc5ff
--- /dev/null
+++ b/test/mjsunit/regress/regress-411210.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-interval=439 --random-seed=-423594851
+
+var __v_3;
+function __f_2() {
+ var __v_1 = new Array(3);
+ __v_1[0] = 10;
+ __v_1[1] = 15.5;
+ __v_3 = __f_2();
+ __v_1[2] = 20;
+ return __v_1;
+}
+
+try {
+ for (var __v_2 = 0; __v_2 < 3; ++__v_2) {
+ __v_3 = __f_2();
+ }
+}
+catch (e) { }
diff --git a/test/mjsunit/regress/regress-411237.js b/test/mjsunit/regress/regress-411237.js
new file mode 100644
index 0000000..8b75ba3
--- /dev/null
+++ b/test/mjsunit/regress/regress-411237.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --harmony
+
+try {
+ %OptimizeFunctionOnNextCall(print);
+} catch(e) { }
+
+try {
+ function* f() {
+ }
+ %OptimizeFunctionOnNextCall(f);
+} catch(e) { }
diff --git a/test/mjsunit/regress/regress-412162.js b/test/mjsunit/regress/regress-412162.js
new file mode 100644
index 0000000..6a7ad0c
--- /dev/null
+++ b/test/mjsunit/regress/regress-412162.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+ Math.abs(-NaN).toString();
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/test/mjsunit/regress/regress-416416.js b/test/mjsunit/regress/regress-416416.js
new file mode 100644
index 0000000..66e882e
--- /dev/null
+++ b/test/mjsunit/regress/regress-416416.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function foo() {
+ try {
+ String.prototype.length.x();
+ } catch (e) {
+ }
+}
+
+foo();
+foo();
+foo();
diff --git a/test/mjsunit/regress/regress-45469.js b/test/mjsunit/regress/regress-45469.js
index 832a73f..1abe0f9 100644
--- a/test/mjsunit/regress/regress-45469.js
+++ b/test/mjsunit/regress/regress-45469.js
@@ -42,5 +42,3 @@
var res = re.test("xx");
assertEquals(i % 3 != 2, res, "testres" + i);
}
-
-
diff --git a/test/mjsunit/regress/regress-483.js b/test/mjsunit/regress/regress-483.js
index db93f59..7370134 100644
--- a/test/mjsunit/regress/regress-483.js
+++ b/test/mjsunit/regress/regress-483.js
@@ -32,4 +32,3 @@
X.prototype.x = {x:1}
new X()
-
diff --git a/test/mjsunit/regress/regress-485.js b/test/mjsunit/regress/regress-485.js
old mode 100755
new mode 100644
diff --git a/test/mjsunit/regress/regress-490.js b/test/mjsunit/regress/regress-490.js
index 8dd8959..6ce89db 100644
--- a/test/mjsunit/regress/regress-490.js
+++ b/test/mjsunit/regress/regress-490.js
@@ -42,6 +42,9 @@
var b = '';
for (var j = 0; j < 10; j++) {
b += '$1';
+
+ // TODO(machenbach): Do we need all these replacements? Wouldn't corner
+ // cases like smallest and biggest suffice?
a.replace(/^(.*)/, b);
}
a += a;
diff --git a/test/mjsunit/regress/regress-492.js b/test/mjsunit/regress/regress-492.js
index a8b783b..53b3195 100644
--- a/test/mjsunit/regress/regress-492.js
+++ b/test/mjsunit/regress/regress-492.js
@@ -29,7 +29,7 @@
// This should not hit any asserts in debug mode on ARM.
function function_with_n_args(n) {
- var source = '(function f(';
+ var source = '(function f' + n + '(';
for (var arg = 0; arg < n; arg++) {
if (arg != 0) source += ',';
source += 'arg' + arg;
@@ -50,3 +50,41 @@
for (args = 1019; args < 1041; args++) {
function_with_n_args(args);
}
+
+
+function foo(
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x,
+ x, x, x, x, x, x, x, x, x, x, x, x, x, x, x, x
+) {}
+
+for (var i = 0; i < 10000; ++i) foo();
diff --git a/test/mjsunit/regress/regress-581.js b/test/mjsunit/regress/regress-581.js
new file mode 100644
index 0000000..65cd87d
--- /dev/null
+++ b/test/mjsunit/regress/regress-581.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var pow30 = Math.pow(2, 30);
+var pow31 = Math.pow(2, 31);
+
+var a = [];
+a[pow31] = 31;
+
+assertEquals(pow31 + 1, a.length);
+assertThrows(function() { a.concat(a); }, RangeError);
+
+var b = [];
+b[pow31 - 2] = 32;
+var ab = a.concat(b);
+assertEquals(2 * pow31 - 1, ab.length);
+assertEquals(31, ab[pow31]);
+assertEquals(32, ab[2 * pow31 - 1]);
+
+var c = [];
+c[pow30] = 30;
+assertThrows(function() { c.concat(c, a); }, RangeError);
diff --git a/test/mjsunit/regress/regress-588599.js b/test/mjsunit/regress/regress-588599.js
index a1c16e2..eece492 100644
--- a/test/mjsunit/regress/regress-588599.js
+++ b/test/mjsunit/regress/regress-588599.js
@@ -28,4 +28,3 @@
assertFalse(Infinity == -Infinity);
assertEquals(Infinity, 1 / 1e-9999);
assertEquals(-Infinity, 1 / -1e-9999);
-
diff --git a/test/mjsunit/regress/regress-618.js b/test/mjsunit/regress/regress-618.js
new file mode 100644
index 0000000..ddc0c19
--- /dev/null
+++ b/test/mjsunit/regress/regress-618.js
@@ -0,0 +1,86 @@
+// Copyright 2010 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Simple class using inline constructor.
+function C1() {
+ this.x = 23;
+};
+var c1 = new C1();
+assertEquals(23, c1.x);
+assertEquals("undefined", typeof c1.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C1.prototype = { set x(value) { this.y = 23; } };
+var c1 = new C1();
+assertEquals("undefined", typeof c1.x);
+assertEquals(23, c1.y);
+
+// Simple class using inline constructor.
+function C2() {
+ this.x = 23;
+};
+var c2 = new C2();
+assertEquals(23, c2.x);
+assertEquals("undefined", typeof c2.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C2.prototype.__proto__ = { set x(value) { this.y = 23; } };
+var c2 = new C2();
+assertEquals("undefined", typeof c2.x);
+assertEquals(23, c2.y);
+
+// Simple class using inline constructor.
+function C3() {
+ this.x = 23;
+};
+var c3 = new C3();
+assertEquals(23, c3.x);
+assertEquals("undefined", typeof c3.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C3.prototype.__defineSetter__('x', function(value) { this.y = 23; });
+var c3 = new C3();
+assertEquals("undefined", typeof c3.x);
+assertEquals(23, c3.y);
+
+// Simple class using inline constructor.
+function C4() {
+ this.x = 23;
+};
+var c4 = new C4();
+assertEquals(23, c4.x);
+assertEquals("undefined", typeof c4.y);
+
+// Add setter somewhere on the prototype chain after having constructed the
+// first instance.
+C4.prototype.__proto__.__defineSetter__('x', function(value) { this.y = 23; });
+var c4 = new C4();
+assertEquals("undefined", typeof c4.x);
+assertEquals(23, c4.y);
diff --git a/test/mjsunit/regress/regress-619.js b/test/mjsunit/regress/regress-619.js
index 4d3e66b..c18a8ac 100644
--- a/test/mjsunit/regress/regress-619.js
+++ b/test/mjsunit/regress/regress-619.js
@@ -58,4 +58,3 @@
for(var i = 0; i < 1024; i++) {
assertEquals(i, obj[i]);
}
-
diff --git a/test/mjsunit/regress/regress-634-debug.js b/test/mjsunit/regress/regress-634-debug.js
new file mode 100644
index 0000000..17ca828
--- /dev/null
+++ b/test/mjsunit/regress/regress-634-debug.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ %SetAllocationTimeout(1, 0, false);
+ a = new Array(0);
+ assertEquals(0, a.length);
+ assertEquals(0, a.length);
+ %SetAllocationTimeout(-1, -1, true);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-670147.js b/test/mjsunit/regress/regress-670147.js
index b5b00d0..916c13d 100644
--- a/test/mjsunit/regress/regress-670147.js
+++ b/test/mjsunit/regress/regress-670147.js
@@ -31,4 +31,3 @@
}
assertFalse(XXX('Hello'));
-
diff --git a/test/mjsunit/regress/regress-674753.js b/test/mjsunit/regress/regress-674753.js
index 361b457..b3704ea 100644
--- a/test/mjsunit/regress/regress-674753.js
+++ b/test/mjsunit/regress/regress-674753.js
@@ -84,4 +84,3 @@
assertFalse(typeof 'x' === 'object');
assertFalse(typeof Object == 'object');
assertFalse(typeof Object === 'object');
-
diff --git a/test/mjsunit/regress/regress-675.js b/test/mjsunit/regress/regress-675.js
index 19ca646..bef7b27 100644
--- a/test/mjsunit/regress/regress-675.js
+++ b/test/mjsunit/regress/regress-675.js
@@ -58,4 +58,3 @@
// Check that IC bails out.
assertEquals(42, g());
-
diff --git a/test/mjsunit/regress/regress-678525.js b/test/mjsunit/regress/regress-678525.js
index 11eaf74..49059c6 100644
--- a/test/mjsunit/regress/regress-678525.js
+++ b/test/mjsunit/regress/regress-678525.js
@@ -55,5 +55,3 @@
assertEquals(73, '\111'.charCodeAt(0));
assertEquals(105, '\151'.charCodeAt(0));
-
-
diff --git a/test/mjsunit/regress/regress-734862.js b/test/mjsunit/regress/regress-734862.js
index 6239047..40e5b1d 100644
--- a/test/mjsunit/regress/regress-734862.js
+++ b/test/mjsunit/regress/regress-734862.js
@@ -34,4 +34,3 @@
assertTrue(catcher(void 0, 'foo') instanceof TypeError);
assertTrue(catcher(null, 123) instanceof TypeError);
assertTrue(catcher(void 0, 123) instanceof TypeError);
-
diff --git a/test/mjsunit/regress/regress-74.js b/test/mjsunit/regress/regress-74.js
index f22b33c..bdc3b5c 100644
--- a/test/mjsunit/regress/regress-74.js
+++ b/test/mjsunit/regress/regress-74.js
@@ -38,4 +38,3 @@
}
test();
-
diff --git a/test/mjsunit/regress/regress-753.js b/test/mjsunit/regress/regress-753.js
index 6a6d87b..0253962 100644
--- a/test/mjsunit/regress/regress-753.js
+++ b/test/mjsunit/regress/regress-753.js
@@ -32,5 +32,4 @@
// See: http://code.google.com/p/v8/issues/detail?id=753
var obj = {a1: {b1: [1,2,3,4], b2: {c1: 1, c2: 2}},a2: 'a2'};
-assertEquals(JSON.stringify(obj,null, 5.99999), JSON.stringify(obj,null, 5));
-
+assertEquals(JSON.stringify(obj, null, 5.99999), JSON.stringify(obj, null, 5));
diff --git a/test/mjsunit/regress/regress-806473.js b/test/mjsunit/regress/regress-806473.js
index 6d6485d..91c9a9f 100644
--- a/test/mjsunit/regress/regress-806473.js
+++ b/test/mjsunit/regress/regress-806473.js
@@ -56,5 +56,3 @@
assertEquals(10, i);
assertEquals(10, j);
-
-
diff --git a/test/mjsunit/regress/regress-85177.js b/test/mjsunit/regress/regress-85177.js
index 275bbe7..aa938f5 100644
--- a/test/mjsunit/regress/regress-85177.js
+++ b/test/mjsunit/regress/regress-85177.js
@@ -62,4 +62,3 @@
f();
%OptimizeFunctionOnNextCall(f);
f();
-
diff --git a/test/mjsunit/regress/regress-892742.js b/test/mjsunit/regress/regress-892742.js
index 78a57b2..fd79fc0 100644
--- a/test/mjsunit/regress/regress-892742.js
+++ b/test/mjsunit/regress/regress-892742.js
@@ -45,4 +45,3 @@
assertEquals(1, f());
assertEquals(undefined, g());
assertEquals(undefined, h());
-
diff --git a/test/mjsunit/regress/regress-925537.js b/test/mjsunit/regress/regress-925537.js
index d50c568..6d75504 100644
--- a/test/mjsunit/regress/regress-925537.js
+++ b/test/mjsunit/regress/regress-925537.js
@@ -39,4 +39,3 @@
assertClose(-Math.PI / 4, Math.atan2(ninf, pinf));
assertClose( 3 * Math.PI / 4, Math.atan2(pinf, ninf));
assertClose(-3 * Math.PI / 4, Math.atan2(ninf, ninf));
-
diff --git a/test/mjsunit/regress/regress-94873.js b/test/mjsunit/regress/regress-94873.js
index 41ca992..b61bc0c 100644
--- a/test/mjsunit/regress/regress-94873.js
+++ b/test/mjsunit/regress/regress-94873.js
@@ -75,4 +75,4 @@
}
Debug.setBreakPoint(a, 0, 0);
-new a(1, 2);
\ No newline at end of file
+new a(1, 2);
diff --git a/test/mjsunit/regress/regress-97116b.js b/test/mjsunit/regress/regress-97116b.js
new file mode 100644
index 0000000..91e7d6e
--- /dev/null
+++ b/test/mjsunit/regress/regress-97116b.js
@@ -0,0 +1,50 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+// Check that we are not flushing code for inlined functions that
+// have a pending lazy deoptimization on the stack.
+
+%NeverOptimizeFunction(deopt);
+function deopt() {
+ %DeoptimizeFunction(outer);
+ for (var i = 0; i < 10; i++) gc(); // Force code flushing.
+}
+
+function outer(should_deopt) {
+ inner(should_deopt);
+}
+
+function inner(should_deopt) {
+ if (should_deopt) deopt();
+}
+
+outer(false);
+outer(false);
+%OptimizeFunctionOnNextCall(outer);
+outer(true);
diff --git a/test/mjsunit/regress/regress-990205.js b/test/mjsunit/regress/regress-990205.js
index b3024c2..7eb66f0 100644
--- a/test/mjsunit/regress/regress-990205.js
+++ b/test/mjsunit/regress/regress-990205.js
@@ -36,4 +36,3 @@
};
assertThrows("f()");
-
diff --git a/test/mjsunit/regress/regress-99167.js b/test/mjsunit/regress/regress-99167.js
index 5053ae5..eac49d1 100644
--- a/test/mjsunit/regress/regress-99167.js
+++ b/test/mjsunit/regress/regress-99167.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --expose-gc --max-new-space-size=1024
+// Flags: --expose-gc --max-semi-space-size=1
eval("function Node() { this.a = 1; this.a = 3; }");
new Node;
diff --git a/test/mjsunit/regress/regress-995.js b/test/mjsunit/regress/regress-995.js
index e88121a..6f3dac1 100644
--- a/test/mjsunit/regress/regress-995.js
+++ b/test/mjsunit/regress/regress-995.js
@@ -54,4 +54,3 @@
}
}
h(undefined);
-
diff --git a/test/mjsunit/regress/regress-998565.js b/test/mjsunit/regress/regress-998565.js
index 260b791..840c045 100644
--- a/test/mjsunit/regress/regress-998565.js
+++ b/test/mjsunit/regress/regress-998565.js
@@ -48,4 +48,4 @@
f();
// Make sure that the debug event listener vas invoked.
-assertTrue(listenerCalled);
\ No newline at end of file
+assertTrue(listenerCalled);
diff --git a/test/mjsunit/regress/regress-add-minus-zero.js b/test/mjsunit/regress/regress-add-minus-zero.js
new file mode 100644
index 0000000..cb77cdf
--- /dev/null
+++ b/test/mjsunit/regress/regress-add-minus-zero.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o = { a: 0 };
+
+function f(x) { return -o.a + 0; };
+
+assertEquals("Infinity", String(1/f()));
+assertEquals("Infinity", String(1/f()));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("Infinity", String(1/f()));
diff --git a/test/mjsunit/regress/regress-alloc-smi-check.js b/test/mjsunit/regress/regress-alloc-smi-check.js
new file mode 100644
index 0000000..295048a
--- /dev/null
+++ b/test/mjsunit/regress/regress-alloc-smi-check.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var x = {};
+
+function f(a) {
+ a[200000000] = x;
+}
+
+f(new Array(100000));
+f([]);
+%OptimizeFunctionOnNextCall(f);
+f([]);
diff --git a/test/mjsunit/regress/regress-array-pop-deopt.js b/test/mjsunit/regress/regress-array-pop-deopt.js
new file mode 100644
index 0000000..9a0d35d
--- /dev/null
+++ b/test/mjsunit/regress/regress-array-pop-deopt.js
@@ -0,0 +1,41 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o = [6,7,8,9];
+
+function f(b) {
+ var v = o.pop() + b;
+ return v;
+}
+
+assertEquals(10, f(1));
+assertEquals(9, f(1));
+assertEquals(8, f(1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("61", f("1"));
diff --git a/test/mjsunit/regress/regress-array-pop-nonconfigurable.js b/test/mjsunit/regress/regress-array-pop-nonconfigurable.js
new file mode 100644
index 0000000..823bb6b
--- /dev/null
+++ b/test/mjsunit/regress/regress-array-pop-nonconfigurable.js
@@ -0,0 +1,30 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [];
+Object.defineProperty(a, 0, {});
+assertThrows(function() { a.pop(); });
diff --git a/test/mjsunit/regress/regress-binop-nosse2.js b/test/mjsunit/regress/regress-binop-nosse2.js
new file mode 100644
index 0000000..29c8a04
--- /dev/null
+++ b/test/mjsunit/regress/regress-binop-nosse2.js
@@ -0,0 +1,167 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --noenable-sse2
+
+// general tests
+var e31 = Math.pow(2, 31);
+
+assertEquals(-e31, -1*e31);
+assertEquals(e31, -1*e31*(-1));
+assertEquals(e31, -1*-e31);
+assertEquals(e31, -e31*(-1));
+
+var x = {toString : function() {return 1}}
+function add(a,b){return a+b;}
+add(1,x);
+add(1,x);
+%OptimizeFunctionOnNextCall(add);
+add(1,x);
+x.toString = function() {return "2"};
+
+assertEquals(add(1,x), "12");
+
+// Test the correct placement of the simulates in TruncateToNumber:
+function Checker() {
+ this.str = "1";
+ var toStringCalled = 0;
+ var toStringExpected = 0;
+ this.toString = function() {
+ toStringCalled++;
+ return this.str;
+ };
+ this.check = function() {
+ toStringExpected++;
+ assertEquals(toStringExpected, toStringCalled);
+ };
+};
+var left = new Checker();
+var right = new Checker();
+
+function test(fun,check_fun,a,b,does_throw) {
+ left.str = a;
+ right.str = b;
+ try {
+ assertEquals(check_fun(a,b), fun(left, right));
+ assertTrue(!does_throw);
+ } catch(e) {
+ if (e instanceof TypeError) {
+ assertTrue(!!does_throw);
+ } else {
+ throw e;
+ }
+ } finally {
+ left.check();
+ if (!does_throw || does_throw>1) {
+ right.check();
+ }
+ }
+}
+
+function minus(a,b) { return a-b };
+function check_minus(a,b) { return a-b };
+function mod(a,b) { return a%b };
+function check_mod(a,b) { return a%b };
+
+test(minus,check_minus,1,2);
+// Bailout on left
+test(minus,check_minus,1<<30,1);
+// Bailout on right
+test(minus,check_minus,1,1<<30);
+// Bailout on result
+test(minus,check_minus,1<<30,-(1<<30));
+
+// Some more interesting things
+test(minus,check_minus,1,1.4);
+test(minus,check_minus,1.3,4);
+test(minus,check_minus,1.3,1.4);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,undefined);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,true);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,null);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,"");
+test(minus,check_minus,1,2);
+
+// Throw on left
+test(minus,check_minus,{},1,1);
+// Throw on right
+test(minus,check_minus,1,{},2);
+// Throw both
+test(minus,check_minus,{},{},1);
+
+test(minus,check_minus,1,2);
+
+// Now with optimized code
+test(mod,check_mod,1,2);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,2);
+
+test(mod,check_mod,1<<30,1);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1<<30,1);
+test(mod,check_mod,1,1<<30);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,1<<30);
+test(mod,check_mod,1<<30,-(1<<30));
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1<<30,-(1<<30));
+
+test(mod,check_mod,1,{},2);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,{},2);
+
+test(mod,check_mod,1,2);
+
+
+// test oddballs
+function t1(a, b) {return a-b}
+assertEquals(t1(1,2), 1-2);
+assertEquals(t1(2,true), 2-1);
+assertEquals(t1(false,2), 0-2);
+assertEquals(t1(1,2.4), 1-2.4);
+assertEquals(t1(1.3,2.4), 1.3-2.4);
+assertEquals(t1(true,2.4), 1-2.4);
+assertEquals(t1(1,undefined), 1-NaN);
+assertEquals(t1(1,1<<30), 1-(1<<30));
+assertEquals(t1(1,2), 1-2);
+
+function t2(a, b) {return a/b}
+assertEquals(t2(1,2), 1/2);
+assertEquals(t2(null,2), 0/2);
+assertEquals(t2(null,-2), 0/-2);
+assertEquals(t2(2,null), 2/0);
+assertEquals(t2(-2,null), -2/0);
+assertEquals(t2(1,2.4), 1/2.4);
+assertEquals(t2(1.3,2.4), 1.3/2.4);
+assertEquals(t2(null,2.4), 0/2.4);
+assertEquals(t2(1.3,null), 1.3/0);
+assertEquals(t2(undefined,2), NaN/2);
+assertEquals(t2(1,1<<30), 1/(1<<30));
+assertEquals(t2(1,2), 1/2);
diff --git a/test/mjsunit/regress/regress-binop.js b/test/mjsunit/regress/regress-binop.js
new file mode 100644
index 0000000..7a8b419
--- /dev/null
+++ b/test/mjsunit/regress/regress-binop.js
@@ -0,0 +1,181 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// general tests
+var e31 = Math.pow(2, 31);
+
+assertEquals(-e31, -1*e31);
+assertEquals(e31, -1*e31*(-1));
+assertEquals(e31, -1*-e31);
+assertEquals(e31, -e31*(-1));
+
+var x = {toString : function() {return 1}}
+function add(a,b){return a+b;}
+add(1,x);
+add(1,x);
+%OptimizeFunctionOnNextCall(add);
+add(1,x);
+x.toString = function() {return "2"};
+
+assertEquals(add(1,x), "12");
+
+// Test the correct placement of the simulates in TruncateToNumber:
+function Checker() {
+ this.str = "1";
+ var toStringCalled = 0;
+ var toStringExpected = 0;
+ this.toString = function() {
+ toStringCalled++;
+ return this.str;
+ };
+ this.check = function() {
+ toStringExpected++;
+ assertEquals(toStringExpected, toStringCalled);
+ };
+};
+var left = new Checker();
+var right = new Checker();
+
+function test(fun,check_fun,a,b,does_throw) {
+ left.str = a;
+ right.str = b;
+ try {
+ assertEquals(check_fun(a,b), fun(left, right));
+ assertTrue(!does_throw);
+ } catch(e) {
+ if (e instanceof TypeError) {
+ assertTrue(!!does_throw);
+ } else {
+ throw e;
+ }
+ } finally {
+ left.check();
+ if (!does_throw || does_throw>1) {
+ right.check();
+ }
+ }
+}
+
+function minus(a,b) { return a-b };
+function check_minus(a,b) { return a-b };
+function mod(a,b) { return a%b };
+function check_mod(a,b) { return a%b };
+
+test(minus,check_minus,1,2);
+// Bailout on left
+test(minus,check_minus,1<<30,1);
+// Bailout on right
+test(minus,check_minus,1,1<<30);
+// Bailout on result
+test(minus,check_minus,1<<30,-(1<<30));
+
+// Some more interesting things
+test(minus,check_minus,1,1.4);
+test(minus,check_minus,1.3,4);
+test(minus,check_minus,1.3,1.4);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,undefined);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,true);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,null);
+test(minus,check_minus,1,2);
+test(minus,check_minus,1,"");
+test(minus,check_minus,1,2);
+
+// Throw on left
+test(minus,check_minus,{},1,1);
+// Throw on right
+test(minus,check_minus,1,{},2);
+// Throw both
+test(minus,check_minus,{},{},1);
+
+test(minus,check_minus,1,2);
+
+// Now with optimized code
+test(mod,check_mod,1,2);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,2);
+
+test(mod,check_mod,1<<30,1);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1<<30,1);
+test(mod,check_mod,1,1<<30);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,1<<30);
+test(mod,check_mod,1<<30,-(1<<30));
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1<<30,-(1<<30));
+
+test(mod,check_mod,1,{},2);
+%OptimizeFunctionOnNextCall(mod);
+test(mod,check_mod,1,{},2);
+
+test(mod,check_mod,1,2);
+
+
+// test oddballs
+function t1(a, b) {return a-b}
+assertEquals(t1(1,2), 1-2);
+assertEquals(t1(2,true), 2-1);
+assertEquals(t1(false,2), 0-2);
+assertEquals(t1(1,2.4), 1-2.4);
+assertEquals(t1(1.3,2.4), 1.3-2.4);
+assertEquals(t1(true,2.4), 1-2.4);
+assertEquals(t1(1,undefined), 1-NaN);
+assertEquals(t1(1,1<<30), 1-(1<<30));
+assertEquals(t1(1,2), 1-2);
+
+function t2(a, b) {return a/b}
+assertEquals(t2(1,2), 1/2);
+assertEquals(t2(null,2), 0/2);
+assertEquals(t2(null,-2), 0/-2);
+assertEquals(t2(2,null), 2/0);
+assertEquals(t2(-2,null), -2/0);
+assertEquals(t2(1,2.4), 1/2.4);
+assertEquals(t2(1.3,2.4), 1.3/2.4);
+assertEquals(t2(null,2.4), 0/2.4);
+assertEquals(t2(1.3,null), 1.3/0);
+assertEquals(t2(undefined,2), NaN/2);
+assertEquals(t2(1,1<<30), 1/(1<<30));
+assertEquals(t2(1,2), 1/2);
+
+
+// Assert that the hole is not truncated to nan for string add.
+function string_add(a,i) {
+ var d = [0.1, ,0.3];
+ return a + d[i];
+}
+
+string_add(1.1, 0);
+string_add("", 0);
+%OptimizeFunctionOnNextCall(string_add);
+string_add(1.1, 0);
+// There comes the hole
+assertEquals("undefined", string_add("", 1));
diff --git a/test/mjsunit/regress/regress-builtin-array-op.js b/test/mjsunit/regress/regress-builtin-array-op.js
new file mode 100644
index 0000000..ea5891f
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtin-array-op.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that we invoke the correct sort function in
+// array operations.
+
+var foo = "hest";
+Array.prototype.sort = function(fn) { foo = "fisk"; };
+Function.prototype.call = function() { foo = "caramel"; };
+var a = [2,3,1];
+a[100000] = 0;
+a.join();
+assertEquals("hest", foo);
diff --git a/test/mjsunit/regress/regress-builtinbust-1.js b/test/mjsunit/regress/regress-builtinbust-1.js
new file mode 100644
index 0000000..33a7563
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-1.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function nope() { return false; }
+var a = [ 1, 2, 3 ];
+Object.seal(a);
+Object.isSealed = nope;
+
+assertThrows(function() { a.pop(); }, TypeError);
+assertThrows(function() { a.push(5); }, TypeError);
+assertThrows(function() { a.shift(); }, TypeError);
+assertThrows(function() { a.unshift(5); }, TypeError);
+assertThrows(function() { a.splice(0, 1); }, TypeError);
diff --git a/test/mjsunit/regress/regress-builtinbust-3.js b/test/mjsunit/regress/regress-builtinbust-3.js
new file mode 100644
index 0000000..f5a0c39
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-3.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function produce_object() {
+ var real_length = 1;
+ function set_length() { real_length = "boom"; }
+ function get_length() { return real_length; }
+ var o = { __proto__:Array.prototype , 0:"x" };
+ Object.defineProperty(o, "length", { set:set_length, get:get_length })
+ return o;
+}
+
+assertEquals(2, produce_object().push("y"));
+assertEquals(2, produce_object().unshift("y"));
diff --git a/test/mjsunit/regress/regress-builtinbust-4.js b/test/mjsunit/regress/regress-builtinbust-4.js
new file mode 100644
index 0000000..dbaa245
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-4.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = { __proto__:Array.prototype, 0:"x" };
+function boomer() { return 0; }
+Object.defineProperty(o, "length", { get:boomer, set:boomer });
+Object.seal(o);
+
+assertDoesNotThrow(function() { o.push(1); });
+assertEquals(0, o.length);
+assertEquals(1, o[0]);
+
+assertDoesNotThrow(function() { o.unshift(2); });
+assertEquals(0, o.length);
+assertEquals(2, o[0]);
diff --git a/test/mjsunit/regress/regress-builtinbust-5.js b/test/mjsunit/regress/regress-builtinbust-5.js
new file mode 100644
index 0000000..266e4d4
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-5.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [ 1, 2, 3 ];
+var was_called = false;
+function poison() { was_called = true; }
+a.hasOwnProperty = poison;
+Object.freeze(a);
+
+assertThrows("a.unshift()", TypeError);
+assertEquals(3, a.length);
+assertFalse(was_called);
diff --git a/test/mjsunit/regress/regress-builtinbust-6.js b/test/mjsunit/regress/regress-builtinbust-6.js
new file mode 100644
index 0000000..d926bd0
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-6.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Test that Array builtins can be called on primitive values.
+var values = [ 23, 4.2, true, false, 0/0 ];
+for (var i = 0; i < values.length; ++i) {
+ var v = values[i];
+ Array.prototype.join.call(v);
+ Array.prototype.pop.call(v);
+ Array.prototype.push.call(v);
+ Array.prototype.reverse.call(v);
+ Array.prototype.shift.call(v);
+ Array.prototype.slice.call(v);
+ Array.prototype.splice.call(v);
+ Array.prototype.unshift.call(v);
+}
+
+// Test that ToObject on primitive values is only called once.
+var length_receiver, element_receiver;
+function length() { length_receiver = this; return 2; }
+function element() { element_receiver = this; return "x"; }
+Object.defineProperty(Number.prototype, "length", { get:length, set:length });
+Object.defineProperty(Number.prototype, "0", { get:element, set:element });
+Object.defineProperty(Number.prototype, "1", { get:element, set:element });
+Object.defineProperty(Number.prototype, "2", { get:element, set:element });
+function test_receiver(expected, call_string) {
+ assertDoesNotThrow(call_string);
+ assertEquals(new Number(expected), length_receiver);
+ assertSame(length_receiver, element_receiver);
+}
+
+test_receiver(11, "Array.prototype.join.call(11)")
+test_receiver(23, "Array.prototype.pop.call(23)");
+test_receiver(42, "Array.prototype.push.call(42, 'y')");
+test_receiver(49, "Array.prototype.reverse.call(49)");
+test_receiver(65, "Array.prototype.shift.call(65)");
+test_receiver(77, "Array.prototype.slice.call(77, 1)");
+test_receiver(88, "Array.prototype.splice.call(88, 1, 1)");
+test_receiver(99, "Array.prototype.unshift.call(99, 'z')");
diff --git a/test/mjsunit/regress/regress-builtinbust-7.js b/test/mjsunit/regress/regress-builtinbust-7.js
new file mode 100644
index 0000000..a7c049e
--- /dev/null
+++ b/test/mjsunit/regress/regress-builtinbust-7.js
@@ -0,0 +1,32 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+if ("Intl" in this) {
+ function overflow() {
+ return overflow() + 1;
+ }
+ Object.defineProperty = overflow;
+ assertDoesNotThrow(function() { Intl.Collator.supportedLocalesOf("en"); });
+
+ var date = new Date(Date.UTC(2004, 12, 25, 3, 0, 0));
+ var options = {
+ weekday: "long",
+ year: "numeric",
+ month: "long",
+ day: "numeric"
+ };
+
+ Object.apply = overflow;
+ assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", options); });
+
+ var options_incomplete = {};
+ assertDoesNotThrow(function() {
+ date.toLocaleDateString("de-DE", options_incomplete);
+ });
+ assertTrue(options_incomplete.hasOwnProperty("year"));
+
+ assertDoesNotThrow(function() { date.toLocaleDateString("de-DE", undefined); });
+ assertDoesNotThrow(function() { date.toLocaleDateString("de-DE"); });
+ assertThrows(function() { date.toLocaleDateString("de-DE", null); }, TypeError);
+}
diff --git a/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js b/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
new file mode 100644
index 0000000..a306e5d
--- /dev/null
+++ b/test/mjsunit/regress/regress-calls-with-migrating-prototypes.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ return 1;
+}
+function C1(f) {
+ this.f = f;
+}
+var o1 = new C1(f);
+var o2 = {__proto__: new C1(f) }
+function foo(o) {
+ return o.f();
+}
+foo(o1);
+foo(o1);
+foo(o2);
+foo(o1);
+var o3 = new C1(function() { return 2; });
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo(o2));
+o2.__proto__.f = function() { return 3; };
+assertEquals(3, foo(o2));
diff --git a/test/mjsunit/regress/regress-captured-object-no-dummy-use.js b/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
new file mode 100644
index 0000000..cdf548d
--- /dev/null
+++ b/test/mjsunit/regress/regress-captured-object-no-dummy-use.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+var global = "10.1";
+function f() { }
+function g(a) { this.d = a; }
+function h() {
+ var x = new f();
+ global.dummy = this;
+ var y = new g(x);
+}
+h();
+h();
+%OptimizeFunctionOnNextCall(h);
+h();
diff --git a/test/mjsunit/regress/regress-check-eliminate-loop-phis.js b/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
new file mode 100644
index 0000000..3791c35
--- /dev/null
+++ b/test/mjsunit/regress/regress-check-eliminate-loop-phis.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var o = {x:1};
+ var y = {y:2.5, x:0};
+ var result;
+ for (var i = 0; i < 2; i++) {
+ result = o.x + 3;
+ o = y;
+ }
+ return result;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f());
diff --git a/test/mjsunit/regress/regress-clobbered-fp-regs.js b/test/mjsunit/regress/regress-clobbered-fp-regs.js
new file mode 100644
index 0000000..7795ae9
--- /dev/null
+++ b/test/mjsunit/regress/regress-clobbered-fp-regs.js
@@ -0,0 +1,54 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+//
+// Flags: --allow-natives-syntax
+
+function store(a, x, y) {
+ var f1 = 0.1 * y;
+ var f2 = 0.2 * y;
+ var f3 = 0.3 * y;
+ var f4 = 0.4 * y;
+ var f5 = 0.5 * y;
+ var f6 = 0.6 * y;
+ var f7 = 0.7 * y;
+ var f8 = 0.8 * y;
+ a[0] = x;
+ var sum = (f1 + f2 + f3 + f4 + f5 + f6 + f7 + f8);
+ assertEquals(1, y);
+ var expected = 3.6;
+ if (Math.abs(expected - sum) > 0.01) {
+ assertEquals(expected, sum);
+ }
+}
+
+// Generate TransitionElementsKindStub.
+store([1], 1, 1);
+store([1], 1.1, 1);
+store([1], 1.1, 1);
+%OptimizeFunctionOnNextCall(store);
+// This will trap on allocation site in TransitionElementsKindStub.
+store([1], 1, 1)
diff --git a/test/mjsunit/regress/regress-cnlt-elements.js b/test/mjsunit/regress/regress-cnlt-elements.js
new file mode 100644
index 0000000..634534c
--- /dev/null
+++ b/test/mjsunit/regress/regress-cnlt-elements.js
@@ -0,0 +1,43 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+var a = JSON.parse('{"b":1,"c":2,"d":3,"e":4}');
+var b = JSON.parse('{"12040200":1, "a":2, "b":2}');
+var c = JSON.parse('{"24050300":1}');
+b = null;
+gc();
+gc();
+c.a1 = 2;
+c.a2 = 2;
+c.a3 = 2;
+c.a4 = 2;
+c.a5 = 2;
+c.a6 = 2;
+c.a7 = 2;
+c.a8 = 2;
diff --git a/test/mjsunit/regress/regress-cnlt-enum-indices.js b/test/mjsunit/regress/regress-cnlt-enum-indices.js
new file mode 100644
index 0000000..03582bb
--- /dev/null
+++ b/test/mjsunit/regress/regress-cnlt-enum-indices.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+var o = {};
+var o2 = {};
+
+o.a = 1;
+o2.a = 1;
+function f() { return 10; }
+// Adds a non-field enumerable property.
+Object.defineProperty(o, "b", { get: f, enumerable: true });
+Object.defineProperty(o2, "b", { get: f, enumerable: true });
+assertTrue(%HaveSameMap(o, o2));
+o.c = 2;
+
+for (var x in o) { }
+o = null;
+
+gc();
diff --git a/test/mjsunit/regress/regress-cntl-descriptors-enum.js b/test/mjsunit/regress/regress-cntl-descriptors-enum.js
new file mode 100644
index 0000000..fd4ac6d
--- /dev/null
+++ b/test/mjsunit/regress/regress-cntl-descriptors-enum.js
@@ -0,0 +1,46 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+DontEnum = 2;
+
+var o = {};
+%AddNamedProperty(o, "a", 0, DontEnum);
+
+var o2 = {};
+%AddNamedProperty(o2, "a", 0, DontEnum);
+
+assertTrue(%HaveSameMap(o, o2));
+
+o.y = 2;
+
+for (var v in o) { print(v); }
+o = {};
+gc();
+
+for (var v in o2) { print(v); }
diff --git a/test/mjsunit/regress/regress-compare-constant-doubles.js b/test/mjsunit/regress/regress-compare-constant-doubles.js
new file mode 100644
index 0000000..0f8ffe3
--- /dev/null
+++ b/test/mjsunit/regress/regress-compare-constant-doubles.js
@@ -0,0 +1,58 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var left = 1.5;
+var right;
+
+var keepalive;
+
+function foo() {
+ // Fill XMM registers with cruft.
+ var a1 = Math.sin(1) + 10;
+ var a2 = a1 + 1;
+ var a3 = a2 + 1;
+ var a4 = a3 + 1;
+ var a5 = a4 + 1;
+ var a6 = a5 + 1;
+ keepalive = [a1, a2, a3, a4, a5, a6];
+
+ // Actual test.
+ if (left < right) return "ok";
+ return "bad";
+}
+
+function prepare(base) {
+ right = 0.5 * base;
+}
+
+prepare(21);
+assertEquals("ok", foo());
+assertEquals("ok", foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals("ok", foo());
diff --git a/test/mjsunit/regress/regress-conditional-position.js b/test/mjsunit/regress/regress-conditional-position.js
index cd8f7bd..ae5a3ac 100644
--- a/test/mjsunit/regress/regress-conditional-position.js
+++ b/test/mjsunit/regress/regress-conditional-position.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --always-full-compiler
+// Flags: --nocrankshaft
var functionToCatch;
var lineNumber;
diff --git a/test/mjsunit/regress/regress-context-osr.js b/test/mjsunit/regress/regress-context-osr.js
new file mode 100644
index 0000000..b74907d
--- /dev/null
+++ b/test/mjsunit/regress/regress-context-osr.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+"use strict";
+function f() {
+ try { } catch (e) { }
+}
+
+for (this.x = 0; this.x < 1; ++this.x) {
+ for (this.y = 0; this.y < 1; ++this.y) {
+ for (this.ll = 0; this.ll < 70670; ++this.ll) {
+ f();
+ }
+ }
+}
diff --git a/test/mjsunit/regress/regress-convert-enum.js b/test/mjsunit/regress/regress-convert-enum.js
new file mode 100644
index 0000000..c624cad
--- /dev/null
+++ b/test/mjsunit/regress/regress-convert-enum.js
@@ -0,0 +1,60 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Create a transition tree A (no descriptors) -> B (descriptor for a) -> C
+// (descriptor for a and c), that all share the descriptor array [a,c]. C is the
+// owner of the descriptor array.
+var o = {};
+o.a = 1;
+o.c = 2;
+
+// Add a transition B -> D where D has its own descriptor array [a,b] where b is
+// a constant function.
+var o1 = {};
+o1.a = 1;
+
+// Install an enumeration cache in the descriptor array [a,c] at map B.
+for (var x in o1) { }
+o1.b = function() { return 1; };
+
+// Return ownership of the descriptor array [a,c] to B and trim it to [a].
+o = null;
+gc();
+
+// Convert the transition B -> D into a transition to B -> E so that E uses the
+// instance descriptors [a,b] with b being a field.
+var o2 = {};
+o2.a = 1;
+o2.b = 10;
+
+// Create an object with map B and iterate over it.
+var o3 = {};
+o3.a = 1;
+
+for (var y in o3) { }
diff --git a/test/mjsunit/regress/regress-convert-enum2.js b/test/mjsunit/regress/regress-convert-enum2.js
new file mode 100644
index 0000000..cdc7fbe
--- /dev/null
+++ b/test/mjsunit/regress/regress-convert-enum2.js
@@ -0,0 +1,46 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+o.a = 1;
+o.b = function() { return 1; };
+o.d = 2;
+
+for (var x in o) { }
+
+var o1 = {};
+o1.a = 1;
+o1.b = 10;
+o1.c = 20;
+
+var keys = ["a", "b", "c"];
+
+var i = 0;
+for (var y in o1) {
+ assertEquals(keys[i], y);
+ i += 1;
+}
diff --git a/test/mjsunit/regress/regress-convert-function-to-double.js b/test/mjsunit/regress/regress-convert-function-to-double.js
new file mode 100644
index 0000000..fca44f9
--- /dev/null
+++ b/test/mjsunit/regress/regress-convert-function-to-double.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(v) {
+ this.func = v;
+}
+
+var o1 = new f(f);
+var d = 1.4;
+var o2 = new f(d);
+o2.func = 1.8;
+assertEquals(1.4, d)
diff --git a/test/mjsunit/regress/regress-convert-hole.js b/test/mjsunit/regress/regress-convert-hole.js
new file mode 100644
index 0000000..1e9c3f3
--- /dev/null
+++ b/test/mjsunit/regress/regress-convert-hole.js
@@ -0,0 +1,109 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f_store(test, test2, a, i) {
+ var o = [0.5,1,,3];
+ var d;
+ if (test) {
+ d = 1.5;
+ } else {
+ d = o[i];
+ }
+ if (test2) {
+ d += 1;
+ }
+ a[i] = d;
+ return d;
+}
+
+var a1 = [0, 0, 0, {}];
+f_store(true, false, a1, 0);
+f_store(true, true, a1, 0);
+f_store(false, false, a1, 1);
+f_store(false, true, a1, 1);
+%OptimizeFunctionOnNextCall(f_store);
+f_store(false, false, a1, 2);
+assertEquals(undefined, a1[2]);
+
+function test_arg(expected) {
+ return function(v) {
+ assertEquals(expected, v);
+ }
+}
+
+function f_call(f, test, test2, i) {
+ var o = [0.5,1,,3];
+ var d;
+ if (test) {
+ d = 1.5;
+ } else {
+ d = o[i];
+ }
+ if (test2) {
+ d += 1;
+ }
+ f(d);
+ return d;
+}
+
+f_call(test_arg(1.5), true, false, 0);
+f_call(test_arg(2.5), true, true, 0);
+f_call(test_arg(1), false, false, 1);
+f_call(test_arg(2), false, true, 1);
+%OptimizeFunctionOnNextCall(f_call);
+f_call(test_arg(undefined), false, false, 2);
+
+
+function f_external(test, test2, test3, a, i) {
+ var o = [0.5,1,,3];
+ var d;
+ if (test) {
+ d = 1.5;
+ } else {
+ d = o[i];
+ }
+ if (test2) {
+ d += 1;
+ }
+ if (test3) {
+ d = d|0;
+ }
+ a[d] = 1;
+ assertEquals(1, a[d]);
+ return d;
+}
+
+var a2 = new Int32Array(10);
+f_external(true, false, true, a2, 0);
+f_external(true, true, true, a2, 0);
+f_external(false, false, true, a2, 1);
+f_external(false, true, true, a2, 1);
+%OptimizeFunctionOnNextCall(f_external);
+f_external(false, false, false, a2, 2);
+assertEquals(1, a2[undefined]);
diff --git a/test/mjsunit/regress/regress-convert-hole2.js b/test/mjsunit/regress/regress-convert-hole2.js
new file mode 100644
index 0000000..02ef4dd
--- /dev/null
+++ b/test/mjsunit/regress/regress-convert-hole2.js
@@ -0,0 +1,86 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --allow-natives-syntax
+
+// Test adding undefined from hole in double-holey to string.
+var a = [1.5, , 1.8];
+
+function f(a, i, l) {
+ var v = a[i];
+ return l + v;
+}
+
+assertEquals("test1.5", f(a, 0, "test"));
+assertEquals("test1.5", f(a, 0, "test"));
+%OptimizeFunctionOnNextCall(f);
+assertEquals("testundefined", f(a, 1, "test"));
+
+// Test double-hole going through a phi to a string-add.
+function f2(b, a1, a2) {
+ var v;
+ if (b) {
+ v = a1[0];
+ } else {
+ v = a2[0];
+ }
+ x = v * 2;
+ return "test" + v + x;
+}
+
+f2(true, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+f2(true, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+f2(false, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+f2(false, [1.4,1.8,,1.9], [1.4,1.8,,1.9]);
+%OptimizeFunctionOnNextCall(f2);
+assertEquals("testundefinedNaN", f2(false, [,1.8,,1.9], [,1.9,,1.9]));
+
+// Test converting smi-hole to double-hole.
+function t_smi(a) {
+ a[0] = 1.5;
+}
+
+t_smi([1,,3]);
+t_smi([1,,3]);
+t_smi([1,,3]);
+%OptimizeFunctionOnNextCall(t_smi);
+var ta = [1,,3];
+t_smi(ta);
+ta.__proto__ = [6,6,6];
+assertEquals([1.5,6,3], ta);
+
+// Test converting double-hole to tagged-hole.
+function t(b) {
+ b[1] = {};
+}
+
+t([1.4, 1.6,,1.8, NaN]);
+t([1.4, 1.6,,1.8, NaN]);
+%OptimizeFunctionOnNextCall(t);
+var a = [1.6, 1.8,,1.9, NaN];
+t(a);
+a.__proto__ = [6,6,6,6,6];
+assertEquals([1.6, {}, 6, 1.9, NaN], a);
diff --git a/test/mjsunit/regress/regress-convert-transition.js b/test/mjsunit/regress/regress-convert-transition.js
new file mode 100644
index 0000000..057dc80
--- /dev/null
+++ b/test/mjsunit/regress/regress-convert-transition.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var input = '{ "a1":1, "a2":1, "a3":1, "a4":1, "a5":1, "a6":1, "a7":1,\
+ "a8":1, "a9":1, "a10":1, "a11":1, "a12":1, "a13":1}';
+var a = JSON.parse(input);
+a.a = function() { return 10; };
+
+// Force conversion of field to slow mode.
+var b = JSON.parse(input);
+b.a = 10;
+
+// Add another property to the object that would transition to a.
+var c = JSON.parse(input);
+c.x = 10;
+assertEquals(undefined, c.a);
diff --git a/test/mjsunit/regress/regress-copy-hole-to-field.js b/test/mjsunit/regress/regress-copy-hole-to-field.js
new file mode 100644
index 0000000..fa3db92
--- /dev/null
+++ b/test/mjsunit/regress/regress-copy-hole-to-field.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Copy a hole from HOLEY_DOUBLE to double field.
+var a = [1.5,,1.7];
+var o = {a:1.8};
+
+function f1(o,a,i) {
+ o.a = a[i];
+}
+
+f1(o,a,0);
+f1(o,a,0);
+assertEquals(1.5, o.a);
+%OptimizeFunctionOnNextCall(f1);
+f1(o,a,1);
+assertEquals(undefined, o.a);
+
+// Copy a hole from HOLEY_SMI to smi field.
+var a = [1,,3];
+var o = {ab:5};
+
+function f2(o,a,i) {
+ o.ab = a[i];
+}
+
+f2(o,a,0);
+f2(o,a,0);
+%OptimizeFunctionOnNextCall(f2);
+f2(o,a,1);
+assertEquals(undefined, o.ab);
diff --git a/test/mjsunit/regress/regress-cr-344285.js b/test/mjsunit/regress/regress-cr-344285.js
new file mode 100644
index 0000000..42e8bd1
--- /dev/null
+++ b/test/mjsunit/regress/regress-cr-344285.js
@@ -0,0 +1,37 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function __f_1(g) { return (g/-1) ^ 1; }
+var __v_0 = 1 << 31;
+var __v_2 = __f_1(__v_0);
+caught = false;
+try {
+ Realm.eval(__v_2, "Realm.global(0).y = 1");
+} catch (e) {
+ caught = true;
+}
+assertTrue(caught, "exception not caught");
diff --git a/test/mjsunit/regress/regress-crbug-107996.js b/test/mjsunit/regress/regress-crbug-107996.js
index dfe07e5..b4907f3 100644
--- a/test/mjsunit/regress/regress-crbug-107996.js
+++ b/test/mjsunit/regress/regress-crbug-107996.js
@@ -26,6 +26,7 @@
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
Debug = debug.Debug;
diff --git a/test/mjsunit/regress/regress-crbug-119926.js b/test/mjsunit/regress/regress-crbug-119926.js
index 26b84fa..1ad250a 100644
--- a/test/mjsunit/regress/regress-crbug-119926.js
+++ b/test/mjsunit/regress/regress-crbug-119926.js
@@ -25,9 +25,11 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+// Flags: --gc-global
+
// Test that array elements don't break upon garbage collection.
var a = new Array(500);
-for (var i = 0; i < 500000; i++) {
+for (var i = 0; i < 100000; i++) {
a[i] = new Object();
}
diff --git a/test/mjsunit/regress/regress-crbug-122271.js b/test/mjsunit/regress/regress-crbug-122271.js
index 3a99a7fa..8ae91e8 100644
--- a/test/mjsunit/regress/regress-crbug-122271.js
+++ b/test/mjsunit/regress/regress-crbug-122271.js
@@ -39,11 +39,11 @@
array.foo = "bar";
}
-assertTrue(%HasFastSmiOnlyElements(a));
-assertTrue(%HasFastElements(b));
+assertTrue(%HasFastSmiElements(a));
+assertTrue(%HasFastObjectElements(b));
foo(a);
foo(b);
-assertTrue(%HasFastSmiOnlyElements(a));
-assertTrue(%HasFastElements(b));
+assertTrue(%HasFastSmiElements(a));
+assertTrue(%HasFastObjectElements(b));
diff --git a/test/mjsunit/regress/regress-crbug-125148.js b/test/mjsunit/regress/regress-crbug-125148.js
new file mode 100644
index 0000000..0f7bcd8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-125148.js
@@ -0,0 +1,90 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function ToDictionaryMode(x) {
+ %OptimizeObjectForAddingMultipleProperties(x, 100);
+}
+
+var A, B, C;
+
+// The initial bug report was about calling a know function...
+A = {};
+Object.defineProperty(A, "foo", { value: function() { assertUnreachable(); }});
+
+B = Object.create(A);
+Object.defineProperty(B, "foo", { value: function() { return 111; }});
+
+C = Object.create(B);
+
+function bar(x) { return x.foo(); }
+
+assertEquals(111, bar(C));
+assertEquals(111, bar(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(111, bar(C));
+
+// Although this was not in the initial bug report: The same for getters...
+A = {};
+Object.defineProperty(A, "baz", { get: function() { assertUnreachable(); }});
+
+B = Object.create(A);
+Object.defineProperty(B, "baz", { get: function() { return 111; }});
+
+C = Object.create(B);
+
+function boo(x) { return x.baz; }
+
+assertEquals(111, boo(C));
+assertEquals(111, boo(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(boo);
+assertEquals(111, boo(C));
+
+// And once more for setters...
+A = {};
+Object.defineProperty(A, "huh", { set: function(x) { assertUnreachable(); }});
+
+B = Object.create(A);
+var setterValue;
+Object.defineProperty(B, "huh", { set: function(x) { setterValue = x; }});
+
+C = Object.create(B);
+
+function fuu(x) {
+ setterValue = 222;
+ x.huh = 111;
+ return setterValue;
+}
+
+assertEquals(111, fuu(C));
+assertEquals(111, fuu(C));
+ToDictionaryMode(B);
+%OptimizeFunctionOnNextCall(fuu);
+assertEquals(111, fuu(C));
diff --git a/test/mjsunit/regress/regress-crbug-134055.js b/test/mjsunit/regress/regress-crbug-134055.js
new file mode 100644
index 0000000..9b658fb
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-134055.js
@@ -0,0 +1,63 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function crash(obj) {
+ return obj.foo;
+}
+
+function base(number_of_properties) {
+ var result = new Array();
+ for (var i = 0; i < number_of_properties; i++) {
+ result["property" + i] = "value" + i;
+ }
+ result.foo = number_of_properties;
+ return result;
+}
+
+var a = base(12);
+var b = base(13);
+var c = base(14);
+var d = base(15);
+
+crash(a); // Premonomorphic.
+crash(a);
+crash(b);
+crash(c);
+crash(d); // Polymorphic, degree 4.
+
+//Prepare ElementsKind transition map chain.
+var x = base(13);
+x[0] = "object";
+x = base(14);
+x[0] = "object";
+x = base(15);
+x[0] = "object";
+
+%OptimizeFunctionOnNextCall(crash);
+crash(a);
diff --git a/test/mjsunit/regress/regress-crbug-134609.js b/test/mjsunit/regress/regress-crbug-134609.js
new file mode 100644
index 0000000..da7d85d
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-134609.js
@@ -0,0 +1,59 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --inline-accessors
+
+var forceDeopt = {x:0};
+
+var objectWithGetterProperty = (function (value) {
+ var obj = {};
+ Object.defineProperty(obj, "getterProperty", {
+ get: function foo() {
+ forceDeopt.x;
+ return value;
+ },
+ });
+ return obj;
+})("bad");
+
+function test() {
+ var iAmContextAllocated = "good";
+ objectWithGetterProperty.getterProperty;
+ return iAmContextAllocated;
+
+ // Make sure that the local variable is context allocated.
+ function unused() { iAmContextAllocated; }
+}
+
+assertEquals("good", test());
+assertEquals("good", test());
+%OptimizeFunctionOnNextCall(test);
+assertEquals("good", test());
+
+// At this point, foo should have been inlined into test. Let's deopt...
+delete forceDeopt.x;
+assertEquals("good", test());
diff --git a/test/mjsunit/regress/regress-crbug-135008.js b/test/mjsunit/regress/regress-crbug-135008.js
new file mode 100644
index 0000000..2be396e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-135008.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "//" + new Array(1024).join('x');
+
+var scope = { x:23 };
+
+with(scope) {
+ eval(
+ "scope.f = (function outer() {" +
+ " function inner() {" +
+ " return x;" +
+ " }" +
+ " return inner;" +
+ "})();" +
+ filler
+ );
+};
+
+assertSame(23, scope.f());
diff --git a/test/mjsunit/regress/regress-crbug-135066.js b/test/mjsunit/regress/regress-crbug-135066.js
new file mode 100644
index 0000000..35e9ff8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-135066.js
@@ -0,0 +1,55 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "//" + new Array(1024).join('x');
+
+// Test strict eval in global context.
+assertEquals(23, eval(
+ "'use strict';" +
+ "var x = 23;" +
+ "var f = function bozo1() {" +
+ " return x;" +
+ "};" +
+ "assertSame(23, f());" +
+ "f;" +
+ filler
+)());
+
+// Test default eval in strict context.
+assertEquals(42, (function() {
+ "use strict";
+ return eval(
+ "var y = 42;" +
+ "var g = function bozo2() {" +
+ " return y;" +
+ "};" +
+ "assertSame(42, g());" +
+ "g;" +
+ filler
+ )();
+})());
diff --git a/test/mjsunit/regress/regress-crbug-137689.js b/test/mjsunit/regress/regress-crbug-137689.js
new file mode 100644
index 0000000..ef79d24
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-137689.js
@@ -0,0 +1,47 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function getter() { return 10; }
+function setter(v) { }
+function getter2() { return 20; }
+
+var o = {};
+var o2 = {};
+
+Object.defineProperty(o, "foo", { get: getter, configurable: true });
+Object.defineProperty(o2, "foo", { get: getter, configurable: true });
+assertTrue(%HaveSameMap(o, o2));
+
+Object.defineProperty(o, "bar", { get: getter2 });
+Object.defineProperty(o2, "bar", { get: getter2 });
+assertTrue(%HaveSameMap(o, o2));
+
+Object.defineProperty(o, "foo", { set: setter, configurable: true });
+Object.defineProperty(o2, "foo", { set: setter, configurable: true });
+assertTrue(%HaveSameMap(o, o2));
diff --git a/test/mjsunit/regress/regress-crbug-138887.js b/test/mjsunit/regress/regress-crbug-138887.js
new file mode 100644
index 0000000..8d8e169
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-138887.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function worker1(ignored) {
+ return 100;
+}
+
+function factory(worker) {
+ return function(call_depth) {
+ if (call_depth == 0) return 10;
+ return 1 + worker(call_depth - 1);
+ }
+}
+
+var f1 = factory(worker1);
+var f2 = factory(f1);
+assertEquals(11, f2(1)); // Result: 1 + f1(0) == 1 + 10.
+assertEquals(11, f2(1));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(10, f1(0)); // Terminates immediately -> returns 10.
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(102, f2(1000)); // 1 + f1(999) == 1 + 1 + worker1(998) == 102
diff --git a/test/mjsunit/regress/regress-crbug-140083.js b/test/mjsunit/regress/regress-crbug-140083.js
new file mode 100644
index 0000000..e38192c
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-140083.js
@@ -0,0 +1,44 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that the absence of a setter in a compound/count operation works.
+
+Object.defineProperty(Object.prototype, "foo",
+ { get: function() { return 123; } });
+
+function bar(o) {
+ o.foo += 42;
+ o.foo++;
+}
+
+var baz = {};
+bar(baz);
+bar(baz);
+%OptimizeFunctionOnNextCall(bar)
+bar(baz);
diff --git a/test/mjsunit/regress/regress-crbug-142087.js b/test/mjsunit/regress/regress-crbug-142087.js
new file mode 100644
index 0000000..881ca60
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-142087.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var string = "What are you looking for?";
+
+var expected_match = [""];
+for (var i = 0; i < string.length; i++) {
+ expected_match.push("");
+}
+
+string.replace(/(_)|(_|)/g, "");
+assertArrayEquals(expected_match, string.match(/(_)|(_|)/g, ""));
+
+'***************************************'.match(/((\\)|(\*)|(\$))/g, ".");
diff --git a/test/mjsunit/regress/regress-crbug-142218.js b/test/mjsunit/regress/regress-crbug-142218.js
new file mode 100644
index 0000000..373f83b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-142218.js
@@ -0,0 +1,44 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+length = 1 << 16;
+a = new Array(length);
+
+function insert_element(key) {
+ a[key] = 42;
+}
+
+insert_element(1);
+%OptimizeFunctionOnNextCall(insert_element);
+insert_element(new Object());
+count = 0;
+for (var i = 0; i < length; i++) {
+ if (a[i] != undefined) count++;
+}
+assertEquals(1, count);
diff --git a/test/mjsunit/regress/regress-crbug-145961.js b/test/mjsunit/regress/regress-crbug-145961.js
new file mode 100644
index 0000000..eb88945
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-145961.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// This test causes the operands to be passed in as Integer32 registers.
+// Flags: --allow-natives-syntax
+function test() {
+ var a = new Int32Array(2);
+ var x = a[0];
+ return Math.min(x, x);
+}
+
+assertEquals(0, test());
+assertEquals(0, test());
+%OptimizeFunctionOnNextCall(test);
+assertEquals(0, test());
diff --git a/test/mjsunit/regress/regress-crbug-146910.js b/test/mjsunit/regress/regress-crbug-146910.js
new file mode 100644
index 0000000..120f809
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-146910.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = [];
+assertSame(0, x.length);
+assertSame(undefined, x[0]);
+
+Object.defineProperty(x, '0', { value: 7, configurable: false });
+assertSame(1, x.length);
+assertSame(7, x[0]);
+
+x.length = 0;
+assertSame(1, x.length);
+assertSame(7, x[0]);
diff --git a/test/mjsunit/regress/regress-crbug-147475.js b/test/mjsunit/regress/regress-crbug-147475.js
new file mode 100644
index 0000000..180744c
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-147475.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function worker1(ignored) {
+ return 100;
+}
+
+function factory(worker) {
+ return function(call_depth) {
+ if (call_depth == 0) return 10;
+ return 1 + worker(call_depth - 1);
+ }
+}
+
+var f1 = factory(worker1);
+var f2 = factory(f1);
+assertEquals(11, f2(1));
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(10, f1(0));
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(102, f2(2));
+assertEquals(102, f2(2));
diff --git a/test/mjsunit/regress/regress-crbug-148376.js b/test/mjsunit/regress/regress-crbug-148376.js
new file mode 100644
index 0000000..55bb5f1
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-148376.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function defineSetter(o) {
+ o.__defineSetter__('property', function() {});
+}
+
+defineSetter(Object.prototype);
+property = 0;
+defineSetter(this);
+var keys = Object.keys(this);
diff --git a/test/mjsunit/regress/regress-crbug-150545.js b/test/mjsunit/regress/regress-crbug-150545.js
new file mode 100644
index 0000000..8238d2f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-150545.js
@@ -0,0 +1,55 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that we do not generate OSR entry points that have an arguments
+// stack height different from zero. The OSR machinery cannot generate
+// frames for that.
+
+(function() {
+ "use strict";
+
+ var instantReturn = false;
+ function inner() {
+ if (instantReturn) return;
+ assertSame(3, arguments.length);
+ assertSame(1, arguments[0]);
+ assertSame(2, arguments[1]);
+ assertSame(3, arguments[2]);
+ }
+
+ function outer() {
+ inner(1,2,3);
+ // Trigger OSR, if optimization is not disabled.
+ if (%GetOptimizationStatus(outer) != 4) {
+ while (%GetOptimizationCount(outer) == 0) {}
+ }
+ }
+
+ outer();
+})();
diff --git a/test/mjsunit/regress/regress-crbug-150729.js b/test/mjsunit/regress/regress-crbug-150729.js
new file mode 100644
index 0000000..15aa587
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-150729.js
@@ -0,0 +1,39 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var t = 0;
+function burn() {
+ i = [t, 1];
+ var M = [i[0], Math.cos(t) + i[7074959]];
+ t += .05;
+}
+for (var j = 0; j < 5; j++) {
+ if (j == 2) %OptimizeFunctionOnNextCall(burn);
+ burn();
+}
diff --git a/test/mjsunit/regress/regress-crbug-157019.js b/test/mjsunit/regress/regress-crbug-157019.js
new file mode 100644
index 0000000..1c54089
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-157019.js
@@ -0,0 +1,54 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --nocrankshaft
+
+function makeConstructor() {
+ return function() {
+ this.a = 1;
+ this.b = 2;
+ };
+}
+
+var c1 = makeConstructor();
+var o1 = new c1();
+
+c1.prototype = {};
+
+for (var i = 0; i < 10; i++) {
+ var o = new c1();
+ for (var j = 0; j < 8; j++) {
+ o["x" + j] = 0;
+ }
+}
+
+var c2 = makeConstructor();
+var o2 = new c2();
+
+for (var i = 0; i < 50000; i++) {
+ new c2();
+}
diff --git a/test/mjsunit/regress/regress-crbug-157520.js b/test/mjsunit/regress/regress-crbug-157520.js
new file mode 100644
index 0000000..17081df
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-157520.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --nocrankshaft
+
+(function(){
+ var f = function(arg) {
+ arg = 2;
+ return arguments[0];
+ };
+ for (var i = 0; i < 50000; i++) {
+ assertSame(2, f(1));
+ }
+})();
diff --git a/test/mjsunit/regress/regress-crbug-158185.js b/test/mjsunit/regress/regress-crbug-158185.js
new file mode 100644
index 0000000..5cb5900
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-158185.js
@@ -0,0 +1,38 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals("0023456",
+ Object.keys(JSON.parse('{"0023456": 1}'))[0]);
+assertEquals("1234567890123",
+ Object.keys(JSON.parse('{"1234567890123": 1}'))[0]);
+assertEquals("123456789ABCD",
+ Object.keys(JSON.parse('{"123456789ABCD": 1}'))[0]);
+assertEquals("12A",
+ Object.keys(JSON.parse('{"12A": 1}'))[0]);
+
+assertEquals(1, JSON.parse('{"0":1}')[0]);
+assertEquals(undefined, JSON.parse('{"00":1}')[0]);
diff --git a/test/mjsunit/regress/regress-crbug-160010.js b/test/mjsunit/regress/regress-crbug-160010.js
new file mode 100644
index 0000000..586bddd
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-160010.js
@@ -0,0 +1,35 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var str = "a";
+for (var i = 0; i < 28; i++) {
+ str += str;
+ %FlattenString(str); // Evil performance hack
+}
+JSON.stringify(str);
diff --git a/test/mjsunit/regress/regress-crbug-162085.js b/test/mjsunit/regress/regress-crbug-162085.js
new file mode 100644
index 0000000..a53b2c9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-162085.js
@@ -0,0 +1,71 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Ensure extending an empty packed smi array with a double initializes the
+// array with holes.
+var a = [1,2,3];
+a.length = 0;
+a[0] = 1.4;
+assertEquals(1.4, a[0]);
+assertEquals(undefined, a[1]);
+assertEquals(undefined, a[2]);
+assertEquals(undefined, a[3]);
+
+// Ensure the double array growstub initializes the array with holes.
+function grow_store(a,i,v) {
+ a[i] = v;
+}
+
+var a2 = [1.3];
+grow_store(a2,1,1.4);
+a2.length = 0;
+grow_store(a2,0,1.5);
+assertEquals(1.5, a2[0]);
+assertEquals(undefined, a2[1]);
+assertEquals(undefined, a2[2]);
+assertEquals(undefined, a2[3]);
+
+// Check storing objects using the double grow stub.
+var a3 = [1.3];
+var o = {};
+grow_store(a3, 1, o);
+assertEquals(1.3, a3[0]);
+assertEquals(o, a3[1]);
+
+// Ensure the double array growstub initializes the array with holes.
+function grow_store2(a,i,v) {
+ a[i] = v;
+}
+
+var a4 = [1.3];
+grow_store2(a4,1,1.4);
+a4.length = 0;
+grow_store2(a4,0,1);
+assertEquals(1, a4[0]);
+assertEquals(undefined, a4[1]);
+assertEquals(undefined, a4[2]);
+assertEquals(undefined, a4[3]);
diff --git a/test/mjsunit/regress/regress-crbug-163530.js b/test/mjsunit/regress/regress-crbug-163530.js
new file mode 100644
index 0000000..7abae14
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-163530.js
@@ -0,0 +1,80 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test materialization of an arguments object with unknown argument
+// values in non-strict mode (length has to be zero).
+(function() {
+ var deoptimize = { deopt:true };
+ var object = {};
+
+ object.a = function A(x, y, z) {
+ assertSame(0, arguments.length);
+ return this.b();
+ };
+
+ object.b = function B() {
+ assertSame(0, arguments.length);
+ deoptimize.deopt;
+ return arguments.length;
+ };
+
+ assertSame(0, object.a());
+ assertSame(0, object.a());
+ %OptimizeFunctionOnNextCall(object.a);
+ assertSame(0, object.a());
+ delete deoptimize.deopt;
+ assertSame(0, object.a());
+})();
+
+
+// Test materialization of an arguments object with unknown argument
+// values in strict mode (length is allowed to exceed stack size).
+(function() {
+ 'use strict';
+ var deoptimize = { deopt:true };
+ var object = {};
+
+ object.a = function A(x, y, z) {
+ assertSame(0, arguments.length);
+ return this.b(1, 2, 3, 4, 5, 6, 7, 8);
+ };
+
+ object.b = function B(a, b, c, d, e, f, g, h) {
+ assertSame(8, arguments.length);
+ deoptimize.deopt;
+ return arguments.length;
+ };
+
+ assertSame(8, object.a());
+ assertSame(8, object.a());
+ %OptimizeFunctionOnNextCall(object.a);
+ assertSame(8, object.a());
+ delete deoptimize.deopt;
+ assertSame(8, object.a());
+})();
diff --git a/test/mjsunit/regress/regress-crbug-168545.js b/test/mjsunit/regress/regress-crbug-168545.js
new file mode 100644
index 0000000..acc065e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-168545.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var o = {};
+Object.defineProperty(o, "length", { get: function() { throw "bail"; }});
+assertThrows("new Int16Array(o);");
+
+var a = [];
+Object.defineProperty(a, "0", { get: function() { throw "bail"; }});
+assertThrows("new Int16Array(a);");
diff --git a/test/mjsunit/regress/regress-crbug-170856.js b/test/mjsunit/regress/regress-crbug-170856.js
new file mode 100644
index 0000000..2e73b12
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-170856.js
@@ -0,0 +1,33 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+r = new RegExp("a");
+for (var i = 0; i < 100; i++) {
+ r["abc" + i] = i;
+}
+"zzzz".replace(r, "");
+assertEquals(0, r.lastIndex);
diff --git a/test/mjsunit/regress/regress-crbug-171715.js b/test/mjsunit/regress/regress-crbug-171715.js
new file mode 100644
index 0000000..309f50a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-171715.js
@@ -0,0 +1,88 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
+Debug = debug.Debug
+
+var error = null;
+var test = 0;
+
+function check_v(expected, exec_state, frame_id) {
+ assertEquals(expected, exec_state.frame(frame_id).evaluate('v').value());
+}
+
+function listener(event, exec_state, event_data, data) {
+ try {
+ if (event != Debug.DebugEvent.Break) return;
+ test++;
+ if (test == 1) {
+ check_v('inner0', exec_state, 0);
+ check_v('inner0', exec_state, 1);
+ check_v('outer', exec_state, 2);
+ assertArrayEquals(["a", "b", "c"],
+ exec_state.frame(0).evaluate('arguments').value());
+ } else if (test == 2) {
+ check_v('inner1', exec_state, 0);
+ check_v('inner1', exec_state, 1);
+ check_v('outer', exec_state, 2);
+ assertArrayEquals(["a", "b", "c"],
+ exec_state.frame(0).evaluate('arguments').value());
+ } else {
+ assertEquals(3, test);
+ check_v('inner2', exec_state, 0);
+ check_v('inner1', exec_state, 1);
+ check_v('inner1', exec_state, 2);
+ check_v('outer', exec_state, 3);
+ assertArrayEquals(["x", "y", "z"],
+ exec_state.frame(0).evaluate('arguments').value());
+ assertArrayEquals(["a", "b", "c"],
+ exec_state.frame(1).evaluate('arguments').value());
+ }
+ } catch (e) {
+ error = e;
+ }
+};
+
+Debug.setListener(listener);
+
+var v = 'outer';
+(function() { // Test 1 and 2
+ var v = 'inner0';
+ eval("debugger; var v = 'inner1'; debugger;");
+ assertEquals('inner1', v); // Overwritten by local eval.
+})("a", "b", "c");
+assertNull(error);
+
+(function() { // Test 3
+ var v = 'inner0'; // Local eval overwrites this value.
+ eval("var v = 'inner1'; " +
+ "(function() { var v = 'inner2'; debugger; })('x', 'y', 'z');");
+ assertEquals('inner1', v); // Overwritten by local eval.
+})("a", "b", "c");
+assertNull(error);
diff --git a/test/mjsunit/regress/regress-crbug-172345.js b/test/mjsunit/regress/regress-crbug-172345.js
new file mode 100644
index 0000000..711501c
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-172345.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f(a,i) {
+ return a[i];
+}
+
+f([1,2,3], "length");
+f([1,2,3], "length");
+f([1,2,3], 2);
diff --git a/test/mjsunit/regress/regress-crbug-173907.js b/test/mjsunit/regress/regress-crbug-173907.js
new file mode 100644
index 0000000..9f92fef
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-173907.js
@@ -0,0 +1,88 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var X = 1.1;
+var K = 0.5;
+
+var O = 0;
+var result = new Float64Array(2);
+
+function spill() {
+ try { } catch (e) { }
+}
+
+function buggy() {
+ var v = X;
+ var phi1 = v + K;
+ var phi2 = v - K;
+
+ spill(); // At this point initial values for phi1 and phi2 are spilled.
+
+ var xmm1 = v;
+ var xmm2 = v*v*v;
+ var xmm3 = v*v*v*v;
+ var xmm4 = v*v*v*v*v;
+ var xmm5 = v*v*v*v*v*v;
+ var xmm6 = v*v*v*v*v*v*v;
+ var xmm7 = v*v*v*v*v*v*v*v;
+ var xmm8 = v*v*v*v*v*v*v*v*v;
+
+ // All registers are blocked and phis for phi1 and phi2 are spilled because
+ // their left (incoming) value is spilled, there are no free registers,
+ // and phis themselves have only ANY-policy uses.
+
+ for (var x = 0; x < 2; x++) {
+ xmm1 += xmm1 * xmm6;
+ xmm2 += xmm1 * xmm5;
+ xmm3 += xmm1 * xmm4;
+ xmm4 += xmm1 * xmm3;
+ xmm5 += xmm1 * xmm2;
+
+ // Now swap values of phi1 and phi2 to create cycle between phis.
+ var t = phi1;
+ phi1 = phi2;
+ phi2 = t;
+ }
+
+ // Now we want to get values of phi1 and phi2. However we would like to
+ // do it in a way that does not produce any uses of phi1&phi2 that have
+ // a register beneficial policy. How? We just hide these uses behind phis.
+ result[0] = (O === 0) ? phi1 : phi2;
+ result[1] = (O !== 0) ? phi1 : phi2;
+}
+
+function test() {
+ buggy();
+ assertArrayEquals([X + K, X - K], result);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(buggy);
+test();
diff --git a/test/mjsunit/regress/regress-crbug-173907b.js b/test/mjsunit/regress/regress-crbug-173907b.js
new file mode 100644
index 0000000..4ecfd64
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-173907b.js
@@ -0,0 +1,88 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var X = 1.1;
+var K = 0.5;
+
+var O = 0;
+var result = new Float64Array(2);
+
+%NeverOptimizeFunction(spill);
+function spill() {
+}
+
+function buggy() {
+ var v = X;
+ var phi1 = v + K;
+ var phi2 = v - K;
+
+ spill(); // At this point initial values for phi1 and phi2 are spilled.
+
+ var xmm1 = v;
+ var xmm2 = v*v*v;
+ var xmm3 = v*v*v*v;
+ var xmm4 = v*v*v*v*v;
+ var xmm5 = v*v*v*v*v*v;
+ var xmm6 = v*v*v*v*v*v*v;
+ var xmm7 = v*v*v*v*v*v*v*v;
+ var xmm8 = v*v*v*v*v*v*v*v*v;
+
+ // All registers are blocked and phis for phi1 and phi2 are spilled because
+ // their left (incoming) value is spilled, there are no free registers,
+ // and phis themselves have only ANY-policy uses.
+
+ for (var x = 0; x < 2; x++) {
+ xmm1 += xmm1 * xmm6;
+ xmm2 += xmm1 * xmm5;
+ xmm3 += xmm1 * xmm4;
+ xmm4 += xmm1 * xmm3;
+ xmm5 += xmm1 * xmm2;
+
+ // Now swap values of phi1 and phi2 to create cycle between phis.
+ var t = phi1;
+ phi1 = phi2;
+ phi2 = t;
+ }
+
+ // Now we want to get values of phi1 and phi2. However we would like to
+ // do it in a way that does not produce any uses of phi1&phi2 that have
+ // a register beneficial policy. How? We just hide these uses behind phis.
+ result[0] = (O === 0) ? phi1 : phi2;
+ result[1] = (O !== 0) ? phi1 : phi2;
+}
+
+function test() {
+ buggy();
+ assertArrayEquals([X + K, X - K], result);
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(buggy);
+test();
diff --git a/test/mjsunit/regress/regress-crbug-173974.js b/test/mjsunit/regress/regress-crbug-173974.js
new file mode 100644
index 0000000..905bd60
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-173974.js
@@ -0,0 +1,36 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var count = "";
+ count[0] --;
+}
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-178790.js b/test/mjsunit/regress/regress-crbug-178790.js
new file mode 100644
index 0000000..25cc96b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-178790.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create a regexp in the form of a?a?...a? so that fully
+// traversing the entire graph would be prohibitively expensive.
+// This should not cause time out.
+var r1 = "";
+for (var i = 0; i < 1000; i++) {
+ r1 += "a?";
+}
+"test".match(RegExp(r1));
+
+var r2 = "";
+for (var i = 0; i < 100; i++) {
+ r2 += "(a?|b?|c?|d?|e?|f?|g?)";
+}
+"test".match(RegExp(r2));
+
+// Create a regexp in the form of ((..(a)a..)a.
+// Compiling it causes EatsAtLeast to reach the maximum
+// recursion depth possible with a given budget.
+// This should not cause a stack overflow.
+var r3 = "a";
+for (var i = 0; i < 1000; i++) {
+ r3 = "(" + r3 + ")a";
+}
+"test".match(RegExp(r3));
diff --git a/test/mjsunit/regress/regress-crbug-181422.js b/test/mjsunit/regress/regress-crbug-181422.js
new file mode 100644
index 0000000..52826f3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-181422.js
@@ -0,0 +1,32 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertArrayEquals(["\u00a0"], "ab\u00a0cd".match(/\s/));
+assertArrayEquals(["a", "b", "c", "d"], "ab\u00a0cd".match(/\S/g));
+
+assertArrayEquals(["\u00a0"], "\u2604b\u00a0cd".match(/\s/));
+assertArrayEquals(["\u2604", "b", "c", "d"], "\u2604b\u00a0cd".match(/\S/g));
diff --git a/test/mjsunit/regress/regress-crbug-18639.js b/test/mjsunit/regress/regress-crbug-18639.js
index 23e225a..6c8e6ad 100644
--- a/test/mjsunit/regress/regress-crbug-18639.js
+++ b/test/mjsunit/regress/regress-crbug-18639.js
@@ -27,8 +27,12 @@
// See http://crbug.com/18639
-toString = toString;
-__defineGetter__("z", (0).toLocaleString);
-z;
-z;
-((0).toLocaleString)();
+try {
+ toString = toString;
+ __defineGetter__("z", (0).toLocaleString);
+ z;
+ z;
+ ((0).toLocaleString)();
+} catch (e) {
+ assertInstanceof(e, TypeError);
+}
diff --git a/test/mjsunit/regress/regress-crbug-196583.js b/test/mjsunit/regress/regress-crbug-196583.js
new file mode 100644
index 0000000..c486158
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-196583.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = 1;
+a.__proto__.f = 1;
+a.__proto__.f = function() { return 1; }
+
+// Create some polymorphism.
+function B() {}
+B.prototype = {f: function() { return 2; }};
+var b = new B();
+function C() {}
+C.prototype = {g: "foo", f: function() { return 3; }};
+var c = new C();
+
+function crash(obj) {
+ return obj.f();
+}
+
+for (var i = 0; i < 2; i++) {
+ crash(a);
+ crash(b);
+ crash(c);
+}
+%OptimizeFunctionOnNextCall(crash);
+assertEquals(1, crash(a));
diff --git a/test/mjsunit/regress/regress-crbug-217858.js b/test/mjsunit/regress/regress-crbug-217858.js
new file mode 100644
index 0000000..e61cb9f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-217858.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --noanalyze_environment_liveness
+
+var r = /r/;
+function f() {
+ r[r] = function() {};
+}
+
+for (var i = 0; i < 300000; i++) {
+ f();
+}
diff --git a/test/mjsunit/regress/regress-crbug-222893.js b/test/mjsunit/regress/regress-crbug-222893.js
new file mode 100644
index 0000000..75e1728
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-222893.js
@@ -0,0 +1,64 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+// Flags: --turbo-deoptimization
+
+Debug = debug.Debug
+
+var error = null;
+var array = ["a", "b", "c"];
+
+function listener(event, exec_state, event_data, data) {
+ try {
+ if (event == Debug.DebugEvent.Break) {
+ assertArrayEquals(array,
+ exec_state.frame(0).evaluate('arguments').value());
+ }
+ } catch (e) {
+ error = e;
+ }
+};
+
+Debug.setListener(listener);
+
+
+function f(a, b) {
+ arguments;
+ debugger; // Arguments object is already materialized.
+}
+
+f.apply(this, array);
+f("a", "b", "c");
+assertNull(error);
+
+function g(a, b) {
+ debugger; // Arguments object is not yet materialized.
+}
+g.apply(this, array);
+g("a", "b", "c");
+assertNull(error);
diff --git a/test/mjsunit/regress/regress-crbug-229923.js b/test/mjsunit/regress/regress-crbug-229923.js
new file mode 100644
index 0000000..95c0ded
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-229923.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-externalize-string
+
+var slice = "slow path of JSON.stringify for sliced string".substring(1);
+assertEquals('"' + slice + '"', JSON.stringify(slice, null, 0));
+
+var parent = "external string turned into two byte";
+var slice_of_external = parent.substring(1);
+try {
+ // Turn the string to a two-byte external string, so that the sliced
+ // string looks like one-byte, but its parent is actually two-byte.
+ externalizeString(parent, true);
+} catch (e) { }
+assertEquals('"' + slice_of_external + '"',
+ JSON.stringify(slice_of_external, null, 0));
diff --git a/test/mjsunit/regress/regress-crbug-233737.js b/test/mjsunit/regress/regress-crbug-233737.js
new file mode 100644
index 0000000..38b44e0
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-233737.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = new Array(2);
+a[0] = 1;
+assertTrue(%HasFastSmiElements(a));
+assertTrue(%HasFastHoleyElements(a));
+
+function hole(i) {
+ return a[i] << 0;
+}
+
+assertEquals(1, hole(0));
+assertEquals(1, hole(0));
+%OptimizeFunctionOnNextCall(hole);
+assertEquals(0, hole(1));
diff --git a/test/mjsunit/regress/regress-crbug-240032.js b/test/mjsunit/regress/regress-crbug-240032.js
new file mode 100644
index 0000000..7ce95d3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-240032.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Generate closures in that live in new-space.
+function mk() {
+ return function() {};
+}
+assertInstanceof(mk(), Function);
+assertInstanceof(mk(), Function);
+
+// Setup constant function using above closures.
+var o = {};
+o.func = mk();
+
+// Optimize object comparison with new-space RHS.
+function cmp(o, f) {
+ return f === o.func;
+}
+assertTrue(cmp(o, o.func));
+assertTrue(cmp(o, o.func));
+%OptimizeFunctionOnNextCall(cmp);
+assertTrue(cmp(o, o.func));
diff --git a/test/mjsunit/regress/regress-crbug-242502.js b/test/mjsunit/regress/regress-crbug-242502.js
new file mode 100644
index 0000000..8ee7640
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-242502.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc --allow-natives-syntax
+
+function f() {
+ return 23;
+}
+
+function call(o) {
+ return o['']();
+}
+
+function test() {
+ var o1 = %ToFastProperties(Object.create({ foo:1 }, { '': { value:f }}));
+ var o2 = %ToFastProperties(Object.create({ bar:1 }, { '': { value:f }}));
+ var o3 = %ToFastProperties(Object.create({ baz:1 }, { '': { value:f }}));
+ var o4 = %ToFastProperties(Object.create({ qux:1 }, { '': { value:f }}));
+ var o5 = %ToFastProperties(Object.create({ loo:1 }, { '': { value:f }}));
+ // Called twice on o1 to turn monomorphic.
+ assertEquals(23, call(o1));
+ assertEquals(23, call(o1));
+ // Called on four other objects to turn megamorphic.
+ assertEquals(23, call(o2));
+ assertEquals(23, call(o3));
+ assertEquals(23, call(o4));
+ assertEquals(23, call(o5));
+ return o1;
+}
+
+// Fill stub cache with entries.
+test();
+
+// Clear stub cache during GC.
+gc();
+
+// Turn IC megamorphic again.
+var oboom = test();
+
+// Optimize with previously cleared stub cache.
+%OptimizeFunctionOnNextCall(call);
+assertEquals(23, call(oboom));
diff --git a/test/mjsunit/regress/regress-crbug-242870.js b/test/mjsunit/regress/regress-crbug-242870.js
new file mode 100644
index 0000000..7183375
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-242870.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f() {
+ return (non_const_true || true && g());
+}
+
+function g() {
+ for (;;) {}
+}
+
+assertTrue(f());
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/test/mjsunit/regress/regress-crbug-242924.js b/test/mjsunit/regress/regress-crbug-242924.js
new file mode 100644
index 0000000..68ad7c6
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-242924.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc --gc-global
+
+function f() {
+ return [,{}];
+}
+
+assertEquals([,{}], f());
+assertEquals([,{}], f());
+%OptimizeFunctionOnNextCall(f);
+assertEquals([,{}], f());
+gc();
+
+function g() {
+ return [[,1.5],{}];
+}
+
+assertEquals([[,1.5],{}], g());
+assertEquals([[,1.5],{}], g());
+%OptimizeFunctionOnNextCall(g);
+assertEquals([[,1.5],{}], g());
+gc();
diff --git a/test/mjsunit/regress/regress-crbug-243868.js b/test/mjsunit/regress/regress-crbug-243868.js
new file mode 100644
index 0000000..106d9cc
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-243868.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f(o) {
+ return (non_const_true && (o.val == null || false));
+}
+
+// Create an object with a constant function in another realm.
+var realm = Realm.create();
+var realmObject = Realm.eval(realm, "function g() {}; var o = { val:g }; o;")
+
+// Make the CompareNil IC in the function monomorphic.
+assertFalse(f(realmObject));
+assertFalse(f(realmObject));
+
+// Optimize the function containing the CompareNil IC.
+%OptimizeFunctionOnNextCall(f);
+assertFalse(f(realmObject));
diff --git a/test/mjsunit/regress/regress-crbug-244461.js b/test/mjsunit/regress/regress-crbug-244461.js
new file mode 100644
index 0000000..7b46548
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-244461.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --smi-only-arrays
+
+function foo(arg) {
+ var a = arg();
+ return a;
+}
+
+
+foo(Array);
+foo(Array);
+%OptimizeFunctionOnNextCall(foo);
+// Compilation of foo will crash without the bugfix for 244461
+foo(Array);
diff --git a/test/mjsunit/regress/regress-crbug-245424.js b/test/mjsunit/regress/regress-crbug-245424.js
new file mode 100644
index 0000000..005c8ba
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-245424.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom() {
+ var a = {
+ foo: "bar",
+ foo: "baz"
+ };
+ return a;
+}
+
+assertEquals("baz", boom().foo);
+assertEquals("baz", boom().foo);
+%OptimizeFunctionOnNextCall(boom);
+assertEquals("baz", boom().foo);
diff --git a/test/mjsunit/regress/regress-crbug-245480.js b/test/mjsunit/regress/regress-crbug-245480.js
new file mode 100644
index 0000000..43fa6ba
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-245480.js
@@ -0,0 +1,72 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+// Flags: --noalways-opt
+
+function isHoley(obj) {
+ if (%HasFastHoleyElements(obj)) return true;
+ return false;
+}
+
+function assertHoley(obj, name_opt) {
+ assertEquals(true, isHoley(obj), name_opt);
+}
+
+function assertNotHoley(obj, name_opt) {
+ assertEquals(false, isHoley(obj), name_opt);
+}
+
+function create_array(arg) {
+ return new Array(arg);
+}
+
+obj = create_array(0);
+assertNotHoley(obj);
+create_array(0);
+%OptimizeFunctionOnNextCall(create_array);
+obj = create_array(10);
+assertHoley(obj);
+
+// The code below would assert in debug or crash in release
+function f(length) {
+ return new Array(length)
+}
+
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+var a = f(10);
+
+function g(a) {
+ return a[0];
+}
+
+var b = [0];
+g(b);
+g(b);
+assertEquals(undefined, g(a));
diff --git a/test/mjsunit/regress/regress-crbug-258519.js b/test/mjsunit/regress/regress-crbug-258519.js
new file mode 100644
index 0000000..b2015a8
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-258519.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {
+ compare_null: function(x) { return null != x; },
+ kaboom: function() {}
+}
+
+function crash(x) {
+ var b = a;
+ b.compare_null(x) && b.kaboom();
+ return "ok";
+}
+
+assertEquals("ok", crash(null));
+assertEquals("ok", crash(null));
+%OptimizeFunctionOnNextCall(crash);
+// Used to throw: "TypeError: Cannot call method 'kaboom' of undefined".
+assertEquals("ok", crash(1));
diff --git a/test/mjsunit/regress/regress-crbug-259300.js b/test/mjsunit/regress/regress-crbug-259300.js
new file mode 100644
index 0000000..eac494a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-259300.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug;
+var listened = false;
+var recursion_depth = 0;
+
+function listener(event, exec_state, event_data, data) {
+ if (event == Debug.DebugEvent.Break) {
+ recursion_depth++;
+ var disable_break = (recursion_depth > 2);
+ for (var i = 0; i < exec_state.frameCount(); i++) {
+ exec_state.frame(i).evaluate("debugger", disable_break);
+ }
+ }
+ listened = true;
+}
+
+Debug.setListener(listener);
+eval("debugger");
+Debug.setListener(null);
+assertTrue(listened);
diff --git a/test/mjsunit/regress/regress-crbug-260345.js b/test/mjsunit/regress/regress-crbug-260345.js
new file mode 100644
index 0000000..75832ab
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-260345.js
@@ -0,0 +1,59 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var steps = 100000;
+var undefined_values = [undefined, "go on"];
+var null_values = [null, "go on"];
+
+function get_undefined_object(i) {
+ return undefined_values[(i / steps) | 0];
+}
+
+function test_undefined() {
+ var objects = 0;
+ for (var i = 0; i < 2 * steps; i++) {
+ undefined == get_undefined_object(i) && objects++;
+ }
+ return objects;
+}
+
+assertEquals(steps, test_undefined());
+
+
+function get_null_object(i) {
+ return null_values[(i / steps) | 0];
+}
+
+function test_null() {
+ var objects = 0;
+ for (var i = 0; i < 2 * steps; i++) {
+ null == get_null_object(i) && objects++;
+ }
+ return objects;
+}
+
+assertEquals(steps, test_null());
diff --git a/test/mjsunit/regress/regress-crbug-263276.js b/test/mjsunit/regress/regress-crbug-263276.js
new file mode 100644
index 0000000..05aa94c
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-263276.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var array1 = [];
+array1.foo = true;
+
+var array2 = [];
+array2.bar = true;
+
+function bad(array) {
+ array[array.length] = 1;
+}
+
+bad(array1);
+bad(array1);
+bad(array2); // Length is now 1.
+bad(array2); // Length is now 2.
+%OptimizeFunctionOnNextCall(bad);
+bad(array2); // Length is now 3.
+assertEquals(3, array2.length);
diff --git a/test/mjsunit/regress/regress-crbug-272564.js b/test/mjsunit/regress/regress-crbug-272564.js
new file mode 100644
index 0000000..5475298
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-272564.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function Bb(w) {
+ this.width = w;
+}
+
+function ce(a, b) {
+ "number" == typeof a && (a = (b ? Math.round(a) : a) + "px");
+ return a
+}
+
+function pe(a, b, c) {
+ if (b instanceof Bb) b = b.width;
+ a.width = ce(b, !0);
+}
+
+var a = new Bb(1);
+var b = new Bb(5);
+pe(a, b, 0);
+pe(a, b, 0);
+%OptimizeFunctionOnNextCall(pe);
+pe(a, b, 0);
diff --git a/test/mjsunit/regress/regress-crbug-274438.js b/test/mjsunit/regress/regress-crbug-274438.js
new file mode 100644
index 0000000..5d6817d
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-274438.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b) {
+ var x = { a:a };
+ switch(b) { case "string": }
+ var y = { b:b };
+ return y;
+}
+
+f("a", "b");
+f("a", "b");
+%OptimizeFunctionOnNextCall(f);
+f("a", "b");
+%SetAllocationTimeout(100, 0);
+var killer = f("bang", "bo" + "om");
+assertEquals("boom", killer.b);
diff --git a/test/mjsunit/regress/regress-crbug-280333.js b/test/mjsunit/regress/regress-crbug-280333.js
new file mode 100644
index 0000000..ca3fdc7
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-280333.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function funky() { return false; }
+var global;
+
+function foo(x, fun) {
+ var a = x + 1;
+ var b = x + 2; // Need another Simulate to fold the first one into.
+ global = true; // Need a side effect to deopt to.
+ if (fun()) {
+ return a;
+ }
+ return 0;
+}
+
+assertEquals(0, foo(1, funky));
+assertEquals(0, foo(1, funky));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(0, foo(1, funky));
+assertEquals(2, foo(1, function() { return true; }));
diff --git a/test/mjsunit/regress/regress-crbug-285355.js b/test/mjsunit/regress/regress-crbug-285355.js
new file mode 100644
index 0000000..ebd480a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-285355.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function inverted_index() {
+ return ~1;
+}
+
+%NeverOptimizeFunction(inverted_index);
+
+function crash(array) {
+ return array[~inverted_index()] = 2;
+}
+
+assertEquals(2, crash(new Array(1)));
+assertEquals(2, crash(new Array(1)));
+%OptimizeFunctionOnNextCall(crash)
+assertEquals(2, crash(new Array(1)));
diff --git a/test/mjsunit/regress/regress-crbug-305309.js b/test/mjsunit/regress/regress-crbug-305309.js
new file mode 100644
index 0000000..cd89bed
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-305309.js
@@ -0,0 +1,49 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function BadProto() {
+ this.constant_function = function() {};
+ this.one = 1;
+ this.two = 2;
+}
+var b1 = new BadProto();
+var b2 = new BadProto();
+
+function Ctor() {}
+Ctor.prototype = b1;
+var a = new Ctor();
+
+function Two(x) {
+ return x.two;
+}
+assertEquals(2, Two(a));
+assertEquals(2, Two(a));
+b2.constant_function = "no longer constant!";
+%OptimizeFunctionOnNextCall(Two);
+assertEquals(2, Two(a));
diff --git a/test/mjsunit/regress/regress-crbug-306220.js b/test/mjsunit/regress/regress-crbug-306220.js
new file mode 100644
index 0000000..a481ee9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-306220.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var CustomError = function(x) { this.x = x; };
+CustomError.prototype = new Error();
+CustomError.prototype.x = "prototype";
+
+Object.defineProperties(CustomError.prototype, {
+ 'message': {
+ 'get': function() { return this.x; }
+ }
+});
+
+assertEquals("Error: instance", String(new CustomError("instance")));
diff --git a/test/mjsunit/regress/regress-crbug-306851.js b/test/mjsunit/regress/regress-crbug-306851.js
new file mode 100644
index 0000000..77b711a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-306851.js
@@ -0,0 +1,52 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function Counter() {
+ this.value = 0;
+};
+
+Object.defineProperty(Counter.prototype, 'count', {
+ get: function() { return this.value; },
+ set: function(value) { this.value = value; }
+});
+
+var obj = new Counter();
+
+function bummer() {
+ obj.count++;
+ return obj.count;
+}
+
+assertEquals(1, bummer());
+assertEquals(2, bummer());
+assertEquals(3, bummer());
+%OptimizeFunctionOnNextCall(bummer);
+assertEquals(4, bummer());
+assertEquals(5, bummer());
+assertEquals(6, bummer());
diff --git a/test/mjsunit/regress/regress-crbug-309623.js b/test/mjsunit/regress/regress-crbug-309623.js
new file mode 100644
index 0000000..12473c7
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-309623.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var u = new Uint32Array(2);
+u[0] = 1;
+u[1] = 0xEE6B2800;
+
+var a = [0, 1, 2];
+a[0] = 0; // Kill the COW.
+assertTrue(%HasFastSmiElements(a));
+
+function foo(i) {
+ a[0] = u[i];
+ return a[0];
+}
+
+assertEquals(u[0], foo(0));
+assertEquals(u[0], foo(0));
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(u[1], foo(1));
diff --git a/test/mjsunit/regress/regress-crbug-315252.js b/test/mjsunit/regress/regress-crbug-315252.js
new file mode 100644
index 0000000..51454bf
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-315252.js
@@ -0,0 +1,61 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b, c) {
+ this.a = a;
+ this.b = b;
+ this.c = c;
+}
+var o3 = new f(1, 2, 3.5);
+var o4 = new f(1, 2.5, 3);
+var o1 = new f(1.5, 2, 3);
+var o2 = new f(1.5, 2, 3);
+function migrate(o) {
+ return o.a;
+}
+// Use migrate to stabilize o1, o2 and o4 in [double, double, smi].
+migrate(o4);
+migrate(o1);
+migrate(o2);
+function store_transition(o) {
+ o.d = 1;
+}
+// Optimize "store_transition" to transition from [double, double, smi] to
+// [double, double, smi, smi]. This adds a dependency on the
+// [double, double, smi] map.
+store_transition(o4);
+store_transition(o1);
+store_transition(o2);
+%OptimizeFunctionOnNextCall(store_transition);
+// Pass in a deprecated object of format [smi, smi, double]. This will migrate
+// the instance, forcing a merge with [double, double, smi], ending up with
+// [double, double, double], which deprecates [double, double, smi] and
+// deoptimizes all dependencies of [double, double, smi], including
+// store_transition itself.
+store_transition(o3);
diff --git a/test/mjsunit/regress/regress-crbug-3184.js b/test/mjsunit/regress/regress-crbug-3184.js
index ed78183..054668e 100644
--- a/test/mjsunit/regress/regress-crbug-3184.js
+++ b/test/mjsunit/regress/regress-crbug-3184.js
@@ -80,4 +80,3 @@
});
assertEquals("Test1 test1", "test1 test1".cap());
assertEquals("Test2 Test2", "test2 test2".cap(true));
-
diff --git a/test/mjsunit/regress/regress-crbug-318671.js b/test/mjsunit/regress/regress-crbug-318671.js
new file mode 100644
index 0000000..54a7d5e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-318671.js
@@ -0,0 +1,38 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function add(x, y) { return x + y; }
+
+print(add({ a: 1 }, "a"));
+print(add({ b: 1 }, "b"));
+print(add({ c: 1 }, "c"));
+
+%OptimizeFunctionOnNextCall(add);
+
+print(add("a", 1));
diff --git a/test/mjsunit/regress/regress-crbug-319835.js b/test/mjsunit/regress/regress-crbug-319835.js
new file mode 100644
index 0000000..48f871f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-319835.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+try {} catch(e) {} // No need to optimize the top level.
+
+var size = 0x20000;
+var a = new Float64Array(size);
+var training = new Float64Array(10);
+function store(a, index) {
+ var offset = 0x20000000;
+ for (var i = 0; i < 1; i++) {
+ a[index + offset] = 0xcc;
+ }
+}
+
+store(training, -0x20000000);
+store(training, -0x20000000 + 1);
+store(training, -0x20000000);
+store(training, -0x20000000 + 1);
+%OptimizeFunctionOnNextCall(store);
+
+// Segfault maybe?
+for (var i = -0x20000000; i < -0x20000000 + size; i++) {
+ store(a, i);
+}
diff --git a/test/mjsunit/regress/regress-crbug-319860.js b/test/mjsunit/regress/regress-crbug-319860.js
new file mode 100644
index 0000000..b81fb85
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-319860.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function read(a, index) {
+ var offset = 0x2000000;
+ var result;
+ for (var i = 0; i < 1; i++) {
+ result = a[index + offset];
+ }
+ return result;
+}
+
+var a = new Int8Array(0x2000001);
+read(a, 0);
+read(a, 0);
+%OptimizeFunctionOnNextCall(read);
+
+// Segfault maybe?
+for (var i = 0; i > -1000000; --i) {
+ read(a, i);
+}
diff --git a/test/mjsunit/regress/regress-crbug-320922.js b/test/mjsunit/regress/regress-crbug-320922.js
new file mode 100644
index 0000000..9ba759a
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-320922.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var string = "hello world";
+var expected = "Hello " + "world";
+function Capitalize() {
+ %_OneByteSeqStringSetChar(0, 0x48, string);
+}
+Capitalize();
+assertEquals(expected, string);
+Capitalize();
+assertEquals(expected, string);
+
+var twobyte = "\u20ACello world";
+
+function TwoByteCapitalize() {
+ %_TwoByteSeqStringSetChar(0, 0x48, twobyte);
+}
+TwoByteCapitalize();
+assertEquals(expected, twobyte);
+TwoByteCapitalize();
+assertEquals(expected, twobyte);
diff --git a/test/mjsunit/regress/regress-crbug-323942.js b/test/mjsunit/regress/regress-crbug-323942.js
new file mode 100644
index 0000000..15af494
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-323942.js
@@ -0,0 +1,57 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+// Function is defined on the prototype chain.
+var holder = { f: function() { return 42; } };
+var receiver = { };
+receiver.__proto__ = { };
+receiver.__proto__.__proto__ = holder;
+
+// Inline two levels.
+function h(o) { return o.f.apply(this, arguments); }
+function g(o) { return h(o); }
+
+// Collect type information for apply call.
+assertEquals(42, g(receiver));
+assertEquals(42, g(receiver));
+
+// Sneakily remove the function from the prototype chain.
+// The receiver map does not change.
+receiver.__proto__.__proto__ = {};
+
+// Lookup of o.f during graph creation fails.
+%OptimizeFunctionOnNextCall(g);
+
+assertThrows(function() { g(receiver); });
+
+// Put function back.
+receiver.__proto__.__proto__ = holder;
+assertEquals(42, g(receiver));
diff --git a/test/mjsunit/regress/regress-crbug-325225.js b/test/mjsunit/regress/regress-crbug-325225.js
new file mode 100644
index 0000000..798d548
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-325225.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function f1(a) {
+ a[0](0);
+}
+
+function do1() {
+ f1([f1]);
+}
+
+assertThrows(do1, TypeError);
+
+function f2(a) {
+ a[0](true);
+}
+
+function do2() {
+ f2([function(a) { return f2("undefined", typeof f2(42, 0)); }]);
+}
+
+assertThrows(do2, TypeError);
diff --git a/test/mjsunit/regress/regress-crbug-329709.js b/test/mjsunit/regress/regress-crbug-329709.js
new file mode 100644
index 0000000..c5316f3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-329709.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom(x) {
+ switch(x) {
+ case 1: return "one";
+ case 1500000000: return "non-smi int32";
+ default: return "default";
+ }
+}
+
+assertEquals("one", boom(1));
+assertEquals("one", boom(1));
+%OptimizeFunctionOnNextCall(boom)
+assertEquals("non-smi int32", boom(1500000000));
diff --git a/test/mjsunit/regress/regress-crbug-336148.js b/test/mjsunit/regress/regress-crbug-336148.js
new file mode 100644
index 0000000..8157c9f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-336148.js
@@ -0,0 +1,56 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ var a = 1;
+ if (true) return o.v && a;
+}
+
+f({});
+f({});
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f({ v: 1 }));
+
+
+function f1() { return 1 && 2; };
+function f2() { return 1 || 2; };
+function f3() { return 0 && 2; };
+function f4() { return 0 || 2; };
+
+function test() {
+ assertEquals(2, f1());
+ assertEquals(1, f2());
+ assertEquals(0, f3());
+ assertEquals(2, f4());
+}
+
+test();
+test();
+[f1, f2, f3, f4].forEach(function(f) { %OptimizeFunctionOnNextCall(f); });
+test();
diff --git a/test/mjsunit/regress/regress-crbug-340064.js b/test/mjsunit/regress/regress-crbug-340064.js
new file mode 100644
index 0000000..f2ab1d6
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-340064.js
@@ -0,0 +1,38 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(v) {
+ return v.length;
+}
+
+assertEquals(4, f("test"));
+assertEquals(4, f("test"));
+assertEquals(undefined, f(true));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(true));
diff --git a/test/mjsunit/regress/regress-crbug-344186.js b/test/mjsunit/regress/regress-crbug-344186.js
new file mode 100644
index 0000000..6486f38
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-344186.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = new Int32Array(100);
+var array = new Int32Array(128);
+function fun(base) {
+ array[base - 95] = 1;
+ array[base - 99] = 2;
+ array[base + 4] = 3;
+}
+fun(100);
+%OptimizeFunctionOnNextCall(fun);
+fun(0);
+
+for (var i = 0; i < dummy.length; i++) {
+ assertEquals(0, dummy[i]);
+}
diff --git a/test/mjsunit/regress/regress-crbug-345715.js b/test/mjsunit/regress/regress-crbug-345715.js
new file mode 100644
index 0000000..a375341
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-345715.js
@@ -0,0 +1,26 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = {y:1.5};
+a.y = 0;
+b = a.y;
+c = {y:{}};
+
+function f() {
+ return 1;
+}
+
+function g() {
+ var e = {y: b};
+ var d = {x:f()};
+ var d = {x:f()};
+ return [e, d];
+}
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+assertEquals(1, g()[1].x);
diff --git a/test/mjsunit/regress/regress-crbug-345820.js b/test/mjsunit/regress/regress-crbug-345820.js
new file mode 100644
index 0000000..bdd0af9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-345820.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code
+
+var __v_6 = {};
+__v_6 = new Int32Array(5);
+for (var i = 0; i < __v_6.length; i++) __v_6[i] = 0;
+
+function __f_7(N) {
+ for (var i = -1; i < N; i++) {
+ __v_6[i] = i;
+ }
+}
+__f_7(1);
+%OptimizeFunctionOnNextCall(__f_7);
+__f_7(__v_6.length);
diff --git a/test/mjsunit/regress/regress-crbug-346636.js b/test/mjsunit/regress/regress-crbug-346636.js
new file mode 100644
index 0000000..247f8be
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-346636.js
@@ -0,0 +1,31 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertSame(expected, found) {
+ if (found === expected) {
+ if (expected !== 0 || (1 / expected) == (1 / found)) return;
+ }
+ return;
+};
+
+function foo(x) {
+ return x.bar;
+}
+
+function getter1() {
+ assertSame(this, this);
+}
+var o1 = Object.defineProperty({}, "bar", { get: getter1 });
+foo(o1);
+foo(o1);
+
+function getter2() {
+ assertSame(this, this);
+}
+var o2 = Object.defineProperty({}, "bar", { get: getter2 });
+foo(o2);
+%OptimizeFunctionOnNextCall(foo);
+foo(o2);
diff --git a/test/mjsunit/regress/regress-crbug-347903.js b/test/mjsunit/regress/regress-crbug-347903.js
new file mode 100644
index 0000000..b5174da
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-347903.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --use-allocation-folding --verify-heap
+
+function f() {
+ var a = new Array(84632);
+ // Allocation folding will bail out trying to fold the elements alloc of
+ // array "b."
+ var b = new Array(84632);
+ var c = new Array(84632);
+ return [a, b, c];
+}
+f(); f();
+%OptimizeFunctionOnNextCall(f);
+for(var i = 0; i < 10; i++) {
+ f();
+}
diff --git a/test/mjsunit/regress/regress-crbug-349079.js b/test/mjsunit/regress/regress-crbug-349079.js
new file mode 100644
index 0000000..b1076ea
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-349079.js
@@ -0,0 +1,23 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function assertEquals(expected, found) {
+ return found === expected;
+};
+%NeverOptimizeFunction(assertEquals);
+
+function crash() {
+ var a = 1;
+ var b = -0;
+ var c = 1.5;
+ assertEquals(b, Math.max(b++, c++));
+ assertEquals(c, Math.min(b++, c++));
+ assertEquals(b, Math.max(b++, a++));
+}
+crash();
+crash();
+%OptimizeFunctionOnNextCall(crash);
+crash();
diff --git a/test/mjsunit/regress/regress-crbug-349465.js b/test/mjsunit/regress/regress-crbug-349465.js
new file mode 100644
index 0000000..335ea1e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-349465.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --debug-code --use-gvn
+
+function f(a, base) {
+ a[base] = 1;
+ a[base + 4] = 2;
+ a[base] = 3;
+}
+var a1 = new Array(1024);
+var a2 = new Array(128);
+f(a1, 1);
+f(a2, -2);
+%OptimizeFunctionOnNextCall(f);
+f(a1, -2);
diff --git a/test/mjsunit/regress/regress-crbug-349853.js b/test/mjsunit/regress/regress-crbug-349853.js
new file mode 100644
index 0000000..53af64c
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-349853.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = ["string"];
+function funky(array) { return array[0] = 1; }
+funky(a);
+
+function crash() {
+ var q = [0];
+ // The failing ASSERT was only triggered when compiling for OSR.
+ for (var i = 0; i < 100000; i++) {
+ funky(q);
+ }
+ q[0] = 0;
+ funky(q)
+}
+
+crash();
diff --git a/test/mjsunit/regress/regress-crbug-349878.js b/test/mjsunit/regress/regress-crbug-349878.js
new file mode 100644
index 0000000..5ed048f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-349878.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, b) {
+ a == b;
+}
+
+f({}, {});
+
+var a = { y: 1.5 };
+a.y = 777;
+var b = a.y;
+
+function h() {
+ var d = 1;
+ var e = 777;
+ while (d-- > 0) e++;
+ f(1, e);
+}
+
+var global;
+function g() {
+ global = b;
+ return h(b);
+}
+
+g();
+g();
+%OptimizeFunctionOnNextCall(g);
+g();
diff --git a/test/mjsunit/regress/regress-crbug-350434.js b/test/mjsunit/regress/regress-crbug-350434.js
new file mode 100644
index 0000000..8a9a8e5
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-350434.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --gc-global --noincremental-marking --allow-natives-syntax
+
+function Ctor() {
+ this.foo = 1;
+}
+
+var o = new Ctor();
+var p = new Ctor();
+
+
+function crash(o, timeout) {
+ var s = "4000111222"; // Outside Smi range.
+ %SetAllocationTimeout(100000, timeout);
+ // This allocates a heap number, causing a GC, triggering lazy deopt.
+ var end = s >>> 0;
+ s = s.substring(0, end);
+ // This creates a map dependency, which gives the GC a reason to trigger
+ // a lazy deopt when that map dies.
+ o.bar = 2;
+}
+
+crash(o, 100000);
+crash(o, 100000);
+crash(p, 100000);
+%OptimizeFunctionOnNextCall(crash);
+crash(o, 100000);
+o = null;
+p = null;
+crash({}, 0);
diff --git a/test/mjsunit/regress/regress-crbug-350864.js b/test/mjsunit/regress/regress-crbug-350864.js
new file mode 100644
index 0000000..510834b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-350864.js
@@ -0,0 +1,34 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var v0 = new WeakMap;
+var v1 = {};
+v0.set(v1, 1);
+var sym = Symbol();
+v1[sym] = 1;
+var symbols = Object.getOwnPropertySymbols(v1);
+assertArrayEquals([sym], symbols);
diff --git a/test/mjsunit/regress/regress-crbug-350867.js b/test/mjsunit/regress/regress-crbug-350867.js
new file mode 100644
index 0000000..d8b826c
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-350867.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f1(a, i) {
+ return a[i];
+}
+function f2(a, b, c, index) {
+ return f1(arguments, index);
+}
+
+f2(2, 3, 4, "foo");
+f2(2, 3, 4, "foo");
+assertEquals(11, f1([11, 22, 33], 0));
+assertEquals(22, f2(22, 33, 44, 0));
diff --git a/test/mjsunit/regress/regress-crbug-350890.js b/test/mjsunit/regress/regress-crbug-350890.js
new file mode 100644
index 0000000..b60a2aa
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-350890.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function set_length(a, l) {
+ a.length = l;
+}
+
+function test1() {
+ var l = {};
+ var a = Array(l);
+ set_length(a, 3);
+ set_length(a, 3);
+ assertEquals(3, a.length);
+}
+
+function test2() {
+ var a = [];
+ set_length(a, 10);
+ set_length(a, 10);
+ Object.freeze(a);
+ set_length(a, 3);
+ set_length(a, 3);
+ assertEquals(10, a.length);
+}
+
+function test3() {
+ var a = [2];
+ Object.defineProperty(a, "length", {value:2, writable: false});
+ %ToFastProperties(a);
+ set_length([], 10);
+ set_length([], 10);
+ set_length(a, 10);
+ set_length(a, 10);
+ assertEquals(2, a.length);
+}
+
+test1();
+test2();
+test3();
diff --git a/test/mjsunit/regress/regress-crbug-351262.js b/test/mjsunit/regress/regress-crbug-351262.js
new file mode 100644
index 0000000..a2f4ead
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-351262.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+for (var x in this) {};
+JSON.stringify(this);
diff --git a/test/mjsunit/regress/regress-crbug-351320.js b/test/mjsunit/regress/regress-crbug-351320.js
new file mode 100644
index 0000000..24fc641
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-351320.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --fold-constants
+
+var result = 0;
+var o1 = {};
+o2 = {y:1.5};
+o2.y = 0;
+o3 = o2.y;
+
+function crash() {
+ for (var i = 0; i < 10; i++) {
+ result += o1.x + o3.foo;
+ }
+}
+
+crash();
+%OptimizeFunctionOnNextCall(crash);
+crash();
diff --git a/test/mjsunit/regress/regress-crbug-351658.js b/test/mjsunit/regress/regress-crbug-351658.js
new file mode 100644
index 0000000..ae6b50e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-351658.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+try {
+ var f = eval("(function(){0 = y + y})");
+ %OptimizeFunctionOnNextCall(f);
+ f();
+ assertUnreachable();
+} catch(e) {
+ assertTrue(e instanceof ReferenceError);
+}
diff --git a/test/mjsunit/regress/regress-crbug-351787.js b/test/mjsunit/regress/regress-crbug-351787.js
new file mode 100644
index 0000000..74cabf2
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-351787.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var ab1 = new ArrayBuffer(8);
+ab1.__defineGetter__("byteLength", function() { return 1000000; });
+var ab2 = ab1.slice(800000, 900000);
+var array = new Uint8Array(ab2);
+for (var i = 0; i < array.length; i++) {
+ assertEquals(0, array[i]);
+}
+assertEquals(0, array.length);
+
+
+var ab3 = new ArrayBuffer(8);
+ab3.__defineGetter__("byteLength", function() { return 0xFFFFFFFC; });
+var aaa = new DataView(ab3);
+
+for (var i = 10; i < aaa.length; i++) {
+ aaa.setInt8(i, 0xcc);
+}
+assertEquals(8, aaa.byteLength);
+
+
+var a = new Int8Array(4);
+a.__defineGetter__("length", function() { return 0xFFFF; });
+var b = new Int8Array(a);
+for (var i = 0; i < b.length; i++) {
+ assertEquals(0, b[i]);
+}
+
+
+var ab4 = new ArrayBuffer(8);
+ab4.__defineGetter__("byteLength", function() { return 0xFFFFFFFC; });
+var aaaa = new Uint32Array(ab4);
+
+for (var i = 10; i < aaaa.length; i++) {
+ aaaa[i] = 0xcccccccc;
+}
+assertEquals(2, aaaa.length);
diff --git a/test/mjsunit/regress/regress-crbug-352058.js b/test/mjsunit/regress/regress-crbug-352058.js
new file mode 100644
index 0000000..e270d83
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-352058.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --check-elimination --stress-opt
+
+var v0 = this;
+var v2 = this;
+function f() {
+ v2 = [1.2, 2.3];
+ v0 = [12, 23];
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-352586.js b/test/mjsunit/regress/regress-crbug-352586.js
new file mode 100644
index 0000000..2210480
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-352586.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = {};
+
+function getter() {
+ do {
+ return a + 1;
+ } while (false);
+}
+
+a.__proto__ = Error("");
+a.__defineGetter__('message', getter);
+a.message;
diff --git a/test/mjsunit/regress/regress-crbug-352929.js b/test/mjsunit/regress/regress-crbug-352929.js
new file mode 100644
index 0000000..a5872c1
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-352929.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = new Int32Array(100);
+array = new Int32Array(100);
+var dummy2 = new Int32Array(100);
+
+array[-17] = 0;
+function fun(base,cond) {
+ array[base - 1] = 1;
+ array[base - 2] = 2;
+ if (cond) {
+ array[base - 4] = 3;
+ array[base - 5] = 4;
+ } else {
+ array[base - 6] = 5;
+ array[base - 100] = 777;
+ }
+}
+fun(5,true);
+fun(7,false);
+%OptimizeFunctionOnNextCall(fun);
+fun(7,false);
+
+for (var i = 0; i < dummy.length; i++) {
+ assertEquals(0, dummy[i]);
+}
+for (var i = 0; i < dummy2.length; i++) {
+ assertEquals(0, dummy2[i]);
+}
diff --git a/test/mjsunit/regress/regress-crbug-354391.js b/test/mjsunit/regress/regress-crbug-354391.js
new file mode 100644
index 0000000..e652bd3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-354391.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function load(a, i) {
+ return a[i];
+}
+
+function f2(a, b, c, d, index) {
+ return load(arguments, index);
+}
+
+f2(1, 2, 3, 4, "foo");
+f2(1, 2, 3, 4, "foo");
+load([11, 22, 33], 0);
+assertEquals(11, f2(11, 22, 33, 44, 0));
+
+%OptimizeFunctionOnNextCall(load);
+assertEquals(11, f2(11, 22, 33, 44, 0));
diff --git a/test/mjsunit/regress/regress-crbug-357052.js b/test/mjsunit/regress/regress-crbug-357052.js
new file mode 100644
index 0000000..7a58396
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-357052.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f() {
+ var str = "";
+ for (var i = 0; i < 30; i++) {
+ str += "abcdefgh12345678" + str;
+ }
+ return str;
+}
+assertThrows(f);
diff --git a/test/mjsunit/regress/regress-crbug-357137.js b/test/mjsunit/regress/regress-crbug-357137.js
new file mode 100644
index 0000000..a780426
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-357137.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var locals = "";
+for (var i = 0; i < 1024; i++) locals += "var v" + i + ";";
+eval("function f() {" + locals + "f();}");
+assertThrows("f()", RangeError);
diff --git a/test/mjsunit/regress/regress-crbug-357330.js b/test/mjsunit/regress/regress-crbug-357330.js
new file mode 100644
index 0000000..b3edf00
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-357330.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(foo) {
+ var g;
+ true ? (g = foo + 0) : g = null;
+ if (null != g) {}
+};
+
+f(1.4);
+f(1.4);
+%OptimizeFunctionOnNextCall(f);
+f(1.4);
diff --git a/test/mjsunit/regress/regress-crbug-374838.js b/test/mjsunit/regress/regress-crbug-374838.js
new file mode 100644
index 0000000..614b4d9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-374838.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() {
+ var a = [0];
+ result = 0;
+ for (var i = 0; i < 4; i++) {
+ result += a.length;
+ a.shift();
+ }
+ return result;
+}
+
+assertEquals(1, foo());
+assertEquals(1, foo());
+%OptimizeFunctionOnNextCall(foo);
+assertEquals(1, foo());
diff --git a/test/mjsunit/regress/regress-crbug-380512.js b/test/mjsunit/regress/regress-crbug-380512.js
new file mode 100644
index 0000000..af78ba7
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-380512.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() { [].lastIndexOf(42); }
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-381534.js b/test/mjsunit/regress/regress-crbug-381534.js
new file mode 100644
index 0000000..2aa3929
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-381534.js
@@ -0,0 +1,40 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var obj = {};
+
+function f(v) {
+ var v1 = -(4/3);
+ var v2 = 1;
+ var arr = new Array(+0, true, 0, -0, false, undefined, null, "0", obj, v1, -(4/3), -1.3333333333333, "str", v2, 1, false);
+ assertEquals(10, arr.lastIndexOf(-(4/3)));
+ assertEquals(9, arr.indexOf(-(4/3)));
+
+ assertEquals(10, arr.lastIndexOf(v));
+ assertEquals(9, arr.indexOf(v));
+
+ assertEquals(8, arr.lastIndexOf(obj));
+ assertEquals(8, arr.indexOf(obj));
+}
+
+function g(v, x, index) {
+ var arr = new Array({}, x-1.1, x-2, x-3.1);
+ assertEquals(index, arr.indexOf(0));
+ assertEquals(index, arr.lastIndexOf(0));
+
+ assertEquals(index, arr.indexOf(v));
+ assertEquals(index, arr.lastIndexOf(v));
+}
+
+f(-(4/3));
+f(-(4/3));
+%OptimizeFunctionOnNextCall(f);
+f(-(4/3));
+
+g(0, 2, 2);
+g(0, 3.1, 3);
+%OptimizeFunctionOnNextCall(g);
+g(0, 1.1, 1);
diff --git a/test/mjsunit/regress/regress-crbug-382143.js b/test/mjsunit/regress/regress-crbug-382143.js
new file mode 100644
index 0000000..9f37b2e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-382143.js
@@ -0,0 +1,16 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function A() {
+ Object.defineProperty(this, "x", { set: function () {}, get: function () {}});
+ this.a = function () { return 1; }
+}
+
+function B() {
+ A.apply( this );
+ this.a = function () { return 2; }
+}
+
+var b = new B();
+assertTrue(Object.getOwnPropertyDescriptor(b, "a").enumerable);
diff --git a/test/mjsunit/regress/regress-crbug-382513.js b/test/mjsunit/regress/regress-crbug-382513.js
new file mode 100644
index 0000000..59d2dca
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-382513.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo() { return [+0,false].indexOf(-(4/3)); }
+foo();
+foo();
+%OptimizeFunctionOnNextCall(foo);
+foo();
diff --git a/test/mjsunit/regress/regress-crbug-385002.js b/test/mjsunit/regress/regress-crbug-385002.js
new file mode 100644
index 0000000..34713e2
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-385002.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --stack-size=200 --allow-natives-syntax
+
+%Break(); // Schedule an interrupt that does not go away.
+
+function f() { f(); }
+assertThrows(f, RangeError);
+
+var locals = "";
+for (var i = 0; i < 1024; i++) locals += "var v" + i + ";";
+eval("function g() {" + locals + "f();}");
+assertThrows("g()", RangeError);
diff --git a/test/mjsunit/regress/regress-crbug-387031.js b/test/mjsunit/regress/regress-crbug-387031.js
new file mode 100644
index 0000000..77f52a9
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-387031.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+a = [1];
+b = [];
+a.__defineGetter__(0, function () {
+ b.length = 0xffffffff;
+});
+c = a.concat(b);
+for (var i = 0; i < 20; i++) {
+ assertEquals(undefined, (c[i]));
+}
diff --git a/test/mjsunit/regress/regress-crbug-387599.js b/test/mjsunit/regress/regress-crbug-387599.js
new file mode 100644
index 0000000..98750aa
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-387599.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-debug-as debug
+
+Debug = debug.Debug;
+Debug.setListener(function() {});
+
+function f() {
+ for (var i = 0; i < 100; i++) {
+ %OptimizeFunctionOnNextCall(f, "osr");
+ }
+}
+
+Debug.setBreakPoint(f, 0, 0);
+f();
+f();
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/regress-crbug-387636.js b/test/mjsunit/regress/regress-crbug-387636.js
new file mode 100644
index 0000000..1e50ace
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-387636.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ [].indexOf(0x40000000);
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-390918.js b/test/mjsunit/regress/regress-crbug-390918.js
new file mode 100644
index 0000000..4c202b3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-390918.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(scale) {
+ var arr = {a: 1.1};
+
+ for (var i = 0; i < 2; i++) {
+ arr[2 * scale] = 0;
+ }
+}
+
+f({});
+f({});
+%OptimizeFunctionOnNextCall(f);
+f(1004);
diff --git a/test/mjsunit/regress/regress-crbug-390925.js b/test/mjsunit/regress/regress-crbug-390925.js
new file mode 100644
index 0000000..24873df
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-390925.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var a = new Array();
+Object.freeze(a);
+assertThrows(function() { %LiveEditCheckAndDropActivations(a, true); });
diff --git a/test/mjsunit/regress/regress-crbug-393988.js b/test/mjsunit/regress/regress-crbug-393988.js
new file mode 100644
index 0000000..9543e1e
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-393988.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {};
+Error.captureStackTrace(o);
+Object.defineProperty(o, "stack", { value: 1 });
+assertEquals(1, o.stack);
diff --git a/test/mjsunit/regress/regress-crbug-401915.js b/test/mjsunit/regress/regress-crbug-401915.js
new file mode 100644
index 0000000..96dce04
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-401915.js
@@ -0,0 +1,20 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-debug-as debug
+
+Debug = debug.Debug;
+Debug.setListener(function() {});
+Debug.setBreakOnException();
+
+try {
+ try {
+ %DebugPushPromise(new Promise(function() {}));
+ } catch (e) {
+ }
+ throw new Error();
+} catch (e) {
+}
+
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/regress-crbug-403409.js b/test/mjsunit/regress/regress-crbug-403409.js
new file mode 100644
index 0000000..ffd100b
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-403409.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Array.prototype[0] = 777;
+var kElements = 10;
+
+var input_array = [];
+for (var i = 1; i < kElements; i++) {
+ input_array[i] = 0.5;
+}
+var output_array = input_array.concat(0.5);
+
+assertEquals(kElements + 1, output_array.length);
+assertEquals(777, output_array[0]);
+for (var j = 1; j < kElements; j++) {
+ assertEquals(0.5, output_array[j]);
+}
diff --git a/test/mjsunit/regress/regress-crbug-405491.js b/test/mjsunit/regress/regress-crbug-405491.js
new file mode 100644
index 0000000..b633781
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-405491.js
@@ -0,0 +1,5 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as 1
diff --git a/test/mjsunit/regress/regress-crbug-405517.js b/test/mjsunit/regress/regress-crbug-405517.js
new file mode 100644
index 0000000..36c3f4f
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-405517.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --gc-interval=203
+
+function f() {
+ var e = [0];
+ %PreventExtensions(e);
+ for (var i = 0; i < 4; i++) e.shift();
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-405922.js b/test/mjsunit/regress/regress-crbug-405922.js
new file mode 100644
index 0000000..9f76a86
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-405922.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-debug-as debug
+
+Debug = debug.Debug
+
+function listener(event, exec_state, event_data, data) {
+ try {
+ if (event == Debug.DebugEvent.Break) {
+ exec_state.prepareStep(Debug.StepAction.StepIn, 3);
+ }
+ } catch (e) {
+ }
+}
+
+Debug.setListener(listener);
+
+function f(x) {
+ if (x > 0) %_CallFunction(null, x-1, f);
+}
+
+debugger;
+f(2);
+
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/regress-crbug-407946.js b/test/mjsunit/regress/regress-crbug-407946.js
new file mode 100644
index 0000000..d5687cc
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-407946.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(n) { return [0].indexOf((n - n) + 0); }
+
+assertEquals(0, f(.1));
+assertEquals(0, f(.1));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(0, f(.1));
diff --git a/test/mjsunit/regress/regress-crbug-412203.js b/test/mjsunit/regress/regress-crbug-412203.js
new file mode 100644
index 0000000..f150859
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-412203.js
@@ -0,0 +1,36 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var b = [];
+b[10000] = 1;
+// Required to reproduce the bug.
+assertTrue(%HasDictionaryElements(b));
+
+var a1 = [1.5];
+b.__proto__ = a1;
+assertEquals(1.5, ([].concat(b))[0]);
+
+var a2 = new Int32Array(2);
+a2[0] = 3;
+b.__proto__ = a2
+assertEquals(3, ([].concat(b))[0]);
+
+function foo(x, y) {
+ var a = [];
+ a[10000] = 1;
+ assertTrue(%HasDictionaryElements(a));
+
+ a.__proto__ = arguments;
+ var c = [].concat(a);
+ for (var i = 0; i < arguments.length; i++) {
+ assertEquals(i + 2, c[i]);
+ }
+ assertEquals(undefined, c[arguments.length]);
+ assertEquals(undefined, c[arguments.length + 1]);
+}
+foo(2);
+foo(2, 3);
+foo(2, 3, 4);
diff --git a/test/mjsunit/regress/regress-crbug-412208.js b/test/mjsunit/regress/regress-crbug-412208.js
new file mode 100644
index 0000000..a194f85
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-412208.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var non_const_true = true;
+
+function f() {
+ return non_const_true || (f() = this);
+}
+
+assertTrue(f());
+assertTrue(f());
+%OptimizeFunctionOnNextCall(f);
+assertTrue(f());
diff --git a/test/mjsunit/regress/regress-crbug-412210.js b/test/mjsunit/regress/regress-crbug-412210.js
new file mode 100644
index 0000000..6ec7d62
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-412210.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(x) {
+ return (x ? "" >> 0 : "") + /a/;
+};
+
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-crbug-412215.js b/test/mjsunit/regress/regress-crbug-412215.js
new file mode 100644
index 0000000..ad926fc
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-412215.js
@@ -0,0 +1,33 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var dummy = {foo: "true"};
+
+var a = {y:0.5};
+a.y = 357;
+var b = a.y;
+
+var d;
+function f( ) {
+ d = 357;
+ return {foo: b};
+}
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+var x = f();
+
+// With the bug, x is now an invalid object; the code below
+// triggers a crash.
+
+function g(obj) {
+ return obj.foo.length;
+}
+
+g(dummy);
+g(dummy);
+%OptimizeFunctionOnNextCall(g);
+g(x);
diff --git a/test/mjsunit/regress/regress-crbug-412319.js b/test/mjsunit/regress/regress-crbug-412319.js
new file mode 100644
index 0000000..21386e3
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-412319.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function __f_6() {
+ var __v_7 = [0];
+ %PreventExtensions(__v_7);
+ for (var __v_6 = -2; __v_6 < 19; __v_6++) __v_7.shift();
+ __f_7(__v_7);
+}
+__f_6();
+__f_6();
+%OptimizeFunctionOnNextCall(__f_6);
+__f_6();
+function __f_7(__v_7) {
+ __v_7.push(Infinity);
+}
diff --git a/test/mjsunit/regress/regress-crbug-417508.js b/test/mjsunit/regress/regress-crbug-417508.js
new file mode 100644
index 0000000..589fb88
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-417508.js
@@ -0,0 +1,29 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function foo(x) {
+ var k = "value";
+ return x[k] = 1;
+}
+var obj = {};
+Object.defineProperty(obj, "value", {set: function(x) { throw "nope"; }});
+try { foo(obj); } catch(e) {}
+try { foo(obj); } catch(e) {}
+%OptimizeFunctionOnNextCall(foo);
+try { foo(obj); } catch(e) {}
+
+function bar(x) {
+ var k = "value";
+ return (x[k] = 1) ? "ok" : "nope";
+}
+var obj2 = {};
+Object.defineProperty(obj2, "value",
+ {set: function(x) { throw "nope"; return true; } });
+
+try { bar(obj2); } catch(e) {}
+try { bar(obj2); } catch(e) {}
+%OptimizeFunctionOnNextCall(bar);
+try { bar(obj2); } catch(e) {}
diff --git a/test/mjsunit/regress/regress-crbug-423687.js b/test/mjsunit/regress/regress-crbug-423687.js
new file mode 100644
index 0000000..6000352
--- /dev/null
+++ b/test/mjsunit/regress/regress-crbug-423687.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var json = '{"a":{"c":2.1,"d":0},"b":{"c":7,"1024":8}}';
+var data = JSON.parse(json);
+
+data.b.c++;
diff --git a/test/mjsunit/regress/regress-crbug-84186.js b/test/mjsunit/regress/regress-crbug-84186.js
deleted file mode 100644
index 865bf9e..0000000
--- a/test/mjsunit/regress/regress-crbug-84186.js
+++ /dev/null
@@ -1,41 +0,0 @@
-// Copyright 2011 the V8 project authors. All rights reserved.
-// Redistribution and use in source and binary forms, with or without
-// modification, are permitted provided that the following conditions are
-// met:
-//
-// * Redistributions of source code must retain the above copyright
-// notice, this list of conditions and the following disclaimer.
-// * Redistributions in binary form must reproduce the above
-// copyright notice, this list of conditions and the following
-// disclaimer in the documentation and/or other materials provided
-// with the distribution.
-// * Neither the name of Google Inc. nor the names of its
-// contributors may be used to endorse or promote products derived
-// from this software without specific prior written permission.
-//
-// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
-// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
-// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
-// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
-// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
-// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
-// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
-// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
-// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
-// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
-// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-
-// Test that the expected string is parsed in the json parser when the length
-// is so big that the string can't fit in new space, and it includes special
-// characters.
-
-var json = '{"key":"';
-var key = '';
-var expected = '';
-for(var i = 0; i < 60000; i++) {
- key = key + "TESTING" + i + "\\n";
- expected = expected + "TESTING" + i + "\n";
-}
-json = json + key + '"}';
-var out = JSON.parse(json);
-assertEquals(expected, out.key);
diff --git a/test/mjsunit/regress/regress-create-exception.js b/test/mjsunit/regress/regress-create-exception.js
index d3face9..440449c 100644
--- a/test/mjsunit/regress/regress-create-exception.js
+++ b/test/mjsunit/regress/regress-create-exception.js
@@ -25,7 +25,7 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --max-new-space-size=256
+// Flags: --max-semi-space-size=1
"use strict";
// Check for GC bug constructing exceptions.
diff --git a/test/mjsunit/regress/regress-debug-code-recompilation.js b/test/mjsunit/regress/regress-debug-code-recompilation.js
index 1a608b1..4723ec1 100644
--- a/test/mjsunit/regress/regress-debug-code-recompilation.js
+++ b/test/mjsunit/regress/regress-debug-code-recompilation.js
@@ -25,7 +25,8 @@
// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
-// Flags: --allow-natives-syntax --hydrogen-filter=Debug.setBreakPoint --expose-debug-as debug
+// Flags: --allow-natives-syntax --hydrogen-filter=Debug.setBreakPoint
+// Flags: --expose-debug-as debug
Debug = debug.Debug
diff --git a/test/mjsunit/regress/regress-debug-context-load.js b/test/mjsunit/regress/regress-debug-context-load.js
new file mode 100644
index 0000000..0b3c275
--- /dev/null
+++ b/test/mjsunit/regress/regress-debug-context-load.js
@@ -0,0 +1,8 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-debug-as debug
+
+Debug = debug.Debug;
+Debug.setListener(null);
diff --git a/test/mjsunit/regress/regress-debug-deopt-while-recompile.js b/test/mjsunit/regress/regress-debug-deopt-while-recompile.js
new file mode 100644
index 0000000..ce5220a
--- /dev/null
+++ b/test/mjsunit/regress/regress-debug-deopt-while-recompile.js
@@ -0,0 +1,85 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --turbo-deoptimization
+
+Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ try {
+ assertEquals("foo", exec_state.frame(0).evaluate("bar").value());
+ } catch (e) {
+ exception = e;
+ };
+ listened++;
+};
+
+var exception = null;
+var listened = 0;
+
+var f = function() {
+ var bar = "foo";
+ var baz = bar; // Break point should be here.
+ return bar;
+}
+
+var g = function() {
+ var bar = "foo";
+ var baz = bar; // Break point should be here.
+ return bar;
+}
+
+f();
+f();
+g();
+g();
+
+// Mark with builtin.
+%OptimizeFunctionOnNextCall(f);
+if (%IsConcurrentRecompilationSupported()) {
+ %OptimizeFunctionOnNextCall(g, "concurrent");
+}
+
+// Activate debugger.
+Debug.setListener(listener);
+
+ // Set break point.
+Debug.setBreakPoint(f, 2, 0);
+Debug.setBreakPoint(g, 2, 0);
+
+// Trigger break point.
+f();
+g();
+
+// Assert that break point is set at expected location.
+assertTrue(Debug.showBreakPoints(f).indexOf("[B0]var baz = bar;") > 0);
+assertTrue(Debug.showBreakPoints(g).indexOf("[B0]var baz = bar;") > 0);
+
+assertEquals(2, listened);
+assertNull(exception);
diff --git a/test/mjsunit/regress/regress-deep-proto.js b/test/mjsunit/regress/regress-deep-proto.js
new file mode 100644
index 0000000..5d2758c
--- /dev/null
+++ b/test/mjsunit/regress/regress-deep-proto.js
@@ -0,0 +1,45 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function poly(x) {
+ return x.foo;
+}
+
+var one = {foo: 0};
+var two = {foo: 0, bar: 1};
+var three = {bar: 0};
+three.__proto__ = {};
+three.__proto__.__proto__ = {};
+three.__proto__.__proto__.__proto__ = {};
+three.__proto__.__proto__.__proto__.__proto__ = {};
+three.__proto__.__proto__.__proto__.__proto__.__proto__ = {};
+
+for (var i = 0; i < 1e6; i++) {
+ poly(one);
+ poly(two);
+ poly(three);
+}
diff --git a/test/mjsunit/regress/regress-delete-empty-double.js b/test/mjsunit/regress/regress-delete-empty-double.js
new file mode 100644
index 0000000..f7af2b1
--- /dev/null
+++ b/test/mjsunit/regress/regress-delete-empty-double.js
@@ -0,0 +1,40 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+a = [1.1,2.2,3.3];
+a.length = 1;
+delete a[1];
+
+assertTrue(%HasFastDoubleElements(a));
+assertFalse(%HasFastHoleyElements(a));
+
+delete a[0];
+
+assertTrue(%HasFastDoubleElements(a));
+assertTrue(%HasFastHoleyElements(a));
diff --git a/test/mjsunit/regress/regress-deopt-gcb.js b/test/mjsunit/regress/regress-deopt-gcb.js
new file mode 100644
index 0000000..fed92b4
--- /dev/null
+++ b/test/mjsunit/regress/regress-deopt-gcb.js
@@ -0,0 +1,49 @@
+// Copyright 2011 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --expose-gc
+
+// This tests that we can correctly handle a GC immediately after a function
+// has been deoptimized, even when we have an activation of this function on
+// the stack.
+
+// Ensure that there is code objects before the code for the opt_me function.
+(function() { var a = 10; a++; })();
+
+function opt_me() {
+ deopt();
+}
+
+// Make sure we don't inline this function
+%NeverOptimizeFunction(deopt);
+function deopt() {
+ %DeoptimizeFunction(opt_me);
+ gc();
+}
+
+
+opt_me();
diff --git a/test/mjsunit/regress/regress-deopt-store-effect.js b/test/mjsunit/regress/regress-deopt-store-effect.js
new file mode 100644
index 0000000..59094d3
--- /dev/null
+++ b/test/mjsunit/regress/regress-deopt-store-effect.js
@@ -0,0 +1,82 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test deopt after generic store with effect context.
+var pro = { x : 1 }
+var a = {}
+a.__proto__ = pro
+delete pro.x
+
+function g(o) {
+ return 7 + (o.z = 1, 20);
+}
+
+g(a);
+g(a);
+%OptimizeFunctionOnNextCall(g);
+Object.defineProperty(pro, "z", {
+ set: function(v) { %DeoptimizeFunction(g); },
+ get: function() { return 20; }
+});
+
+assertEquals(27, g(a));
+
+// Test deopt after polymorphic as monomorphic store with effect context.
+
+var i = { z : 2, r : 1 }
+var j = { z : 2 }
+var p = { a : 10 }
+var pp = { a : 20, b : 1 }
+
+function bar(o, p) {
+ return 7 + (o.z = 1, p.a);
+}
+
+bar(i, p);
+bar(i, p);
+bar(j, p);
+%OptimizeFunctionOnNextCall(bar);
+assertEquals(27, bar(i, pp));
+
+// Test deopt after polymorphic store with effect context.
+
+var i = { r : 1, z : 2 }
+var j = { z : 2 }
+var p = { a : 10 }
+var pp = { a : 20, b : 1 }
+
+function bar1(o, p) {
+ return 7 + (o.z = 1, p.a);
+}
+
+bar1(i, p);
+bar1(i, p);
+bar1(j, p);
+%OptimizeFunctionOnNextCall(bar1);
+assertEquals(27, bar1(i, pp));
diff --git a/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js b/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
new file mode 100644
index 0000000..f12679a
--- /dev/null
+++ b/test/mjsunit/regress/regress-dictionary-to-fast-arguments.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a, b) {
+ for (var i = 10000; i > 0; i--) {
+ arguments[i] = 0;
+ }
+}
+
+f(1.5, 2.5);
diff --git a/test/mjsunit/regress/regress-double-property.js b/test/mjsunit/regress/regress-double-property.js
new file mode 100644
index 0000000..2ddb45b
--- /dev/null
+++ b/test/mjsunit/regress/regress-double-property.js
@@ -0,0 +1,9 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) {
+ return {0.1: a};
+}
+
+f();
diff --git a/test/mjsunit/regress/regress-embedded-cons-string.js b/test/mjsunit/regress/regress-embedded-cons-string.js
new file mode 100644
index 0000000..b08a942
--- /dev/null
+++ b/test/mjsunit/regress/regress-embedded-cons-string.js
@@ -0,0 +1,70 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --fold-constants --nodead-code-elimination
+// Flags: --expose-gc --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+function test(fun) {
+ fun();
+ fun();
+ // Mark for concurrent optimization.
+ %OptimizeFunctionOnNextCall(fun, "concurrent");
+ // Kick off recompilation.
+ fun();
+ // Tenure cons string after compile graph has been created.
+ gc();
+ // In the mean time, concurrent recompiling is still blocked.
+ assertUnoptimized(fun, "no sync");
+ // Let concurrent recompilation proceed.
+ %UnblockConcurrentRecompilation();
+ // Concurrent recompilation eventually finishes, embeds tenured cons string.
+ assertOptimized(fun, "sync");
+ // Visit embedded cons string during mark compact.
+ gc();
+}
+
+function f() {
+ return "abcdefghijklmn" + "123456789";
+}
+
+function g() {
+ return "abcdefghijklmn\u2603" + "123456789";
+}
+
+function h() {
+ return "abcdefghijklmn\u2603" + "123456789\u2604";
+}
+
+test(f);
+test(g);
+test(h);
diff --git a/test/mjsunit/regress/regress-empty-fixed-double-array.js b/test/mjsunit/regress/regress-empty-fixed-double-array.js
new file mode 100644
index 0000000..1db9e2b
--- /dev/null
+++ b/test/mjsunit/regress/regress-empty-fixed-double-array.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+function f(a, x) {
+ a.shift();
+ a[0] = x;
+}
+
+f([1], 1.1);
+f([1], 1.1);
+%OptimizeFunctionOnNextCall(f);
+f([1], 1.1);
diff --git a/test/mjsunit/regress/regress-enum-prop-keys-cache-size.js b/test/mjsunit/regress/regress-enum-prop-keys-cache-size.js
new file mode 100644
index 0000000..1227500
--- /dev/null
+++ b/test/mjsunit/regress/regress-enum-prop-keys-cache-size.js
@@ -0,0 +1,19 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --stress-compaction
+
+%SetAllocationTimeout(100000, 100000);
+
+var x = {};
+x.a = 1;
+x.b = 2;
+x = {};
+
+var y = {};
+y.a = 1;
+
+%SetAllocationTimeout(100000, 0);
+
+for (var z in y) { }
diff --git a/test/mjsunit/regress/regress-escape-preserve-smi-representation.js b/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
new file mode 100644
index 0000000..fd899d6
--- /dev/null
+++ b/test/mjsunit/regress/regress-escape-preserve-smi-representation.js
@@ -0,0 +1,34 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function deepEquals(a, b) {
+ if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; }
+ if (typeof a != typeof b) return false;
+ if (typeof a == "number") return isNaN(a) && isNaN(b);
+ if (typeof a !== "object" && typeof a !== "function") return false;
+ if (objectClass === "RegExp") { return (a.toString() === b.toString()); }
+ if (objectClass === "Function") return false;
+ if (objectClass === "Array") {
+ var elementsCount = 0;
+ if (a.length != b.length) { return false; }
+ for (var i = 0; i < a.length; i++) {
+ if (!deepEquals(a[i], b[i])) return false;
+ }
+ return true;
+ }
+}
+
+
+function __f_1(){
+ var __v_0 = [];
+ for(var i=0; i<2; i++){
+ __v_0.push([])
+ deepEquals(2, __v_0.length);
+ }
+}
+__f_1();
+%OptimizeFunctionOnNextCall(__f_1);
+__f_1();
diff --git a/test/mjsunit/regress/regress-et-clobbers-doubles.js b/test/mjsunit/regress/regress-et-clobbers-doubles.js
new file mode 100644
index 0000000..47fa479
--- /dev/null
+++ b/test/mjsunit/regress/regress-et-clobbers-doubles.js
@@ -0,0 +1,39 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+function t_smi(a) {
+ a[0] = 1.5;
+}
+
+t_smi([1,,3]);
+t_smi([1,,3]);
+t_smi([1,,3]);
+%OptimizeFunctionOnNextCall(t_smi);
+var ta = [1,,3];
+t_smi(ta);
+assertEquals([1.5,,3], ta);
diff --git a/test/mjsunit/regress/regress-fast-empty-string.js b/test/mjsunit/regress/regress-fast-empty-string.js
new file mode 100644
index 0000000..9b9fea9
--- /dev/null
+++ b/test/mjsunit/regress/regress-fast-empty-string.js
@@ -0,0 +1,13 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = {};
+o[""] = 1;
+var x = {__proto__:o};
+for (i = 0; i < 3; i++) {
+ o[""];
+}
+for (i = 0; i < 3; i++) {
+ assertEquals(undefined, o.x);
+}
diff --git a/test/mjsunit/regress/regress-fast-literal-transition.js b/test/mjsunit/regress/regress-fast-literal-transition.js
new file mode 100644
index 0000000..72110f5
--- /dev/null
+++ b/test/mjsunit/regress/regress-fast-literal-transition.js
@@ -0,0 +1,62 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --always-opt --expose-gc
+
+// Test that the elements kind of the boilerplate object is sufficiently
+// checked in LFastLiteral, so that unoptimized code can transition the
+// boilerplate. The --always-opt flag makes sure that optimized code is
+// not thrown away at deoptimization.
+
+// The switch statement in f() makes sure that f() is not inlined. If we
+// start inlining switch statements, we will still catch the bug on the
+// final --stress-opt run.
+
+function f(x) {
+ switch(x) {
+ case 1: return 1.4;
+ case 2: return 1.5;
+ case 3: return {};
+ default: gc();
+ }
+}
+
+function g(x) {
+ return [1.1, 1.2, 1.3, f(x)];
+}
+
+// Step 1: Optimize g() to contain a FAST_DOUBLE_ELEMENTS boilerplate.
+assertEquals([1.1, 1.2, 1.3, 1.4], g(1));
+assertEquals([1.1, 1.2, 1.3, 1.5], g(2));
+%OptimizeFunctionOnNextCall(g);
+
+// Step 2: Deoptimize g() and transition to FAST_ELEMENTS boilerplate.
+assertEquals([1.1, 1.2, 1.3, {}], g(3));
+
+// Step 3: Cause a GC while broken clone of boilerplate is on the heap,
+// hence causing heap verification to catch it.
+assertEquals([1.1, 1.2, 1.3, undefined], g(4));
diff --git a/test/mjsunit/regress/regress-force-constant-representation.js b/test/mjsunit/regress/regress-force-constant-representation.js
new file mode 100644
index 0000000..4ec2a6a
--- /dev/null
+++ b/test/mjsunit/regress/regress-force-constant-representation.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+// Test push double as tagged.
+var a = [{}];
+function f(a) {
+ a.push(Infinity);
+}
+
+f(a);
+f(a);
+f(a);
+%OptimizeFunctionOnNextCall(f);
+f(a);
+assertEquals([{}, Infinity, Infinity, Infinity, Infinity], a);
diff --git a/test/mjsunit/regress/regress-force-representation.js b/test/mjsunit/regress/regress-force-representation.js
new file mode 100644
index 0000000..8f6746b
--- /dev/null
+++ b/test/mjsunit/regress/regress-force-representation.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function optimize(crankshaft_test) {
+ crankshaft_test();
+ crankshaft_test();
+ %OptimizeFunctionOnNextCall(crankshaft_test);
+ crankshaft_test();
+}
+
+function f() {
+ var v1 = 0;
+ var v2 = -0;
+ var t = v2++;
+ v2++;
+ return Math.max(v2++, v1++);
+}
+
+optimize(f);
diff --git a/test/mjsunit/regress/regress-frame-details-null-receiver.js b/test/mjsunit/regress/regress-frame-details-null-receiver.js
new file mode 100644
index 0000000..ffe5fbb
--- /dev/null
+++ b/test/mjsunit/regress/regress-frame-details-null-receiver.js
@@ -0,0 +1,51 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+
+Debug = debug.Debug;
+var listened = false;
+
+function listener(event, exec_state, event_data, data) {
+ if (event == Debug.DebugEvent.Exception) {
+ for (var i = 0; i < exec_state.frameCount(); i++) {
+ print(exec_state.frame(i).receiver());
+ print(exec_state.frame(i).func().name());
+ }
+ }
+ listened = true;
+}
+
+Debug.setListener(listener);
+Debug.setBreakOnException();
+
+assertThrows(function() { delete null['foo']; });
+
+Debug.clearBreakOnException();
+Debug.setListener(null);
+
+assertTrue(listened);
diff --git a/test/mjsunit/regress/regress-freeze-setter.js b/test/mjsunit/regress/regress-freeze-setter.js
new file mode 100644
index 0000000..c5ac986
--- /dev/null
+++ b/test/mjsunit/regress/regress-freeze-setter.js
@@ -0,0 +1,7 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+Object.defineProperty(this, 'x', {set: function() { }});
+Object.freeze(this);
+eval('"use strict"; x = 20;');
diff --git a/test/mjsunit/regress/regress-freeze.js b/test/mjsunit/regress/regress-freeze.js
new file mode 100644
index 0000000..6f3de2a
--- /dev/null
+++ b/test/mjsunit/regress/regress-freeze.js
@@ -0,0 +1,46 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// CountOperation
+function f(o) { o.x++ };
+var o = {x: 5};
+Object.freeze(o);
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+f(o);
+assertEquals(5, o.x);
+
+// Compound Assignment
+function f2(o) { o.x+=3 };
+f2(o);
+f2(o);
+%OptimizeFunctionOnNextCall(f2);
+f2(o);
+assertEquals(5, o.x);
diff --git a/test/mjsunit/regress/regress-function-constructor-receiver.js b/test/mjsunit/regress/regress-function-constructor-receiver.js
new file mode 100644
index 0000000..f345435
--- /dev/null
+++ b/test/mjsunit/regress/regress-function-constructor-receiver.js
@@ -0,0 +1,17 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Return the raw CallSites array.
+Error.prepareStackTrace = function (a,b) { return b; };
+
+var threw = false;
+try {
+ new Function({toString:0,valueOf:0});
+} catch (e) {
+ threw = true;
+ // Ensure that the receiver during "new Function" is the global proxy.
+ assertEquals(this, e.stack[0].getThis());
+}
+
+assertTrue(threw);
diff --git a/test/mjsunit/regress/regress-function-length-strict.js b/test/mjsunit/regress/regress-function-length-strict.js
new file mode 100644
index 0000000..700f34a
--- /dev/null
+++ b/test/mjsunit/regress/regress-function-length-strict.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that the length property of a function is read-only in strict mode.
+
+"use strict";
+
+function foo(a, b, c) {
+ return b;
+}
+
+var desc = Object.getOwnPropertyDescriptor(foo, 'length');
+assertEquals(3, desc.value);
+assertFalse(desc.writable);
+assertFalse(desc.enumerable);
+assertFalse(desc.configurable);
+assertThrows(function() { foo.length = 2; }, TypeError);
diff --git a/test/mjsunit/regress/regress-grow-deopt.js b/test/mjsunit/regress/regress-grow-deopt.js
new file mode 100644
index 0000000..df3a83f
--- /dev/null
+++ b/test/mjsunit/regress/regress-grow-deopt.js
@@ -0,0 +1,16 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(a, v) {
+ a[a.length] = v;
+}
+
+var a = [1.4];
+f(a, 1);
+f(a, 2);
+%OptimizeFunctionOnNextCall(f);
+f(a, {});
+assertEquals(4, a.length);
diff --git a/test/mjsunit/regress/regress-grow-store-smi-check.js b/test/mjsunit/regress/regress-grow-store-smi-check.js
new file mode 100644
index 0000000..381141d
--- /dev/null
+++ b/test/mjsunit/regress/regress-grow-store-smi-check.js
@@ -0,0 +1,53 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// The below test function was generated from part of a WebKit layout
+// test library setup routine: fast/canvas/webgl/resources/pnglib.js
+
+function test(crc32) {
+ for (var i = 0; i < 256; i++) {
+ var c = i;
+ for (var j = 0; j < 8; j++) {
+ if (c & 1) {
+ c = -306674912 ^ ((c >> 1) & 0x7fffffff);
+ } else {
+ c = (c >> 1) & 0x7fffffff;
+ }
+ }
+ crc32[i] = c;
+ }
+}
+
+var a = [0.5];
+for (var i = 0; i < 256; ++i) a[i] = i;
+
+test([0.5]);
+test(a);
+%OptimizeFunctionOnNextCall(test);
+test(a);
diff --git a/test/mjsunit/regress/regress-gvn-ftt.js b/test/mjsunit/regress/regress-gvn-ftt.js
new file mode 100644
index 0000000..d2cb443
--- /dev/null
+++ b/test/mjsunit/regress/regress-gvn-ftt.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --track-field-types --use-gvn
+
+function A(id) {
+ this.id = id;
+}
+
+var a1 = new A(1);
+var a2 = new A(2);
+
+
+var g;
+function f(o, value) {
+ g = o.o;
+ o.o = value;
+ return o.o;
+}
+
+var obj = {o: a1};
+
+f(obj, a1);
+f(obj, a1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(a2.id, f(obj, a2).id);
diff --git a/test/mjsunit/regress/regress-handle-illegal-redeclaration.js b/test/mjsunit/regress/regress-handle-illegal-redeclaration.js
new file mode 100644
index 0000000..fe04ddb
--- /dev/null
+++ b/test/mjsunit/regress/regress-handle-illegal-redeclaration.js
@@ -0,0 +1,15 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --always-opt
+
+var x = 0;
+
+function f() {
+ const c;
+ var c;
+ return 0 + x;
+}
+
+assertThrows(f);
diff --git a/test/mjsunit/regress/regress-hoist-load-named-field.js b/test/mjsunit/regress/regress-hoist-load-named-field.js
new file mode 100644
index 0000000..7df07a0
--- /dev/null
+++ b/test/mjsunit/regress/regress-hoist-load-named-field.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Load fields should not be hoisted beyond their check maps when the check maps
+// cannot be hoisted due to changes in elements kinds.
+function f(o, a) {
+ var v;
+ var i = 1;
+ while (i < 2) {
+ v = o.y;
+ a[0] = 1.5;
+ i++;
+ }
+ return v;
+}
+
+f({y:1.4}, [1]);
+f({y:1.6}, [1]);
+%OptimizeFunctionOnNextCall(f);
+f({x:1}, [1]);
+
+// Polymorphic loads should not be hoisted beyond their compare maps.
+function f2(o) {
+ var i = 0;
+ var v;
+ while (i < 1) {
+ v = o.x;
+ i++;
+ }
+ return v;
+}
+
+var o1 = { x: 1.5 };
+var o2 = { y: 1, x: 1 };
+
+f2(o1);
+f2(o1);
+f2(o2);
+%OptimizeFunctionOnNextCall(f2);
+f2(o2);
diff --git a/test/mjsunit/regress/regress-inline-constant-load.js b/test/mjsunit/regress/regress-inline-constant-load.js
new file mode 100644
index 0000000..303639c
--- /dev/null
+++ b/test/mjsunit/regress/regress-inline-constant-load.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+var o2 = {};
+
+function foo(x) {
+ return x.bar;
+}
+
+Object.defineProperty(o1, "bar", {value:200});
+foo(o1);
+foo(o1);
+
+function f(b) {
+ var o = o2;
+ if (b) { return foo(o) }
+}
+
+f(false);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(undefined, f(false));
+Object.defineProperty(o2, "bar", {value: 100});
+assertEquals(100, f(true));
diff --git a/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js b/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
new file mode 100644
index 0000000..d459a7a
--- /dev/null
+++ b/test/mjsunit/regress/regress-inline-getter-near-stack-limit.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+//
+// Flags: --allow-natives-syntax
+
+function runNearStackLimit(f) {
+ function t() {
+ try { t(); } catch(e) { f(); }
+ };
+ try { t(); } catch(e) {}
+}
+
+function g(x) { return x.bar; }
+function f1() { }
+function f2() { }
+
+var x = Object.defineProperty({}, "bar", { get: f1 });
+g(x);
+g(x);
+var y = Object.defineProperty({}, "bar", { get: f2 });
+g(y);
+%OptimizeFunctionOnNextCall(g);
+runNearStackLimit(function() { g(y); });
diff --git a/test/mjsunit/regress/regress-int32-truncation.js b/test/mjsunit/regress/regress-int32-truncation.js
new file mode 100644
index 0000000..dec4ac1
--- /dev/null
+++ b/test/mjsunit/regress/regress-int32-truncation.js
@@ -0,0 +1,61 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(i, b) {
+ var a = 0;
+ if (b) {
+ var c = 1 << i;
+ a = c + c;
+ }
+ var x = a >> 3;
+ return a;
+}
+
+f(1, false);
+f(1, true);
+%OptimizeFunctionOnNextCall(f);
+assertEquals((1 << 30) * 2, f(30, true));
+
+
+var global = 1;
+
+function f2(b) {
+ var a = 0;
+ if (b) {
+ a = global;
+ }
+ var x = a >> 3;
+ return a;
+}
+
+f2(false);
+f2(true);
+%OptimizeFunctionOnNextCall(f2);
+global = 2.5;
+assertEquals(global, f2(true));
diff --git a/test/mjsunit/regress/regress-is-contextual.js b/test/mjsunit/regress/regress-is-contextual.js
new file mode 100644
index 0000000..844f4a2
--- /dev/null
+++ b/test/mjsunit/regress/regress-is-contextual.js
@@ -0,0 +1,41 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// CallIC accumulates feedback that string index is out of bounds, then
+// misses
+function foo(index) {
+ return text.charAt(index);
+}
+
+var text = "hi there";
+foo(0);
+foo(0);
+foo(100); // Accumulate feedback that index is out of bounds.
+text = false;
+
+// This line ASSERTS in debug without fix.
+assertThrows(function () { foo(); }, TypeError);
diff --git a/test/mjsunit/regress/regress-is-smi-repr.js b/test/mjsunit/regress/regress-is-smi-repr.js
new file mode 100644
index 0000000..e9f2b51
--- /dev/null
+++ b/test/mjsunit/regress/regress-is-smi-repr.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+
+var global;
+
+function g() { global = this; }
+Object.defineProperty(Number.prototype, "prop", { get: g });
+function f(s) { s.prop; }
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(1);
diff --git a/test/mjsunit/regress/regress-iteration-order.js b/test/mjsunit/regress/regress-iteration-order.js
new file mode 100644
index 0000000..76f5c3f
--- /dev/null
+++ b/test/mjsunit/regress/regress-iteration-order.js
@@ -0,0 +1,42 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var x = {a: 1, b: 2, c: 3};
+
+x.__proto__ = {};
+
+delete x.b;
+
+x.d = 4;
+
+s = "";
+
+for (key in x) {
+ s += x[key];
+}
+
+assertEquals("134", s);
diff --git a/test/mjsunit/regress/regress-json-parse-index.js b/test/mjsunit/regress/regress-json-parse-index.js
new file mode 100644
index 0000000..d1a785a
--- /dev/null
+++ b/test/mjsunit/regress/regress-json-parse-index.js
@@ -0,0 +1,6 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o = JSON.parse('{"\\u0030":100}');
+assertEquals(100, o[0]);
diff --git a/test/mjsunit/regress/regress-json-stringify-gc.js b/test/mjsunit/regress/regress-json-stringify-gc.js
new file mode 100644
index 0000000..905ab40
--- /dev/null
+++ b/test/mjsunit/regress/regress-json-stringify-gc.js
@@ -0,0 +1,51 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var a = [];
+var new_space_string = "a";
+for (var i = 0; i < 8; i++) {
+ new_space_string += new_space_string;
+}
+for (var i = 0; i < 10000; i++) a.push(new_space_string);
+
+// At some point during the first stringify, allocation causes a GC and
+// new_space_string is moved to old space. Make sure that this does not
+// screw up reading from the correct location.
+json1 = JSON.stringify(a);
+json2 = JSON.stringify(a);
+assertTrue(json1 == json2, "GC caused JSON.stringify to fail.");
+
+// Check that the slow path of JSON.stringify works correctly wrt GC.
+for (var i = 0; i < 10000; i++) {
+ var s = i.toString();
+ assertEquals('"' + s + '"', JSON.stringify(s, null, 0));
+}
+
+for (var i = 0; i < 10000; i++) {
+ var s = i.toString() + "\u2603";
+ assertEquals('"' + s + '"', JSON.stringify(s, null, 0));
+}
diff --git a/test/mjsunit/regress/regress-keyed-access-string-length.js b/test/mjsunit/regress/regress-keyed-access-string-length.js
new file mode 100644
index 0000000..f2ead68
--- /dev/null
+++ b/test/mjsunit/regress/regress-keyed-access-string-length.js
@@ -0,0 +1,37 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(i) {
+ return "abc"[i];
+}
+
+f("length");
+f("length");
+%OptimizeFunctionOnNextCall(f);
+f("length");
diff --git a/test/mjsunit/regress/regress-keyed-store-global.js b/test/mjsunit/regress/regress-keyed-store-global.js
new file mode 100644
index 0000000..1b12777
--- /dev/null
+++ b/test/mjsunit/regress/regress-keyed-store-global.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --verify-heap
+function f(a) {
+ for (var i = 0; i < 256; i++) a[i] = i;
+}
+
+f([]);
+f([]);
+f(this);
diff --git a/test/mjsunit/regress/regress-latin-1.js b/test/mjsunit/regress/regress-latin-1.js
new file mode 100644
index 0000000..e7f3136
--- /dev/null
+++ b/test/mjsunit/regress/regress-latin-1.js
@@ -0,0 +1,91 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+assertEquals(String.fromCharCode(97, 220, 256), 'a' + '\u00DC' + '\u0100');
+assertEquals(String.fromCharCode(97, 220, 256), 'a\u00DC\u0100');
+
+assertEquals(0x80, JSON.stringify("\x80").charCodeAt(1));
+assertEquals(0x80, JSON.stringify("\x80", 0, null).charCodeAt(1));
+
+assertEquals(['a', 'b', '\xdc'], ['b', '\xdc', 'a'].sort());
+
+assertEquals(['\xfc\xdc', '\xfc'], new RegExp('(\xdc)\\1', 'i').exec('\xfc\xdc'));
+// Same test but for all values in Latin-1 range.
+var total_lo = 0;
+for (var i = 0; i < 0xff; i++) {
+ var base = String.fromCharCode(i);
+ var escaped = base;
+ if (base == '(' || base == ')' || base == '*' || base == '+' ||
+ base == '?' || base == '[' || base == ']' || base == '\\' ||
+ base == '$' || base == '^' || base == '|') {
+ escaped = '\\' + base;
+ }
+ var lo = String.fromCharCode(i + 0x20);
+ base_result = new RegExp('(' + escaped + ')\\1', 'i').exec(base + base);
+ assertEquals( base_result, [base + base, base]);
+ lo_result = new RegExp('(' + escaped + ')\\1', 'i').exec(base + lo);
+ if (base.toLowerCase() == lo) {
+ assertEquals([base + lo, base], lo_result);
+ total_lo++;
+ } else {
+ assertEquals(null, lo_result);
+ }
+}
+// Should have hit the branch for the following char codes:
+// [A-Z], [192-222] but not 215
+assertEquals((90-65+1)+(222-192-1+1), total_lo);
+
+// Latin-1 whitespace character
+assertEquals( 1, +(String.fromCharCode(0xA0) + '1') );
+
+// Latin-1 \W characters
+assertEquals(["+\u00a3", "=="], "+\u00a3==".match(/\W\W/g));
+
+// Latin-1 character that uppercases out of Latin-1.
+assertTrue(/\u0178/i.test('\u00ff'));
+
+// Unicode equivalence
+assertTrue(/\u039c/i.test('\u00b5'));
+assertTrue(/\u039c/i.test('\u03bc'));
+assertTrue(/\u00b5/i.test('\u03bc'));
+// Unicode equivalence ranges
+assertTrue(/[\u039b-\u039d]/i.test('\u00b5'));
+assertFalse(/[^\u039b-\u039d]/i.test('\u00b5'));
+assertFalse(/[\u039b-\u039d]/.test('\u00b5'));
+assertTrue(/[^\u039b-\u039d]/.test('\u00b5'));
+
+// Check a regression in QuoteJsonSlow and WriteQuoteJsonString
+for (var testNumber = 0; testNumber < 2; testNumber++) {
+ var testString = "\xdc";
+ var loopLength = testNumber == 0 ? 0 : 20;
+ for (var i = 0; i < loopLength; i++ ) {
+ testString += testString;
+ }
+ var stringified = JSON.stringify({"test" : testString}, null, 0);
+ var stringifiedExpected = '{"test":"' + testString + '"}';
+ assertEquals(stringifiedExpected, stringified);
+}
diff --git a/test/mjsunit/regress/regress-lazy-deopt-inlining.js b/test/mjsunit/regress/regress-lazy-deopt-inlining.js
new file mode 100644
index 0000000..6cda168
--- /dev/null
+++ b/test/mjsunit/regress/regress-lazy-deopt-inlining.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+function f1(d) {
+ return 1 + f2(f3(d));
+}
+
+function f2(v) { return v; }
+
+function f3(d) {
+ if (d) %DeoptimizeFunction(f1);
+ return 2;
+}
+
+%NeverOptimizeFunction(f3);
+
+f1(false);
+f1(false);
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(3, f1(true));
diff --git a/test/mjsunit/regress/regress-lazy-deopt-inlining2.js b/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
new file mode 100644
index 0000000..7b73b14
--- /dev/null
+++ b/test/mjsunit/regress/regress-lazy-deopt-inlining2.js
@@ -0,0 +1,24 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+"use strict";
+function f1(d) {
+ return 1 + f2(1, f3(d), d);
+}
+
+function f2(v0, v1, v2) { return v1; }
+
+function f3(d) {
+ if (d) %DeoptimizeFunction(f1);
+ return 2;
+}
+
+%NeverOptimizeFunction(f3);
+
+f1(false);
+f1(false);
+%OptimizeFunctionOnNextCall(f1);
+assertEquals(3, f1(true));
diff --git a/test/mjsunit/regress/regress-load-elements.js b/test/mjsunit/regress/regress-load-elements.js
new file mode 100644
index 0000000..68cdc8e
--- /dev/null
+++ b/test/mjsunit/regress/regress-load-elements.js
@@ -0,0 +1,49 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function bad_func(o,a) {
+ for (var i = 0; i < 1; ++i) {
+ o.prop = 0;
+ var x = a[0];
+ }
+}
+
+o = new Object();
+a = {};
+a[0] = 1;
+bad_func(o, a);
+
+o = new Object();
+bad_func(o, a);
+
+// Optimize. Before the fix, the elements-load and subsequent fixed-array-length
+// were hoisted above the map check. This is invalid since not all types
+// necessarily have elements.
+%OptimizeFunctionOnNextCall(bad_func);
+bad_func(o, "");
diff --git a/test/mjsunit/regress/regress-load-field-by-index.js b/test/mjsunit/regress/regress-load-field-by-index.js
new file mode 100644
index 0000000..c572c1e
--- /dev/null
+++ b/test/mjsunit/regress/regress-load-field-by-index.js
@@ -0,0 +1,22 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {a:1.5, b:{}};
+
+function f(o) {
+ var result = [];
+ for (var k in o) {
+ result[result.length] = o[k];
+ }
+ return result;
+}
+
+f(o);
+f(o);
+%OptimizeFunctionOnNextCall(f);
+var array = f(o);
+o.a = 1.7;
+assertEquals(1.5, array[0]);
diff --git a/test/mjsunit/regress/regress-map-invalidation-1.js b/test/mjsunit/regress/regress-map-invalidation-1.js
new file mode 100644
index 0000000..430972b
--- /dev/null
+++ b/test/mjsunit/regress/regress-map-invalidation-1.js
@@ -0,0 +1,47 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var c = { x: 2, y: 1 };
+
+function h() {
+ %TryMigrateInstance(c);
+ return 2;
+}
+%NeverOptimizeFunction(h);
+
+function f() {
+ for (var i = 0; i < 100000; i++) {
+ var n = c.x + h();
+ assertEquals(4, n);
+ }
+ var o2 = [{ x: 2.5, y:1 }];
+ return o2;
+}
+
+f();
diff --git a/test/mjsunit/regress/regress-map-invalidation-2.js b/test/mjsunit/regress/regress-map-invalidation-2.js
new file mode 100644
index 0000000..1f896a4
--- /dev/null
+++ b/test/mjsunit/regress/regress-map-invalidation-2.js
@@ -0,0 +1,54 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var c = { x: 2, y: 1 };
+
+function g() {
+ var outer = { foo: 1 };
+ function f(b, c) {
+ var n = outer.foo;
+ for (var i = 0; i < 10; i++) {
+ n += c.x + outer.foo;
+ }
+ if (b) return [{ x: 1.5, y: 1 }];
+ else return c;
+ }
+ // Clear type feedback from previous stress runs.
+ %ClearFunctionTypeFeedback(f);
+ return f;
+}
+
+var fun = g();
+fun(false, c);
+fun(false, c);
+fun(false, c);
+%OptimizeFunctionOnNextCall(fun);
+fun(false, c);
+fun(true, c);
+assertOptimized(fun);
diff --git a/test/mjsunit/regress/regress-mask-array-length.js b/test/mjsunit/regress/regress-mask-array-length.js
new file mode 100644
index 0000000..bd87e7c
--- /dev/null
+++ b/test/mjsunit/regress/regress-mask-array-length.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [];
+var o = {
+ __proto__: a
+};
+Object.preventExtensions(o);
+o.length = 'abc';
diff --git a/test/mjsunit/regress/regress-merge-descriptors.js b/test/mjsunit/regress/regress-merge-descriptors.js
new file mode 100644
index 0000000..a84a625
--- /dev/null
+++ b/test/mjsunit/regress/regress-merge-descriptors.js
@@ -0,0 +1,92 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var extend = function (d, b) {
+ function __() { this.constructor = d; }
+ __.prototype = b.prototype;
+ d.prototype = new __();
+};
+
+var Car = (function (Super) {
+ var Car = function () {
+ var self = this;
+
+ Super.call(self);
+
+ Object.defineProperties(self, {
+ "make": {
+ enumerable: true,
+ configurable: true,
+ get: function () {
+ return "Ford";
+ }
+ }
+ });
+
+ self.copy = function () {
+ throw new Error("Meant to be overriden");
+ };
+
+ return self;
+ };
+
+ extend(Car, Super);
+
+ return Car;
+}(Object));
+
+
+var SuperCar = ((function (Super) {
+ var SuperCar = function (make) {
+ var self = this;
+
+ Super.call(self);
+
+
+ Object.defineProperties(self, {
+ "make": {
+ enumerable: true,
+ configurable: true,
+ get: function () {
+ return make;
+ }
+ }
+ });
+
+ // Convert self.copy from CONSTANT to FIELD.
+ self.copy = function () { };
+
+ return self;
+ };
+ extend(SuperCar, Super);
+ return SuperCar;
+})(Car));
+
+assertEquals("Ford", new Car().make);
+assertEquals("Bugatti", new SuperCar("Bugatti").make);
+assertEquals("Lambo", new SuperCar("Lambo").make);
+assertEquals("Shelby", new SuperCar("Shelby").make);
diff --git a/test/mjsunit/regress/regress-migrate-callbacks.js b/test/mjsunit/regress/regress-migrate-callbacks.js
new file mode 100644
index 0000000..b1979ea
--- /dev/null
+++ b/test/mjsunit/regress/regress-migrate-callbacks.js
@@ -0,0 +1,11 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var o1 = {};
+o1.x = 1
+o1.y = 1.5
+var o2 = {}
+o2.x = 1.5;
+o2.__defineSetter__('y', function(v) { });
+o1.y;
diff --git a/test/mjsunit/regress/regress-mul-canoverflow.js b/test/mjsunit/regress/regress-mul-canoverflow.js
new file mode 100644
index 0000000..e3e21ca
--- /dev/null
+++ b/test/mjsunit/regress/regress-mul-canoverflow.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom(a) {
+ return ((a | 0) * (a | 0)) | 0;
+}
+function boom_unoptimized(a) {
+ try {} catch(_) {}
+ return ((a | 0) * (a | 0)) | 0;
+}
+
+boom(1, 1);
+boom(2, 2);
+
+%OptimizeFunctionOnNextCall(boom);
+var big_int = 0x5F00000F;
+var expected = boom_unoptimized(big_int);
+var actual = boom(big_int)
+assertEquals(expected, actual);
diff --git a/test/mjsunit/regress/regress-mul-canoverflowb.js b/test/mjsunit/regress/regress-mul-canoverflowb.js
new file mode 100644
index 0000000..4203ac4
--- /dev/null
+++ b/test/mjsunit/regress/regress-mul-canoverflowb.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function boom(a) {
+ return ((a | 0) * (a | 0)) | 0;
+}
+%NeverOptimizeFunction(boom_unoptimized);
+function boom_unoptimized(a) {
+ return ((a | 0) * (a | 0)) | 0;
+}
+
+boom(1, 1);
+boom(2, 2);
+
+%OptimizeFunctionOnNextCall(boom);
+var big_int = 0x5F00000F;
+var expected = boom_unoptimized(big_int);
+var actual = boom(big_int)
+assertEquals(expected, actual);
diff --git a/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js b/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
new file mode 100644
index 0000000..658d776
--- /dev/null
+++ b/test/mjsunit/regress/regress-no-dummy-use-for-arguments-object.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function g() {
+ arguments.length;
+}
+
+var global = "";
+
+function f() {
+ global.dummy = this;
+ g({});
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
diff --git a/test/mjsunit/regress/regress-observe-map-cache.js b/test/mjsunit/regress/regress-observe-map-cache.js
new file mode 100644
index 0000000..4c7a7e3
--- /dev/null
+++ b/test/mjsunit/regress/regress-observe-map-cache.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --enable-slow-asserts
+
+function f() {
+ var x = new Array(0);
+ x[-1] = -1;
+ Object.observe(x, function() { });
+}
+
+f();
+f();
diff --git a/test/mjsunit/regress/regress-omit-checks.js b/test/mjsunit/regress/regress-omit-checks.js
new file mode 100644
index 0000000..e5d5074
--- /dev/null
+++ b/test/mjsunit/regress/regress-omit-checks.js
@@ -0,0 +1,55 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var a = {x:1};
+var a_deprecate = {x:1};
+a_deprecate.x = 1.5;
+function create() {
+ return {__proto__:a, y:1};
+}
+var b1 = create();
+var b2 = create();
+var b3 = create();
+var b4 = create();
+
+function set(b) {
+ b.x = 5;
+ b.z = 10;
+}
+
+set(b1);
+set(b2);
+%OptimizeFunctionOnNextCall(set);
+set(b3);
+var called = false;
+a.x = 1.5;
+Object.defineProperty(a, "z", {set:function(v) { called = true; }});
+set(b4);
+assertTrue(called);
+assertEquals(undefined, b4.z);
diff --git a/test/mjsunit/regress/regress-opt-after-debug-deopt.js b/test/mjsunit/regress/regress-opt-after-debug-deopt.js
new file mode 100644
index 0000000..5cbaabc
--- /dev/null
+++ b/test/mjsunit/regress/regress-opt-after-debug-deopt.js
@@ -0,0 +1,77 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+// Flags: --turbo-deoptimization
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+Debug = debug.Debug;
+
+function listener(event, exec_state, event_data, data) {
+ if (event != Debug.DebugEvent.Break) return;
+ try {
+ assertEquals("foo", exec_state.frame(0).evaluate("a").value());
+ } catch (e) {
+ exception = e;
+ };
+ listened++;
+};
+
+var exception = null;
+var listened = 0;
+
+var f = function() {
+ var a = "foo";
+ var b = a.substring("1");
+ [a, b].sort();
+ return a;
+}
+
+f();
+f();
+%OptimizeFunctionOnNextCall(f, "concurrent"); // Mark with builtin.
+f(); // Kick off concurrent recompilation.
+
+// After compile graph has been created...
+Debug.setListener(listener); // Activate debugger.
+Debug.setBreakPoint(f, 2, 0); // Force deopt.
+
+// At this point, concurrent recompilation is still being blocked.
+assertUnoptimized(f, "no sync");
+// Let concurrent recompilation proceed.
+%UnblockConcurrentRecompilation();
+// Sync with optimization thread. But no optimized code is installed.
+assertUnoptimized(f, "sync");
+
+f(); // Trigger break point.
+assertEquals(1, listened);
+assertNull(exception);
diff --git a/test/mjsunit/regress/regress-param-local-type.js b/test/mjsunit/regress/regress-param-local-type.js
new file mode 100644
index 0000000..bf26090
--- /dev/null
+++ b/test/mjsunit/regress/regress-param-local-type.js
@@ -0,0 +1,58 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// Test that we do not confuse the first local and the first parameter
+// when gathering type information.
+
+function f(a) { // First parameter is tagged.
+ var s = ''; // First local has string type.
+ var n = 0;
+ var i = 1;
+ n = i + a;
+}
+
+f(1);
+f(1);
+%OptimizeFunctionOnNextCall(f);
+f(1);
+assertOptimized(f);
+
+
+function g() { // 0th parameter (receiver) is tagged.
+ var s = ''; // First local has string type.
+ var n = 0;
+ var i = 1;
+ n = i + this;
+}
+
+g.call(1);
+g.call(1);
+%OptimizeFunctionOnNextCall(g);
+g.call(1);
+assertOptimized(g);
diff --git a/test/mjsunit/regress/regress-parse-object-literal.js b/test/mjsunit/regress/regress-parse-object-literal.js
new file mode 100644
index 0000000..96d63c2
--- /dev/null
+++ b/test/mjsunit/regress/regress-parse-object-literal.js
@@ -0,0 +1,29 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Should throw, not crash.
+assertThrows("var o = { get /*space*/ () {} }");
diff --git a/test/mjsunit/regress/regress-parse-use-strict.js b/test/mjsunit/regress/regress-parse-use-strict.js
new file mode 100644
index 0000000..9dd0f4c
--- /dev/null
+++ b/test/mjsunit/regress/regress-parse-use-strict.js
@@ -0,0 +1,42 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Filler long enough to trigger lazy parsing.
+var filler = "/*" + new Array(1024).join('x') + "*/";
+
+// Snippet trying to switch to strict mode.
+var strict = '"use strict"; with({}) {}';
+
+// Test switching to strict mode after string literal.
+assertThrows('function f() { "use sanity";' + strict + '}');
+assertThrows('function f() { "use sanity";' + strict + filler + '}');
+
+// Test switching to strict mode after function declaration.
+// We must use eval instead of assertDoesNotThrow here to make sure that
+// lazy parsing is triggered. Otherwise the bug won't reproduce.
+eval('function f() { function g() {}' + strict + '}');
+eval('function f() { function g() {}' + strict + filler + '}');
diff --git a/test/mjsunit/regress/regress-parseint.js b/test/mjsunit/regress/regress-parseint.js
new file mode 100644
index 0000000..05501f3
--- /dev/null
+++ b/test/mjsunit/regress/regress-parseint.js
@@ -0,0 +1,18 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+function f(string, radix) {
+ // Use a phi to force radix into heap number representation.
+ radix = (radix == 0) ? radix : (radix >> 0);
+ if (radix != 2) return NaN;
+ return %StringParseInt(string, radix);
+}
+
+assertEquals(2, (-4294967294) >> 0);
+assertEquals(3, f("11", -4294967294));
+assertEquals(NaN, f("11", -2147483650));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(3, f("11", -4294967294));
diff --git a/test/mjsunit/regress/regress-phi-truncation.js b/test/mjsunit/regress/regress-phi-truncation.js
new file mode 100644
index 0000000..940efe3
--- /dev/null
+++ b/test/mjsunit/regress/regress-phi-truncation.js
@@ -0,0 +1,89 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function test(fun, expectation) {
+ assertEquals(1, fun(1));
+ %OptimizeFunctionOnNextCall(fun);
+ assertEquals(expectation, fun(0));
+}
+
+test(function(x) {
+ var a = x ? true : false;
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : true;
+ return a | 0;
+}, 1);
+
+test(function(x) {
+ var a = x ? true : "0";
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : "1";
+ return a | 0;
+}, 1);
+
+test(function(x) {
+ var a = x ? true : "-1";
+ return a | 0;
+}, -1);
+
+test(function(x) {
+ var a = x ? true : "-0";
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : "0x1234";
+ return a | 0;
+}, 0x1234);
+
+test(function(x) {
+ var a = x ? true : { valueOf: function() { return 2; } };
+ return a | 0;
+}, 2);
+
+test(function(x) {
+ var a = x ? true : undefined;
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : null;
+ return a | 0;
+}, 0);
+
+test(function(x) {
+ var a = x ? true : "";
+ return a | 0;
+}, 0);
diff --git a/test/mjsunit/regress/regress-polymorphic-load.js b/test/mjsunit/regress/regress-polymorphic-load.js
new file mode 100644
index 0000000..2545e85
--- /dev/null
+++ b/test/mjsunit/regress/regress-polymorphic-load.js
@@ -0,0 +1,43 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(o) {
+ return o.x;
+}
+
+var o1 = {x:1};
+var o2 = {__proto__: {x:2}};
+
+f(o2);
+f(o2);
+f(o2);
+f(o1);
+%OptimizeFunctionOnNextCall(f);
+assertEquals(1, f(o1));
+assertEquals(2, f(o2));
diff --git a/test/mjsunit/regress/regress-polymorphic-store.js b/test/mjsunit/regress/regress-polymorphic-store.js
new file mode 100644
index 0000000..4723a7f
--- /dev/null
+++ b/test/mjsunit/regress/regress-polymorphic-store.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+var o1 = {};
+o1.f1 = function() { return 10; };
+o1.x = 5;
+o1.y = 2;
+var o2 = {};
+o2.x = 5;
+o2.y = 5;
+
+function store(o, v) {
+ o.y = v;
+}
+
+store(o2, 0);
+store(o1, 0);
+store(o2, 0);
+%OptimizeFunctionOnNextCall(store);
+store(o1, 10);
+assertEquals(5, o1.x);
+assertEquals(10, o1.y);
diff --git a/test/mjsunit/regress/regress-prepare-break-while-recompile.js b/test/mjsunit/regress/regress-prepare-break-while-recompile.js
new file mode 100644
index 0000000..0aedcab
--- /dev/null
+++ b/test/mjsunit/regress/regress-prepare-break-while-recompile.js
@@ -0,0 +1,67 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-debug-as debug --allow-natives-syntax
+// Flags: --concurrent-recompilation --block-concurrent-recompilation
+
+if (!%IsConcurrentRecompilationSupported()) {
+ print("Concurrent recompilation is disabled. Skipping this test.");
+ quit();
+}
+
+Debug = debug.Debug
+
+function foo() {
+ var x = 1;
+ return x;
+}
+
+function bar() {
+ var x = 2;
+ return x;
+}
+
+foo();
+// Mark and kick off recompilation.
+%OptimizeFunctionOnNextCall(foo, "concurrent");
+foo();
+
+// Set break points on an unrelated function. This clears both optimized
+// and (shared) unoptimized code on foo, and sets both to lazy-compile builtin.
+// Clear the break point immediately after to deactivate the debugger.
+// Do all of this after compile graph has been created.
+Debug.setBreakPoint(bar, 0, 0);
+Debug.clearAllBreakPoints();
+
+// At this point, concurrent recompilation is still blocked.
+assertUnoptimized(foo, "no sync");
+// Let concurrent recompilation proceed.
+%UnblockConcurrentRecompilation();
+
+// Install optimized code when concurrent optimization finishes.
+// This needs to be able to deal with shared code being a builtin.
+assertUnoptimized(foo, "sync");
diff --git a/test/mjsunit/regress/regress-put-prototype-transition.js b/test/mjsunit/regress/regress-put-prototype-transition.js
new file mode 100644
index 0000000..f720bd6
--- /dev/null
+++ b/test/mjsunit/regress/regress-put-prototype-transition.js
@@ -0,0 +1,49 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax --expose-gc --stress-compaction --gc-interval=255
+
+function deepEquals(a, b) { if (a === b) { if (a === 0) return (1 / a) === (1 / b); return true; } if (typeof a != typeof b) return false; if (typeof a == "number") return isNaN(a) && isNaN(b); if (typeof a !== "object" && typeof a !== "function") return false; var objectClass = classOf(a); if (objectClass !== classOf(b)) return false; if (objectClass === "RegExp") { return (a.toString() === b.toString()); } if (objectClass === "Function") return false; if (objectClass === "Array") { var elementCount = 0; if (a.length != b.length) { return false; } for (var i = 0; i < a.length; i++) { if (!deepEquals(a[i], b[i])) return false; } return true; } if (objectClass == "String" || objectClass == "Number" || objectClass == "Boolean" || objectClass == "Date") { if (a.valueOf() !== b.valueOf()) return false; } return deepObjectEquals(a, b); }
+assertSame = function assertSame(expected, found, name_opt) { if (found === expected) { if (expected !== 0 || (1 / expected) == (1 / found)) return; } else if ((expected !== expected) && (found !== found)) { return; } fail(PrettyPrint(expected), found, name_opt); }; assertEquals = function assertEquals(expected, found, name_opt) { if (!deepEquals(found, expected)) { fail(PrettyPrint(expected), found, name_opt); } };
+assertEqualsDelta = function assertEqualsDelta(expected, found, delta, name_opt) { assertTrue(Math.abs(expected - found) <= delta, name_opt); }; assertArrayEquals = function assertArrayEquals(expected, found, name_opt) { var start = ""; if (name_opt) { start = name_opt + " - "; } assertEquals(expected.length, found.length, start + "array length"); if (expected.length == found.length) { for (var i = 0; i < expected.length; ++i) { assertEquals(expected[i], found[i], start + "array element at index " + i); } } };
+assertTrue = function assertTrue(value, name_opt) { assertEquals(true, value, name_opt); };
+assertFalse = function assertFalse(value, name_opt) { assertEquals(false, value, name_opt); };
+// End stripped down and modified version of mjsunit.js.
+
+var __v_0 = {};
+var __v_1 = {};
+function __f_3() { }
+function __f_4(obj) {
+ for (var __v_2 = 0; __v_2 < 26; __v_2++) {
+ obj["__v_5" + __v_2] = 0;
+ }
+}
+function __f_0(__v_1, __v_6) {
+ (new __f_3()).__proto__ = __v_1;
+}
+%DebugPrint(undefined);
+function __f_1(__v_4, add_first, __v_6, same_map_as) {
+ var __v_1 = __v_4 ? new __f_3() : {};
+ assertTrue(%HasFastProperties(__v_1));
+ if (add_first) {
+ __f_4(__v_1);
+ assertFalse(%HasFastProperties(__v_1));
+ __f_0(__v_1, __v_6);
+ assertTrue(%HasFastProperties(__v_1));
+ } else {
+ __f_0(__v_1, __v_6);
+ assertTrue(%HasFastProperties(__v_1));
+ __f_4(__v_1);
+ assertFalse(%HasFastProperties(__v_1));
+ }
+}
+gc();
+for (var __v_2 = 0; __v_2 < 4; __v_2++) {
+ var __v_6 = ((__v_2 & 2) != 7);
+ var __v_4 = ((__v_2 & 2) != 0);
+ __f_1(__v_4, true, __v_6);
+ var __v_0 = __f_1(__v_4, false, __v_6);
+ __f_1(__v_4, false, __v_6, __v_0);
+}
+__v_5 = {a: 1, b: 2, c: 3};
diff --git a/test/mjsunit/regress/regress-regexp-construct-result.js b/test/mjsunit/regress/regress-regexp-construct-result.js
new file mode 100644
index 0000000..84bdd20
--- /dev/null
+++ b/test/mjsunit/regress/regress-regexp-construct-result.js
@@ -0,0 +1,45 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Create a huge regexp with many alternative capture groups, most of
+// which do not capture anything, but the corresponding capture slot
+// in the result object has to exist, even though filled with undefined.
+// Having a large result array helps stressing GC.
+
+var num_captures = 1000;
+var regexp_string = "(a)";
+for (var i = 0; i < num_captures - 1; i++) {
+ regexp_string += "|(b)";
+}
+var regexp = new RegExp(regexp_string);
+
+for (var i = 0; i < 10; i++) {
+ var matches = regexp.exec("a");
+ var count = 0;
+ matches.forEach(function() { count++; });
+ assertEquals(num_captures + 1, count);
+}
diff --git a/test/mjsunit/regress/regress-regexp-nocase.js b/test/mjsunit/regress/regress-regexp-nocase.js
new file mode 100644
index 0000000..27637da
--- /dev/null
+++ b/test/mjsunit/regress/regress-regexp-nocase.js
@@ -0,0 +1,30 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+var s = "('')x\nx\uF670";
+
+assertEquals(s.match(/\((').*\1\)/i), ["('')", "'"]);
diff --git a/test/mjsunit/regress/regress-reset-dictionary-elements.js b/test/mjsunit/regress/regress-reset-dictionary-elements.js
new file mode 100644
index 0000000..d3d093e
--- /dev/null
+++ b/test/mjsunit/regress/regress-reset-dictionary-elements.js
@@ -0,0 +1,14 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+var a = [];
+a[10000] = 1;
+a.length = 0;
+a[1] = 1;
+a.length = 0;
+assertEquals(undefined, a[1]);
+
+var o = {};
+Object.freeze(o);
+assertEquals(undefined, o[1]);
diff --git a/test/mjsunit/regress/regress-seqstrsetchar-ex1.js b/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
new file mode 100644
index 0000000..1fd8d81
--- /dev/null
+++ b/test/mjsunit/regress/regress-seqstrsetchar-ex1.js
@@ -0,0 +1,59 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+// stubbed version of ToNumber
+function ToNumber(x) {
+ return 311;
+}
+
+// Reduced version of String.fromCharCode;
+// does not actually do the same calculation but exhibits untagging bug.
+function StringFromCharCode(code) {
+ var n = %_ArgumentsLength();
+ var one_byte = %NewString(n, true);
+ var i;
+ for (i = 0; i < n; i++) {
+ var code = %_Arguments(i);
+ if (!%_IsSmi(code)) code = ToNumber(code) & 0xffff;
+ if (code > 0xff) break;
+ }
+
+ var two_byte = %NewString(n - i, false);
+ for (var j = 0; i < n; i++, j++) {
+ var code = %_Arguments(i);
+ %_TwoByteSeqStringSetChar(j, code, two_byte);
+ }
+ return one_byte + two_byte;
+}
+
+StringFromCharCode(0xFFF, 0xFFF);
+StringFromCharCode(0x7C, 0x7C);
+%OptimizeFunctionOnNextCall(StringFromCharCode);
+StringFromCharCode(0x7C, 0x7C);
+StringFromCharCode(0xFFF, 0xFFF);
diff --git a/test/mjsunit/regress/regress-seqstrsetchar-ex2.js b/test/mjsunit/regress/regress-seqstrsetchar-ex2.js
new file mode 100644
index 0000000..6a5ba91
--- /dev/null
+++ b/test/mjsunit/regress/regress-seqstrsetchar-ex2.js
@@ -0,0 +1,34 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+String.fromCharCode(0xFFF, 0xFFF);
+String.fromCharCode(0x7C, 0x7C);
+%OptimizeFunctionOnNextCall(String.fromCharCode);
+String.fromCharCode(0x7C, 0x7C);
+String.fromCharCode(0xFFF, 0xFFF);
diff --git a/test/mjsunit/regress/regress-seqstrsetchar-ex3.js b/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
new file mode 100644
index 0000000..0a6b211
--- /dev/null
+++ b/test/mjsunit/regress/regress-seqstrsetchar-ex3.js
@@ -0,0 +1,44 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function test() {
+ var string = %NewString(10, true);
+ for (var i = 0; i < 10; i++) {
+ %_OneByteSeqStringSetChar(i, 65, string);
+ %_OneByteSeqStringSetChar(i, 66, string);
+ }
+ for (var i = 0; i < 10; i++) {
+ assertEquals("B", string[i]);
+ }
+}
+
+test();
+test();
+%OptimizeFunctionOnNextCall(test);
+test();
diff --git a/test/mjsunit/regress/regress-set-flags-stress-compact.js b/test/mjsunit/regress/regress-set-flags-stress-compact.js
new file mode 100644
index 0000000..5bc59a7
--- /dev/null
+++ b/test/mjsunit/regress/regress-set-flags-stress-compact.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+%SetFlags("--gc-interval=164 --stress-compaction");
+
+var a = [];
+for (var i = 0; i < 10000; i++) { a[i * 100] = 0; }
diff --git a/test/mjsunit/regress/regress-sliced-external-cons-regexp.js b/test/mjsunit/regress/regress-sliced-external-cons-regexp.js
new file mode 100644
index 0000000..145c831
--- /dev/null
+++ b/test/mjsunit/regress/regress-sliced-external-cons-regexp.js
@@ -0,0 +1,21 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --expose-externalize-string --expose-gc
+
+var re = /(B)/;
+var cons1 = "0123456789" + "ABCDEFGHIJ";
+var cons2 = "0123456789\u1234" + "ABCDEFGHIJ";
+gc();
+gc(); // Promote cons.
+
+try { externalizeString(cons1, false); } catch (e) { }
+try { externalizeString(cons2, true); } catch (e) { }
+
+var slice1 = cons1.slice(1,-1);
+var slice2 = cons2.slice(1,-1);
+for (var i = 0; i < 10; i++) {
+ assertEquals(["B", "B"], re.exec(slice1));
+ assertEquals(["B", "B"], re.exec(slice2));
+}
diff --git a/test/mjsunit/regress/regress-smi-math-floor-round.js b/test/mjsunit/regress/regress-smi-math-floor-round.js
new file mode 100644
index 0000000..7c033a3
--- /dev/null
+++ b/test/mjsunit/regress/regress-smi-math-floor-round.js
@@ -0,0 +1,67 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+
+function f(o) {
+ return Math.floor(o.x_smi) + 1;
+}
+
+assertEquals(2, f({x_smi:1}));
+assertEquals(2, f({x_smi:1}));
+%OptimizeFunctionOnNextCall(f);
+assertEquals(2, f({x_smi:1}));
+
+function f2(o) {
+ return Math.floor(o.x_tagged) + 1;
+}
+
+var o = {x_tagged:{}};
+o.x_tagged = 1.4;
+assertEquals(2, f2(o));
+assertEquals(2, f2(o));
+%OptimizeFunctionOnNextCall(f2);
+assertEquals(2, f2(o));
+
+function f3(o) {
+ return Math.round(o.x_smi) + 1;
+}
+
+assertEquals(2, f3({x_smi:1}));
+assertEquals(2, f3({x_smi:1}));
+%OptimizeFunctionOnNextCall(f3);
+assertEquals(2, f3({x_smi:1}));
+
+function f4(o) {
+ return Math.round(o.x_tagged) + 1;
+}
+
+assertEquals(2, f4(o));
+assertEquals(2, f4(o));
+%OptimizeFunctionOnNextCall(f4);
+assertEquals(2, f4(o));
diff --git a/test/mjsunit/regress/regress-smi-only-concat.js b/test/mjsunit/regress/regress-smi-only-concat.js
index a9a6d89..55ca299 100644
--- a/test/mjsunit/regress/regress-smi-only-concat.js
+++ b/test/mjsunit/regress/regress-smi-only-concat.js
@@ -33,5 +33,5 @@
var fast_array = ['a', 'b'];
var array = fast_array.concat(fast_array);
-assertTrue(%HasFastElements(fast_array));
-assertTrue(%HasFastElements(array));
\ No newline at end of file
+assertTrue(%HasFastObjectElements(fast_array));
+assertTrue(%HasFastObjectElements(array));
diff --git a/test/mjsunit/regress/regress-sort-arguments.js b/test/mjsunit/regress/regress-sort-arguments.js
new file mode 100644
index 0000000..54ebeb1
--- /dev/null
+++ b/test/mjsunit/regress/regress-sort-arguments.js
@@ -0,0 +1,10 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function f(a) { return arguments; }
+var a = f(1,2,3);
+delete a[1];
+Array.prototype.sort.apply(a);
+a[10000000] = 4;
+Array.prototype.sort.apply(a);
diff --git a/test/mjsunit/regress/regress-store-global-proxy.js b/test/mjsunit/regress/regress-store-global-proxy.js
new file mode 100644
index 0000000..c85531c
--- /dev/null
+++ b/test/mjsunit/regress/regress-store-global-proxy.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+delete Object.prototype.__proto__;
+
+function f() {
+ this.toString = 1;
+}
+
+f.apply({});
+f();
diff --git a/test/mjsunit/regress/regress-store-heapobject.js b/test/mjsunit/regress/regress-store-heapobject.js
new file mode 100644
index 0000000..9f2a1b8
--- /dev/null
+++ b/test/mjsunit/regress/regress-store-heapobject.js
@@ -0,0 +1,27 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+var o = {a: undefined};
+
+function store(o, v) {
+ o.a = v;
+}
+
+store(o, undefined);
+store(o, undefined);
+
+function f(bool) {
+ var o = {a: undefined};
+ if (bool) {
+ store(o, 1);
+ }
+ return o;
+}
+
+f(false);
+f(false);
+%OptimizeFunctionOnNextCall(f);
+f(true);
diff --git a/test/mjsunit/regress/regress-store-uncacheable.js b/test/mjsunit/regress/regress-store-uncacheable.js
new file mode 100644
index 0000000..e9c9fc2
--- /dev/null
+++ b/test/mjsunit/regress/regress-store-uncacheable.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f() {
+ var o = {};
+ o["<abc>"] = 123;
+}
+
+f();
+f();
+f();
+%OptimizeFunctionOnNextCall(f);
+f();
+assertOptimized(f);
diff --git a/test/mjsunit/regress/regress-transcendental.js b/test/mjsunit/regress/regress-transcendental.js
new file mode 100644
index 0000000..4065f50
--- /dev/null
+++ b/test/mjsunit/regress/regress-transcendental.js
@@ -0,0 +1,48 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --expose-gc
+
+// Test whether the runtime implementation and generated code of
+// sine and tangens return the same results.
+
+function test(f, x, name) {
+ // Reset transcendental cache.
+ gc();
+ // Initializing cache leads to a runtime call.
+ var runtime_result = f(x);
+ // Flush transcendental cache entries and optimize f.
+ for (var i = 0; i < 100000; i++) f(i);
+ // Calculate using generated code.
+ var gencode_result = f(x);
+ print(name + " runtime function: " + runtime_result);
+ print(name + " generated code : " + gencode_result);
+ assertEquals(gencode_result, runtime_result);
+}
+
+test(Math.tan, -1.57079632679489660000, "Math.tan");
+test(Math.sin, 6.283185307179586, "Math.sin");
diff --git a/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js b/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
new file mode 100644
index 0000000..9e6ec9d
--- /dev/null
+++ b/test/mjsunit/regress/regress-undefined-store-keyed-fast-element.js
@@ -0,0 +1,37 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function f(v) {
+ return [0.0, 0.1, 0.2, v];
+}
+
+assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
+assertEquals([0.0, 0.1, 0.2, NaN], f(NaN));
+%OptimizeFunctionOnNextCall(f);
+assertEquals([0.0, 0.1, 0.2, undefined], f(undefined));
diff --git a/test/mjsunit/regress/regress-update-field-type-attributes.js b/test/mjsunit/regress/regress-update-field-type-attributes.js
new file mode 100644
index 0000000..c23d062
--- /dev/null
+++ b/test/mjsunit/regress/regress-update-field-type-attributes.js
@@ -0,0 +1,12 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+function test(){
+ function InnerClass(){}
+ var container = {field: new InnerClass()};
+ return Object.freeze(container);
+};
+
+assertTrue(Object.isFrozen(test()));
+assertTrue(Object.isFrozen(test()));
diff --git a/test/mjsunit/regress/regress-x87.js b/test/mjsunit/regress/regress-x87.js
new file mode 100644
index 0000000..60380a8
--- /dev/null
+++ b/test/mjsunit/regress/regress-x87.js
@@ -0,0 +1,48 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --noenable-sse2
+
+// Regression for register allocation.
+var x;
+var a = new Float32Array([1,2, 4, 6, 8, 11, NaN, 1/0, -3])
+var val = 2.1*a[1]*a[0]*a[1*2*3*0]*a[1*1]*1.0;
+assertEquals(8.4, val);
+
+// Regression for double-phis
+var a;
+var t = true;
+var res = [2.5, 2];
+for (var i = 0; i < 2; i++) {
+ if (t) {
+ a = 1.5;
+ } else {
+ a = true;
+ }
+ assertEquals(res[i], a+1);
+ t = false;
+}
diff --git a/test/mjsunit/regress/setter.js b/test/mjsunit/regress/setter.js
new file mode 100644
index 0000000..e3a8000
--- /dev/null
+++ b/test/mjsunit/regress/setter.js
@@ -0,0 +1,66 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+function s(v) {
+ v.x = 1;
+}
+
+function c(p) {
+ return {__proto__: p};
+}
+
+var p = {};
+
+var o1 = c(p);
+var o2 = c(p);
+var o3 = c(p);
+var o4 = c(p);
+var o5 = c(p);
+
+// Initialize the store IC.
+s(o1);
+s(o2);
+
+// Install a setter on p.x
+var count = 0;
+Object.defineProperty(p, "x", {
+ set: function(x) {
+ count += 1;
+ }
+});
+
+// Verify that the setter was called directly.
+o3.x = 20;
+assertEquals(1, count);
+
+// Verify that monomorphic prototype failure is triggered in the IC.
+s(o4);
+assertEquals(2, count);
+
+// Verify that the newly installed IC is correct.
+s(o5);
+assertEquals(3, count);
diff --git a/test/mjsunit/regress/setvalueof-deopt.js b/test/mjsunit/regress/setvalueof-deopt.js
new file mode 100644
index 0000000..8c42c8a
--- /dev/null
+++ b/test/mjsunit/regress/setvalueof-deopt.js
@@ -0,0 +1,42 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax
+
+function g(x, y) {
+ return y;
+}
+
+function f(deopt) {
+ return g(%_SetValueOf(1, 1), deopt + 0);
+}
+
+f(0);
+f(0);
+f(0);
+%OptimizeFunctionOnNextCall(f);
+assertEquals("result0", f("result"));
diff --git a/test/mjsunit/regress/string-compare-memcmp.js b/test/mjsunit/regress/string-compare-memcmp.js
new file mode 100644
index 0000000..45f4734
--- /dev/null
+++ b/test/mjsunit/regress/string-compare-memcmp.js
@@ -0,0 +1,7 @@
+// Copyright 2012 the V8 project authors. All rights reserved.
+// Use of this source code is governed by a BSD-style license that can be
+// found in the LICENSE file.
+
+// Flags: --allow-natives-syntax
+
+assertEquals(-1, %StringCompare("abc\u0102", "abc\u0201"));
diff --git a/test/mjsunit/regress/string-set-char-deopt.js b/test/mjsunit/regress/string-set-char-deopt.js
new file mode 100644
index 0000000..c8e8538
--- /dev/null
+++ b/test/mjsunit/regress/string-set-char-deopt.js
@@ -0,0 +1,85 @@
+// Copyright 2014 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Flags: --allow-natives-syntax --turbo-deoptimization
+
+(function OneByteSeqStringSetCharDeoptOsr() {
+ function deopt() {
+ %DeoptimizeFunction(f);
+ }
+
+ function f(string, osr) {
+ var world = " world";
+ %_OneByteSeqStringSetChar(0, (deopt(), 0x48), string);
+
+ if (osr) while (%GetOptimizationStatus(f) == 2) {}
+
+ return string + world;
+ }
+
+ assertEquals("Hello " + "world", f("hello", false));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("Hello " + "world", f("hello", true));
+})();
+
+
+(function OneByteSeqStringSetCharDeopt() {
+ function deopt() {
+ %DeoptimizeFunction(f);
+ }
+
+ function g(x) {
+ }
+
+ function f(string) {
+ g(%_OneByteSeqStringSetChar(0, (deopt(), 0x48), string));
+ return string;
+ }
+
+ assertEquals("Hell" + "o", f("hello"));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("Hell" + "o", f("hello"));
+})();
+
+
+(function TwoByteSeqStringSetCharDeopt() {
+ function deopt() {
+ %DeoptimizeFunction(f);
+ }
+
+ function g(x) {
+ }
+
+ function f(string) {
+ g(%_TwoByteSeqStringSetChar(0, (deopt(), 0x48), string));
+ return string;
+ }
+
+ assertEquals("Hell" + "o", f("\u20ACello"));
+ %OptimizeFunctionOnNextCall(f);
+ assertEquals("Hell" + "o", f("\u20ACello"));
+})();
diff --git a/test/mjsunit/regress/string-split-monkey-patching.js b/test/mjsunit/regress/string-split-monkey-patching.js
new file mode 100644
index 0000000..ea5c867
--- /dev/null
+++ b/test/mjsunit/regress/string-split-monkey-patching.js
@@ -0,0 +1,40 @@
+// Copyright 2013 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+// * Redistributions of source code must retain the above copyright
+// notice, this list of conditions and the following disclaimer.
+// * Redistributions in binary form must reproduce the above
+// copyright notice, this list of conditions and the following
+// disclaimer in the documentation and/or other materials provided
+// with the distribution.
+// * Neither the name of Google Inc. nor the names of its
+// contributors may be used to endorse or promote products derived
+// from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test that String.prototype.split with an regexp does not call the
+// monkey-patchable Array.prototype.push or PutValue.
+
+Array.prototype.push = assertUnreachable;
+
+Object.defineProperty(Array.prototype, "0", {
+ get: assertUnreachable,
+ set: assertUnreachable });
+
+"-".split(/-/);
+"I-must-not-use-push!".split(/-/);
+"Oh-no!".split(/(-)/);
+"a".split(/(a)|(b)/);