Pull from svn bleeding_edge@3716
diff --git a/test/mjsunit/compiler/unary-add.js b/test/mjsunit/compiler/unary-add.js
new file mode 100644
index 0000000..b1fc0c2
--- /dev/null
+++ b/test/mjsunit/compiler/unary-add.js
@@ -0,0 +1,67 @@
+// Copyright 2009 the V8 project authors. All rights reserved.
+// Redistribution and use in source and binary forms, with or without
+// modification, are permitted provided that the following conditions are
+// met:
+//
+//     * Redistributions of source code must retain the above copyright
+//       notice, this list of conditions and the following disclaimer.
+//     * Redistributions in binary form must reproduce the above
+//       copyright notice, this list of conditions and the following
+//       disclaimer in the documentation and/or other materials provided
+//       with the distribution.
+//     * Neither the name of Google Inc. nor the names of its
+//       contributors may be used to endorse or promote products derived
+//       from this software without specific prior written permission.
+//
+// THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
+// "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
+// LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR
+// A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT
+// OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL,
+// SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT
+// LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE,
+// DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY
+// THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT
+// (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
+// OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
+
+// Test unary addition in various contexts.
+
+// Test value context.
+assertEquals(1, +'1');
+assertEquals(1, +1);
+assertEquals(1.12, +1.12);
+assertEquals(NaN, +undefined);
+assertEquals(NaN, +{});
+
+// Test effect context.
+assertEquals(1, eval("+'1'; 1"));
+assertEquals(1, eval("+1; 1"));
+assertEquals(1, eval("+1.12; 1"));
+assertEquals(1, eval("+undefined; 1"));
+assertEquals(1, eval("+{}; 1"));
+
+// Test test context.
+assertEquals(1, (+'1') ? 1 : 2);
+assertEquals(1, (+1) ? 1 : 2);
+assertEquals(1, (+'0') ? 2 : 1);
+assertEquals(1, (+0) ? 2 : 1);
+assertEquals(1, (+1.12) ? 1 : 2);
+assertEquals(1, (+undefined) ? 2 : 1);
+assertEquals(1, (+{}) ? 2 : 1);
+
+// Test value/test context.
+assertEquals(1, +'1' || 2);
+assertEquals(1, +1 || 2);
+assertEquals(1.12, +1.12 || 2);
+assertEquals(2, +undefined || 2);
+assertEquals(2, +{} || 2);
+
+// Test test/value context.
+assertEquals(2, +'1' && 2);
+assertEquals(2, +1 && 2);
+assertEquals(0, +'0' && 2);
+assertEquals(0, +0 && 2);
+assertEquals(2, +1.12 && 2);
+assertEquals(NaN, +undefined && 2);
+assertEquals(NaN, +{} && 2);
diff --git a/test/mjsunit/debug-step.js b/test/mjsunit/debug-step.js
index 4534218..a887514 100644
--- a/test/mjsunit/debug-step.js
+++ b/test/mjsunit/debug-step.js
@@ -79,4 +79,4 @@
 assertEquals(0, result);
 
 // Get rid of the debug event listener.
-Debug.setListener(null);
\ No newline at end of file
+Debug.setListener(null);
diff --git a/test/mjsunit/mjsunit.status b/test/mjsunit/mjsunit.status
index 41388a3..f1752b9 100644
--- a/test/mjsunit/mjsunit.status
+++ b/test/mjsunit/mjsunit.status
@@ -45,8 +45,8 @@
 # Very slow on ARM, contains no architecture dependent code.
 unicode-case-overoptimization: PASS, TIMEOUT if ($arch == arm)
 
-# Skip long running test in debug.
-regress/regress-524: PASS, SKIP if $mode == debug
+# Skip long running test in debug and allow it to timeout in release mode.
+regress/regress-524: (PASS || TIMEOUT), SKIP if $mode == debug
 
 [ $arch == arm ]
 
diff --git a/test/mjsunit/bugs/bug-223.js b/test/mjsunit/regress/regress-580.js
similarity index 64%
rename from test/mjsunit/bugs/bug-223.js
rename to test/mjsunit/regress/regress-580.js
index 04b296b..c6b3db7 100644
--- a/test/mjsunit/bugs/bug-223.js
+++ b/test/mjsunit/regress/regress-580.js
@@ -1,4 +1,4 @@
-// Copyright 2008 the V8 project authors. All rights reserved.
+// Copyright 2010 the V8 project authors. All rights reserved.
 // Redistribution and use in source and binary forms, with or without
 // modification, are permitted provided that the following conditions are
 // met:
@@ -25,15 +25,31 @@
 // (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE
 // OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
 
-// When calling user-defined functions on strings, booleans or
-// numbers, we should create a wrapper object.
+// Test constant folding of smi operations that overflow a 32-bit int
+// See http://code.google.com/p/v8/issues/detail?id=580
 
-function TypeOfThis() { return typeof this; }
+function num_ops() {
+  var x;
+  var tmp = 0;
+  x = (tmp = 1578221999, tmp)+(tmp = 572285336, tmp);
+  assertEquals(2150507335, x);
+  x = 1578221999 + 572285336;
+  assertEquals(2150507335, x);
 
-String.prototype.TypeOfThis = TypeOfThis;
-Boolean.prototype.TypeOfThis = TypeOfThis;
-Number.prototype.TypeOfThis = TypeOfThis;
+  x = (tmp = -1500000000, tmp)+(tmp = -2000000000, tmp);
+  assertEquals(-3500000000, x);
+  x = -1500000000 + -2000000000;
+  assertEquals(-3500000000, x);
 
-assertEquals('object', 'xxx'.TypeOfThis());
-assertEquals('object', true.TypeOfThis());
-assertEquals('object', (42).TypeOfThis());
+  x = (tmp = 1578221999, tmp)-(tmp = -572285336, tmp);
+  assertEquals(2150507335, x);
+  x = 1578221999 - -572285336;
+  assertEquals(2150507335, x);
+
+  x = (tmp = -1500000000, tmp)-(tmp = 2000000000, tmp);
+  assertEquals(-3500000000, x);
+  x = -1500000000 - 2000000000;
+  assertEquals(-3500000000, x);
+}
+
+num_ops();
diff --git a/test/mjsunit/tools/logreader.js b/test/mjsunit/tools/logreader.js
index 8ed5ffd..8b74789 100644
--- a/test/mjsunit/tools/logreader.js
+++ b/test/mjsunit/tools/logreader.js
@@ -67,7 +67,7 @@
   var reader = new devtools.profiler.LogReader({});
 
   assertEquals([0x10000000, 0x10001000, 0xffff000, 0x10000000],
-               reader.processStack(0x10000000, ['overflow',
+               reader.processStack(0x10000000, 0, ['overflow',
                    '+1000', '-2000', '+1000']));
 })();
 
diff --git a/test/mjsunit/tools/tickprocessor-test.func-info b/test/mjsunit/tools/tickprocessor-test.func-info
new file mode 100644
index 0000000..a66b90f
--- /dev/null
+++ b/test/mjsunit/tools/tickprocessor-test.func-info
@@ -0,0 +1,29 @@
+Statistical profiling result from v8.log, (3 ticks, 0 unaccounted, 0 excluded).
+
+ [Shared libraries]:
+   ticks  total  nonlib   name
+
+ [JavaScript]:
+   ticks  total  nonlib   name
+      2   66.7%   66.7%  Stub: CompareStub_GE
+      1   33.3%   33.3%  LazyCompile: DrawLine 3d-cube.js:17
+
+ [C++]:
+   ticks  total  nonlib   name
+
+ [GC]:
+   ticks  total  nonlib   name
+      0    0.0%
+
+ [Bottom up (heavy) profile]:
+  Note: percentage shows a share of a particular caller in the total
+  amount of its parent calls.
+  Callers occupying less than 2.0% are not shown.
+
+   ticks parent  name
+      2   66.7%  Stub: CompareStub_GE
+      2  100.0%    LazyCompile: DrawLine 3d-cube.js:17
+      2  100.0%      LazyCompile: DrawQube 3d-cube.js:188
+
+      1   33.3%  LazyCompile: DrawLine 3d-cube.js:17
+      1  100.0%    LazyCompile: DrawQube 3d-cube.js:188
diff --git a/test/mjsunit/tools/tickprocessor-test.log b/test/mjsunit/tools/tickprocessor-test.log
index 75daad6..80e7ec1 100644
--- a/test/mjsunit/tools/tickprocessor-test.log
+++ b/test/mjsunit/tools/tickprocessor-test.log
@@ -6,19 +6,20 @@
 code-creation,Script,0xf541cd80,736,"exp.js"
 code-creation,Stub,0xf541d0e0,47,"RuntimeStub_Math_exp"
 code-creation,LazyCompile,0xf541d120,145,"exp native math.js:41"
+function-creation,0xf441d280,0xf541d120
 code-creation,LoadIC,0xf541d280,117,"j"
 code-creation,LoadIC,0xf541d360,63,"i"
-tick,0x80f82d1,0xffdfe880,0,0xf541ce5c
-tick,0x80f89a1,0xffdfecf0,0,0xf541ce5c
-tick,0x8123b5c,0xffdff1a0,0,0xf541d1a1,0xf541ceea
-tick,0x8123b65,0xffdff1a0,0,0xf541d1a1,0xf541ceea
-tick,0xf541d2be,0xffdff1e4,0
-tick,0xf541d320,0xffdff1dc,0
-tick,0xf541d384,0xffdff1d8,0
-tick,0xf7db94da,0xffdff0ec,0,0xf541d1a1,0xf541ceea
-tick,0xf7db951c,0xffdff0f0,0,0xf541d1a1,0xf541ceea
-tick,0xf7dbc508,0xffdff14c,0,0xf541d1a1,0xf541ceea
-tick,0xf7dbff21,0xffdff198,0,0xf541d1a1,0xf541ceea
-tick,0xf7edec90,0xffdff0ec,0,0xf541d1a1,0xf541ceea
-tick,0xffffe402,0xffdff488,0
+tick,0x80f82d1,0xffdfe880,0,0,0xf541ce5c
+tick,0x80f89a1,0xffdfecf0,0,0,0xf541ce5c
+tick,0x8123b5c,0xffdff1a0,0,0,0xf541d1a1,0xf541ceea
+tick,0x8123b65,0xffdff1a0,0,0,0xf541d1a1,0xf541ceea
+tick,0xf541d2be,0xffdff1e4,0,0
+tick,0xf541d320,0xffdff1dc,0,0
+tick,0xf541d384,0xffdff1d8,0,0
+tick,0xf7db94da,0xffdff0ec,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7db951c,0xffdff0f0,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7dbc508,0xffdff14c,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7dbff21,0xffdff198,0,0,0xf541d1a1,0xf541ceea
+tick,0xf7edec90,0xffdff0ec,0,0,0xf541d1a1,0xf541ceea
+tick,0xffffe402,0xffdff488,0,0
 profiler,"end"
diff --git a/test/mjsunit/tools/tickprocessor.js b/test/mjsunit/tools/tickprocessor.js
index 83bdac8..abcde89 100644
--- a/test/mjsunit/tools/tickprocessor.js
+++ b/test/mjsunit/tools/tickprocessor.js
@@ -334,7 +334,7 @@
   print = function(str) {
     var strSplit = str.split('\n');
     for (var i = 0; i < strSplit.length; ++i) {
-      s = strSplit[i];
+      var s = strSplit[i];
       realOut.push(s);
       if (outputPos < expectedOut.length) {
         if (expectedOut[outputPos] != s) {
@@ -400,7 +400,10 @@
       'tickprocessor-test.log', 'tickprocessor-test.ignore-unknown'],
     'GcState': [
       false, false, TickProcessor.VmStates.GC,
-      'tickprocessor-test.log', 'tickprocessor-test.gc-state']
+      'tickprocessor-test.log', 'tickprocessor-test.gc-state'],
+    'FunctionInfo': [
+      false, false, null,
+      'tickprocessor-test-func-info.log', 'tickprocessor-test.func-info']
   };
   for (var testName in testData) {
     print('=== testProcessing-' + testName + ' ===');
diff --git a/test/mjsunit/value-wrapper.js b/test/mjsunit/value-wrapper.js
index 33ef013..88330b4 100644
--- a/test/mjsunit/value-wrapper.js
+++ b/test/mjsunit/value-wrapper.js
@@ -28,6 +28,9 @@
 // When calling user-defined functions on strings, booleans or
 // numbers, we should create a wrapper object.
 
+// When running the tests use loops to ensure that the call site moves through
+// the different IC states and that both the runtime system and the generated
+// IC code is tested.
 function RunTests() {
   for (var i = 0; i < 10; i++) {
     assertEquals('object', 'xxx'.TypeOfThis());
@@ -77,6 +80,22 @@
     assertEquals('object', (42)[7]());
     assertEquals('object', (3.14)[7]());
   }
+
+  for (var i = 0; i < 10; i++) {
+    assertEquals('object', typeof 'xxx'.ObjectValueOf());
+    assertEquals('object', typeof true.ObjectValueOf());
+    assertEquals('object', typeof false.ObjectValueOf());
+    assertEquals('object', typeof (42).ObjectValueOf());
+    assertEquals('object', typeof (3.14).ObjectValueOf());
+  }
+
+  for (var i = 0; i < 10; i++) {
+    assertEquals('[object String]', 'xxx'.ObjectToString());
+    assertEquals('[object Boolean]', true.ObjectToString());
+    assertEquals('[object Boolean]', false.ObjectToString());
+    assertEquals('[object Number]', (42).ObjectToString());
+    assertEquals('[object Number]', (3.14).ObjectToString());
+  }
 }
 
 function TypeOfThis() { return typeof this; }
@@ -87,7 +106,14 @@
 Number.prototype.TypeOfThis = TypeOfThis;
 Boolean.prototype[7] = TypeOfThis;
 Number.prototype[7] = TypeOfThis;
-  
+
+String.prototype.ObjectValueOf = Object.prototype.valueOf;
+Boolean.prototype.ObjectValueOf = Object.prototype.valueOf;
+Number.prototype.ObjectValueOf = Object.prototype.valueOf;
+
+String.prototype.ObjectToString = Object.prototype.toString;
+Boolean.prototype.ObjectToString = Object.prototype.toString;
+Number.prototype.ObjectToString = Object.prototype.toString;
 
 RunTests();